Distinguished Engineer at a global bank, ambassador for Microsoft & The Linux Foundation, transforming the future one giant step at a time.
The biggest mistake we can make about quantum security is to think the problem is quantum.
Post-quantum cryptography (PQC) is no longer a research curiosity. In the fall of 2024, NIST finalized its first three (later more) post-quantum cryptographic standards, with a migration roadmap targeting the removal of quantum-vulnerable public-key cryptography from its standards by 2035. The message is clear: Start migrating now. But I believe we are missing a larger conversation.
Quantum-safe cryptography addresses a specific mathematical vulnerability. It does not make our systems resilient. And resilience, not encryption alone, will define the next era of digital trust.
The Threat Is Already Here—Just Not The One We Expected
Consider two incidents from 2024.
In the Snowflake customer breaches, attackers weren’t breaking encryption. They were logging in using stolen credentials. Mandiant identified approximately 165 potentially exposed organizations, with compromised accounts lacking multifactor authentication.
Then came the CrowdStrike outage. A faulty software update disrupted approximately 8.5 million Windows devices worldwide. Airports, financial services and critical infrastructure experienced disruptions.
Neither incident required a quantum computer. One involved compromised identities. The other involved a failure in trusted software. Both exposed an uncomfortable truth: We can have perfectly secure cryptography and still have catastrophically fragile systems.
Meanwhile, AI is making the situation more complicated. Threat intelligence from Google in 2026 documented increasingly sophisticated uses of AI in vulnerability research, exploitation and social engineering.
The attack surface is expanding faster than our traditional security boundaries.
Quantum Is Real, But The Timeline Is Not The Strategy
A sufficiently powerful quantum computer running Shor’s algorithm could compromise RSA and elliptic-curve cryptography, undermining much of today’s digital infrastructure. Nobody knows when that computer will arrive. In 2025, Google’s Craig Gidney published research suggesting RSA-2048 could theoretically be factored with fewer than one million noisy physical qubits under specific engineering assumptions, a dramatic reduction from previous estimates. And now we are down to a mere 10,000. This was not a prediction of imminent quantum capability. But it demonstrated how quickly assumptions can change.
And cryptographic migration takes years, sometimes decades. The “harvest now, decrypt later” threat makes waiting especially dangerous. Sensitive information intercepted today may become readable tomorrow. We absolutely need PQC.
But replacing one cryptographic algorithm with another cannot be our entire strategy.
History provides an important warning. The SIKE post-quantum candidate was undermined by classical cryptanalysis in 2022. The lesson wasn’t that post-quantum cryptography had failed. It was that we must design systems capable of changing their cryptography when assumptions fail.
Crypto agility matters as much as cryptographic strength.
Welcome To The Post-Cyber Era
When I say post-cyber, I don’t mean cybersecurity is disappearing. I mean cybersecurity as an isolated technical discipline is no longer sufficient. Through my work across enterprise technology, regulators and open-source communities, I’ve increasingly seen the difference between securing individual components and engineering trustworthy systems.
The former focuses on controls. The latter asks whether the business can survive when those controls, or the components they protect, fail. A post-cyber operating model connects six essential properties:
- Confidentiality: Can we protect sensitive information?
- Integrity: Can we trust that information hasn’t been altered?
- Authenticity: Can we establish who or what is acting?
- Availability: Can critical services continue operating?
- Safety: Can failures be contained before causing harm?
- Recoverability: Can we restore trusted operations after compromise?
These aren’t new concepts. NIST CSF 2.0, zero-trust architecture, cyber-resilience engineering and CISA’s Secure by Design principles already address much of this territory. The missing piece is often organizational. We continue treating cryptographic migration, identity management, AI governance, software supply chains and operational resilience as separate initiatives. Attackers and failures don’t respect those boundaries. Neither should our architectures.
What Needs To Change?
For technology companies: Build for replacement, not permanence.
Apple’s PQ3 protocol for iMessage demonstrates an important architectural principle. Rather than simply replacing classical encryption, Apple adopted hybrid cryptography, periodic rekeying and mechanisms designed to recover from certain key compromises.
That’s the mindset we need beyond cryptography. Software updates should be staged and reversible. Dependencies should be visible. Identities should be continuously verified. Recovery should be engineered and tested, not assumed.
For enterprises: Maintain two inventories.
The first identifies cryptographic exposure: RSA, elliptic-curve cryptography, certificates, VPNs, applications, hardware and third-party dependencies requiring PQC migration. The second identifies systemic fragility.
What happens if privileged credentials are stolen? If a trusted supplier distributes defective software? If an AI agent operates beyond its intended authority? If a critical cloud dependency disappears? Knowing where vulnerable cryptography exists is essential. Knowing what can stop your business even when cryptography works perfectly is equally important.
For boards and policymakers: Measure resilience, not merely compliance.
Tracking the percentage of systems migrated to PQC is useful but insufficient. Leaders should also ask:
- How quickly can we replace compromised cryptographic components?
- Can critical services survive identity or supplier compromise?
- How rapidly can we restore operations safely?
- Are our architectures adaptable to threats we haven’t anticipated?
These questions turn security from a compliance exercise into a strategic capability.
Beyond The Algorithm
Some will argue that post-cyber is simply another label for existing cybersecurity and resilience practices. That’s fair criticism.
We don’t need another acronym, compliance framework or organizational silo. What we need is a different way of connecting the disciplines we already have. PQC is one of the most consequential infrastructure migrations of this decade. It deserves urgent investment and serious engineering attention. But it cannot become another exercise in checking boxes while ignoring systemic weaknesses.
PQC asks whether our mathematics can survive a new kind of computer. Post-cyber asks whether our institutions, architectures and critical services can survive a world in which the assumptions beneath digital trust keep changing.
The first question now has standards, algorithms and a migration calendar.
The second is the future.
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?