Post-Quantum Cryptography: Why Companies Must Act Now

Index

• The foundation: Why cryptography is indispensable
• The turning point: How quantum logic reverses the one-way streets of mathematics
• Strategic timing
• The invisible archive: Why “harvest now, decrypt later” is already happening
• The solution: post-quantum cryptography (PQC)
• Why now is the right time to act
• A roadmap to quantum resilience
• Sessions
• Post-quantum resilience as the foundation of digital sovereignty

In cybersecurity, there are moments that change everything. Although we are currently investing heavily in defending against current attacks — according to Bitkom, the IT security market is expected to grow by around 10% (link in German) — a technological evolution is unfolding in the background that will redefine our understanding of security: quantum computing.

This is not a hardware crisis, but rather an opportunity to ensure the future of digital trust. It is not just about protecting servers anymore; it is about taking the mathematics that underpin our entire economy to a new level.

The foundation: Why cryptography is indispensable

To understand why quantum computers pose such a fundamental threat, it is important to examine how digital trust is established today. Almost every online interaction — from logging into the cloud and conducting online banking transactions to sending encrypted messaging — relies on asymmetric cryptography, such as RSA and ECC.

The principle behind this cryptography is the “one-way function”: A mathematical problem that is easy to compute in one direction but practically impossible to reverse.

• RSA (prime factorization): Multiplying two large prime numbers is easy. However, reversing the result to identify the original primes is computationally infeasible for classical computers. This is the foundation of TLS certificates and secure email.
• ECC (Elliptic Curve Cryptography): It uses complex curve mathematics to achieve the same level of security as RSA with much shorter keys, enabling secure communication on resource-constrained devices such as smartphones.
• PKI (Public Key Infrastructure): It is the organizational backbone that ensures a public key truly belongs to a trusted entity (e.g., your bank). PKI is the internet's digital identity system.

As long as these mathematical problems remain unsolvable, our digital identities are secure. However, quantum technology intervenes here.

The turning point: How quantum logic reverses the one-way streets of mathematics

To understand the threat, we must move beyond the idea that quantum computers are simply “extremely fast PCs.” Their superiority is based on a fundamentally different way of processing information.

While a classical supercomputer explores a maze by testing each path until it finds the exit, a quantum computer leverages the principle of superposition, effectively existing on all possible paths simultaneously.

The mathematical shortcut: Shor’s algorithm

The foundation of today’s security, whether RSA or ECC, relies on the assumption that certain mathematical reverse operations (such as prime factorization) would take binary systems an astronomically long time to perform. Shor’s algorithm fundamentally changes this scenario. Rather than using brute force, it is a mathematical shortcut. It exploits the wave nature of quantum bits to identify the periodic structures underlying large numbers.

• While it would take a classical computer countless years to break a 2048-bit RSA key, Shor’s algorithm can complete the task in hours or even minutes.
• In doing so, it undermines the concept of a "one-way function," which forms the basis of digital trust. The one-way street of mathematics suddenly gains a fast lane in the opposite direction.

Strategic timing

The risk is no longer just a theoretical side note. According to the German Federal Office for Information Security (BSI), a breakthrough in quantum computing is a realistic possibility by 2030(link in German).

From a strategic planning perspective, this is a critical benchmark. Considering that modernizing complex IT infrastructures often takes a decade or more, it becomes clear that the window for a gradual, low-pressure response has already closed. The systems we build today must remain secure in 2030. Modernization is no longer a future task — it is a present-day requirement.

The invisible archive: Why “harvest now, decrypt later” is already happening

The greatest danger of the quantum era stems from a common misconception: Attacks will only occur once the hardware is fully operational. In reality, the first phase is already underway: “harvest now, decrypt later” (HNDL). Strategic actors are intercepting and storing encrypted data streams in large-scale archives today.

Their objective? Once a cryptographically relevant quantum computer becomes available, these “frozen” datasets will be decrypted and exploited.

The leverage effect of machine identities

The volume of intercepted data is growing exponentially. According to CyberArk, there are now 82 machine identities (bots, APIs, IoT devices) for every human employee. These identities continuously exchange highly sensitive process data around the clock. Accessing a central data interface (API) today exposes not only current information. It also enables attackers to capture a continuous stream of data that can be decrypted retroactively and used against the organization in the future. 

For information that requires long confidentiality, such as patents, 20-year research cycles, or healthcare records, the data breach has effectively already occurred today if it is protected only by classical cryptography.

The solution: Post-quantum cryptography (PQC)

The answer is already within reach. Post-quantum cryptography (PQC) is based on mathematical problems, such as lattice- or code-based approaches, that are too complex for even quantum computers to solve. While quantum computers can exploit mathematical shortcuts to break RSA and ECC's one-way encryption, PQC algorithms present problems for which no such shortcuts exist.

• Lattice-Based Cryptography: In this approach, information is hidden within high-dimensional geometric lattices.  It is practically impossible for quantum computers to identify the exact point within this "mathematical labyrinth" without the correct key.
• Global Standards: The U.S. National Institute of Standards and Technology (NIST) has published the official blueprint for this new era of security in the form of the FIPS 203, 204, and 205 standards.

Post-quantum cryptography (PQC) is no longer theoretical; it is a deployment-ready technology. What This Means for Businesses: For organizations, PQC is far more than a technical upgrade. It is a hallmark of digital sovereignty. Companies that adopt it today send a clear message to their customers: "Your data is secure today and will be protected for decades to come."

Why now is the right time to act

Transitioning to post-quantum security is not a standard IT update; it is a strategic transformation process. Three key factors make immediate action essential.

• Time factor: Experience shows that replacing cryptographic protocols across global infrastructures can take many years.
  Those who wait until the first RSA key is broken will already have fallen behind.
• Deep integration: Encryption is often deeply embedded within microchips, cloud interfaces, and decades-old legacy systems.
  Addressing these layers requires long-term planning and structured execution.
• Regulatory pressure: The European Commission has set clear expectations:
  By the end of 2026, member states and critical sectors must present concrete roadmaps for PQC migration. Compliance is becoming a direct driver of transformation.

A roadmap to quantum resilience

Organizations that want to take a proactive approach can follow a structured roadmap.

• Cryptographic inventory: Determine where classical algorithms (RSA/ECC) are used across your systems, certificates, and partner interfaces.
• Data longevity risk analysis: Identify information with a “long-term value” (e.g., patents, long-term contracts).
• Future-proof architecture: Make PQC capability a mandatory requirement for all new IT procurements and software development.
• Build crypto-agility: Design your infrastructure so that cryptographic methods can be replaced modularly in the future.

This roadmap establishes the strategic foundation. For deeper technical validation and alignment with national security standards, refer to the official BSI white paper: “Quantum-safe cryptography: Recommendations and Fundamentals.”

How to put PQC into practice today

Once the inventory is complete, operational implementation follows in three steps.

1. Enable hybrid mode: Avoid a hard switch. Implement hybrid key exchange mechanisms that combine a classical algorithm (e.g., ECDH) with a quantum-safe one (e.g., ML-KEM / FIPS 203). If one method is compromised, the other will continue to secure the connection.
2. Upgrade VPN & TLS: Prioritize your communication channels. Many modern VPN providers and TLS libraries (such as OQS-OpenSSL) already support PQC handshakes. Begin by securing site-to-site connections that carry sensitive long-term data.
3. Test PQC certificates in your PKI: Establish a test certification authority (CA) that issues quantum-safe signatures (ML-DSA / FIPS 204). Validate compatibility across your endpoints and applications, as PQC certificates, due to their significantly larger signatures, may exceed the maximum transmission unit (MTU). This can result in fragmentation and potential timeouts in systems that are not designed to handle larger handshake packets.

Post-quantum resilience as the foundation of digital sovereignty

The transition to the post-quantum era will not happen overnight. It is a gradual evolution whose impact is already becoming visible today. Those who understand the principle of "harvest now, decrypt later" recognize that tomorrow's security is being determined by today's cryptographic decisions.

Organizations that begin their journey toward quantum resilience early are doing far more than closing technical gaps. They safeguard the integrity of their innovations, protect long-term customer trust, and preserve their ability to act strategically in an unpredictable technological future.

In the post-quantum world, the perception of cybersecurity is shifting fundamentally. It is becoming a decisive factor that sets market leaders apart. Those who establish a quantum-safe infrastructure now are proactively shaping their digital sovereignty, while others risk being overtaken by an invisible wave.

Further Resources:

• Supply Chain Security & Post-Quantum Cryptography
• Quantum Technologies and Quantum-Safe Cryptography (BSI)
• Quantum-safe cryptography – fundamentals, current developments and recommendations (BSI)