Why It’s Time to Invest in Quantum Cybersecurity

Until now, computing has been based on binary numbers: ones and zeros, true or false, on or off. In contrast, quantum computing supports multiple states, exploring trillions of possibilities all at once — which makes it sound like something out of science fiction.

But quantum computing has stepped out of the realm of science fiction and into reality. Striving to outpace major competitors like IBM and Google, Microsoft announced the development of a palm-sized quantum computing chip earlier this year. Computer scientists can already see how quantum computing may make the world better, where it may be able to solve problems a million times faster than today’s computers, and where technical advances could decrease the physical size of quantum computers.

Breakthrough work is genuinely underway. Viable paths for scaling quantum computers to millions of qubits are now clear.

But while quantum computing promises to deliver more computational power, it also brings new dangers. Encryption systems that protect data today will become vulnerable when practical quantum computers arrive in seven to 10 years. Quantum computers capable of breaking current cryptographic standards represent a threat to the privacy of individuals and the security of organizations and entire nations.

This is a ‘today’ problem

While seven to 10 years may sound like a long way off, preparation for quantum threats must begin now, not once they have already materialized. Organizations need time to implement post-quantum cryptography (PQC) transition plans methodically — and that applies both to anyone with an IT infrastructure and to anyone building software-defined systems.

“Current encryption, such as RSA and ECC [elliptic curve cryptography], will become obsolete once quantum computing matures,” said Cigent cofounder John Benkert. “Management often assumes cybersecurity threats are only present-day problems. But this is a future-proofing issue — especially relevant for industries dealing with sensitive, long-lifespan data, like healthcare, finance or government.”

Remediation requires long-term planning. Organizations that wait until quantum computers have broken encryption to address the threat will find that it is too late.

One reason for the urgency of starting today is that an adversary could harvest data now and decrypt it later, once large-scale quantum computers become available. The threat of “capture now, exploit later” means that quantum-resistant algorithms must be deployed well in advance of the scaled quantum computers required to fully execute such an attack.

The good news: Much of the groundwork has been laid. In 2024, after seven years of international collaboration, the U.S. National Institute of Standards and Technology (NIST) finalized its principal set of post-quantum cryptographic algorithms. However, those algorithms have to be added into common and not-so-common protocols, including Transport Layer Security (TLS), which underlies web browsers.

“Every security protocol that uses public-key encryption and digital signatures now needs to be updated to use the new post-quantum standards. So TLS has to be updated to use post-quantum encryption, and the digital certificates TLS uses to authenticate endpoints have to be updated to use post-quantum signatures. In fact, every use of public-key digital signatures needs to be updated,” explained Brian LaMacchia, a cryptography engineer who oversaw Microsoft’s post-quantum transition from 2015 to 2022 and has since founded Farcaster Consulting Group.

And that is just the beginning of the process. Making those updates will entail a lot of work for security professionals, and weaving those changes throughout existing systems’ infrastructures will take time. Fortunately, adding quantum resistance to new systems does not add more time to development schedules, and it does not cost more. The algorithms are free. PQC processes do not require more expensive chips, though they might use different ones. It’s a matter of using newer and different chips and algorithms, not necessarily more expensive components.

As with Y2K so many years ago, quantum’s biggest challenges are around existing systems. Each company needs to identify and update all of its large software stacks and convert their existing uses of cryptography to the new algorithms. But implementing PQC will be more challenging than addressing the Y2K problem was, LaMacchia contended. The problem is harder to describe, and remediation is more difficult. Without tuning or upgrading systems, replacing cybersecurity algorithms can affect application and network performance.

And, critically, with Y2K, everyone knew what the deadline was. With quantum cybersecurity, the deadline is fuzzier. Would-be adversaries do not issue an announcement when they acquire new abilities to breach systems.

What quantum cybersecurity means to mission-critical industries

In some industries, product lifecycles are fast. However, industries that build equipment intended to operate for decades — such as automobiles, aircraft and oil pipelines — need to design secure systems that can withstand breach attempts for years to come, not just today.

To do that, firmware updates need to be digitally signed by the manufacturer, and those digital signature algorithms need to be quantum resistant to ensure that a vehicle does not load a malicious update, LaMacchia said, warning, “If somebody breaks your digital signature, they can impersonate you.”

Automotive OEM encryption systems use cryptography to check manufacturers’ digital signatures, such as when validating firmware updates and application code in software-enabled vehicles. Broken authentication lets bad things happen. Someone could remotely take over a vehicle, for instance, or send malicious code for autonomous execution later, even after the vehicle has gone offline.

However, the new quantum computing cybersecurity algorithms are larger than the old algorithms. “The key sizes are larger, and the ciphertexts are larger, which means you need more storage space, ” LaMacchia said. Relative to the size of most systems, the additional space is small, but in tight, embedded systems, “the code needs to reflect those changes,” he added.

What to do about it today

Here are a few steps companies can take today to prepare for potential quantum security threats.

Build an inventory. Identify what needs to change across toolchains. Itemize everything used today, as well as who owns its implementation and the process of updating it.

“Who owns the physical devices that are securing your VPNs?” LaMacchia asked. “Who owns the storage encryption? For the encryption you’re using, is that something you do in software? Is it the hardware manufacturer?” Don’t leave anything out, he advised.

With inventory in hand, LaMacchia said, go down the list and say, “OK, how am I going to update this for PQC?”

Avoid adding technical debt. Start using quantum-resistant cryptography today, and begin building crypto-agility into the lowest layers of the system.

That is not a new concept for engineering teams. Cryptographic security already comprises a montage of different algorithms. Engineers can augment traditional asymmetric cryptography algorithms with the algorithms from the new NIST standard.

Make the technical adjustments. The new PQC algorithms are larger and more complicated than the ones engineering teams are used to. In some cases, digitally signed messages with security information could triple in size, which could impact storage and bandwidth.

For example, LaMacchia said, someone building oil pipelines might want to install low-power sensors every kilometer, with batteries that will last five years. Tripling the amount of energy required for compute and wireless low-power messages could decrease battery life. Without careful integration of the new algorithms, systems will not last as long as their specifications require.

Ensure that suppliers are quantum-ready. All of the suppliers in an OEM supply chain need to be on the same page. Requests for proposals should ask vendors to include a PQC update plan. Will they automatically update the product or service? What assurances do they offer? Getting answers to such questions is particularly critical for any proprietary protocols, such as those used in many manufacturing systems.

How are we helping?

Aptiv thrives within the tight constraints of the embedded edge, incorporating artificial intelligence into edge devices such as jets, vehicles and robotics and helping to ensure that they are quantum-ready. We are working closely with semiconductor companies, and we demonstrated chip-accelerated quantum resistant cryptography at the Consumer Electronics Show in 2025. To learn more, ask your Aptiv representative about quantum-ready product security.