Quantum and the cloud: Science fiction turned security strategy

Someone walks into a room and says, ‘quantum computing’ and everyone else says, ‘huh?’ It’s simply a difficult concept to understand; however, the internet, containers, and cloud computing were once difficult to comprehend too. Quantum computing is a different way to process information…but it works exponentially faster than “normal” or classical computers.

Rather than classical bits, which are 0s and 1s used independently, it uses qubits, which are 0s, 1s, or both used simultaneously! It’s like a light switch versus a dimmer switch.

Quantum security concerns

It’s widely believed that in the near future, when quantum computers become powerful enough and stable enough, some of the encryption methods used today to keep data secure at rest or in transit will be broken or solved by quantum computers in a matter of seconds. This includes the commonly used RSA and Elliptic Curve Cryptography (ECC). However, it’s believed that the also popular Advanced Encryption Standard (AES) method will be weakened, but not broken.

Think back just a few years ago to when AI tools became more broadly available via ChatGPT in 2022, when LLMs really went mainstream. In the past three years, the technology has been integrated into all of our regularly used mobile applications, web browsers, job functions, and its use is being taught in schools now. We anticipated attacks against AI infrastructure and attacks using AI, and in the last year, we’ve seen an increasing number of confirmed reports. The threat landscape will be the same for quantum threats and vulnerable quantum computers.

Quantum software and hardware are being developed quickly, but quantum security is still a work in progress. If Q-Day, the day quantum computers become powerful enough to break current encryption algorithms, comes sooner than anticipated and migrations aren’t complete, this will open up a new line of threat vectors for supply chain attacks that threat actors may very well already be prepared to take advantage of. With the current availability and access to Quantum-as-a-Service (QaaS) from cloud service providers, threat actors are potentially able to test attacks or experiment with breaking traditional encryption methods.

The security community has coined a theory called ‘harvest now, decrypt later’. The idea is that threat actors will steal and hold on to any encrypted data until they are able to decrypt it with access to a quantum computer. This time/access will likely come much sooner for APTs than it will for other cybercriminal groups or script kiddies. While we may not read headlines about threat actors targeting encrypted data, we can consider this a current threat and make it a priority to safeguard our sensitive data from threat actors or consider replacing these encryption methods. Your encrypted data may have already been stolen, someone is just waiting to break it.

Proactive security/Post-quantum resiliency

So what do you do to anticipate security threats that aren’t fully understood? You’ve probably run this playbook several times before for different kinds of threats. First, take inventory of all organizational assets currently using vulnerable encryption methods and keep the inventory up-to-date as assets change. Unfortunately, data classification is a legacy issue that has carried over into complex, scaled cloud environments and it’s still proving to be a challenge. Which is why we now have data security posture management (DSPM) solutions on the market. Data classification and inventory is imperative for a successful, secure encryption migration prior to Q-Day.

Once you’ve completed a full inventory, make a plan to safely migrate those assets from vulnerable encryption algorithms to post-quantum standardized algorithms such as those suggested by the National Institute of Standards and Technology (NIST). NIST is world-renowned for cybersecurity standards and is leading the efforts to establish standards and guidance for post-quantum cryptography solutions. As of March 2025, NIST has identified 5 algorithms for standardization:

• FIPS 203, 204, and 205
• ML-KEM
• HQC

There are also risk analysis tools available that help identify sensitive data that may need quantum-resistant encryption to be applied to it as a proactive security measure. This is especially important for healthcare, finance, and government sectors as they often store data that goes unchanged for long periods of time, such as names, dates of birth, social security numbers, or other government-issued ID numbers, and more.

Security leaders should be having conversations about quantum readiness now. What does your agility ability look like to move your encryption, or have you done so already? There is risk associated with not being ready for Q-Day, especially if you work in those sectors handling sensitive information.

Also often at the top of many security leaders’ minds is compliance. As of yet, there are no binding global post-quantum regulations, but many post-quantum cryptography security strategies are being prepared all across a very similar timeline.

Furthermore, nearly every technologically advanced country already enforces dual-use risk controls and export regulations on quantum technologies. This is because it can be used for civilian applications like healthcare and science; and also military and intelligence purposes like code-breaking and chemical weapon design. For this reason, there are restrictions on certain technologies and information between some countries and research organizations. Some quantum computing information sharing even requires licensing.

The U.S. federal government has prioritized post-quantum cryptography for several years, making updates to strategy regularly. An executive order from June 2025 states that the Directors of NSA and OMB must have requirements for cryptographic transitions for government agencies ready by December 1, 2025 and also states that transitions must take place before January 2, 2030.

The UK National Cyber Security Centre released a migration timeline in March 2025, which highly encourages starting now to first complete a full cryptography-based inventory assessment, then define migration goals before 2028.

The European Commission also recently published a roadmap for EU Member States. Post-quantum encryption methods should be in place by 2030 and migration is expected to begin at the end of 2026.

The Japanese government announced in October 2024 that it would begin working with companies like Toshiba and NEC Corporation in 2025 to develop quantum encryption technology by 2030.

Quantum in the cloud

Cloud service providers like AWS, Google, and Microsoft are already taking steps to secure the post-quantum future by deploying standardized algorithms. They are active in cryptographic communities and each have their own ongoing migrations, in addition to tools and resources for their customers to use. IBM has also migrated to quantum-safe encryption and provides users with the ability to monitor cryptography use and find cryptographic vulnerabilities.

We already see how these four cloud service providers offering access to Quantum-as-a-service (QaaS) have accelerated research and development and enabled rapid innovation in the quantum software market without requiring access to the fragile hardware. This open access has also supported educating the workforce for the quantum era and encouraged post-quantum computing migration.

Since quantum computing accelerates the speed of information processing, it can drastically reduce resource consumption in some cases. Therefore, in the future hybrid quantum-classical workflow may become more commonplace. We will be able to offload resource-intensive workloads to a quantum processor via the cloud and return the completed results to a classical system for post-processing, integration, or further action. Quantum computers won’t replace classical systems, they will enhance them.

This means that quantum is also expected to supercharge cloud-hosted AI models. This will have the most significant impact on agentic AI, where self-learning algorithms will be able to learn much faster. Faster information processing means:

• Speeding up model training programs.
• Significantly improving model optimization.
• Models can handle exponentially more complex data (and more of it).

Readiness starts today

Quantum computing isn’t a distant “someday” technology. Subject matter experts are heeding warnings and governments are suggesting deadlines. It’s on the horizon and it’s already beginning to reshape security. Just as we prepared for and are trying to stay ahead of the AI threat landscape, now is the time to act to avoid disruption and ensure resilience in the post-quantum era.

So what can you do today?

• Have a subject matter expert or analyst brief your executives and security teams on what quantum computing means for your business and security strategy.
• Conduct a full inventory of data assets and current encryption methods. Prioritize sensitive and long-lived data.
• Make a migration plan that includes highlighting the systems that depend on vulnerable encryption algorithms and an appropriate timeline for migration to recommended standards.
• Anticipate business impact by conducting a threat model to understand operational and compliance implications on your environments, supply chains, and customer trust.

Quantum threats may still feel abstract, but the risk associated with waiting to take action is real now. Organizations that are prepared will face Q-Day with confidence, instead of chaos when the time comes.