Much of today’s post-quantum conversation is focused on algorithms, such as which new standards to adopt and when to make the transition. But the bigger challenge may be underestimating how difficult it is to change the systems around them.
Cryptography is deeply embedded across identities, certificates, cloud infrastructure, applications, payment systems and key-management platforms. Change one component, and the impact can ripple across many others.
That is why the post-quantum challenge is bigger than new algorithms. It is about understanding dependencies, modernizing the foundations of trust, and building the ability to adapt without disrupting the digital services organizations already rely on.
The migration clock is already running
Quantum risk starts before a cryptographically relevant quantum computer arrives.
Sensitive information is being created, encrypted and stored every day. Threat actors may not be able to decrypt that information today, but they can collect and retain it until sufficiently powerful quantum capabilities emerge.
This strategy, commonly known as Harvest Now, Decrypt Later (HNDL), is now the leading quantum-related concern among organizations globally. According to the 2026 Thales Data Threat Report: Quantum & AI, 61% of respondents rank HNDL as their top quantum security concern.
For organizations handling financial information, healthcare records, government data, intellectual property or critical infrastructure, the implication is clear: some data must remain confidential for years, even decades.
The question is therefore not simply when a cryptographically relevant quantum computer will arrive. It is how long the data and systems we depend on today need to remain trusted. The longer that period, the earlier migration planning needs to begin.
Standards are becoming clearer, but migration remains complex
Organizations have a clearer technical path than they did a few years ago. NIST finalized its first three post-quantum cryptography standards in 2024, and here in Singapore,
CSA, GovTech and IMDA have jointly released the Quantum-Safe Migration Handbook and the Quantum Readiness Index to help organisations assess where they stand and plan their transition. The guidance is clear that Critical Information Infrastructure owners and government agencies should begin now.
These are important steps. But standardizing an algorithm does not automatically make an enterprise quantum-ready. The harder question is whether organizations know where vulnerable cryptography exists, what depends on it, and what must change around it.
The real challenge is managing dependencies
Cryptography rarely exists in isolation. An algorithm may sit behind an identity system, certificate, application, payment service or cloud workload. The keys supporting those services depend in turn on hardware, key-management systems, certification requirements and integrations built up over years. This makes post-quantum migration fundamentally a cryptographic dependency challenge.
Before deciding what to replace, organizations need visibility into where cryptography is used, which keys and certificates are involved, what relies on them, and which infrastructure must also evolve.
The dependencies closest to the root of trust deserve particular attention. Public-key systems ultimately depend on cryptographic keys, which underpin identity, payments, cloud services, certificates, digital signing and sensitive data. Yet the infrastructure protecting and managing those keys is often deeply embedded in enterprise environments.
Algorithms can be updated relatively quickly. The hardware, key-management, certification and integration layers supporting them may take considerably longer. If the keys and trust infrastructure cannot evolve securely, the systems built on top of them cannot evolve securely either.
Start where it matters most
Quantum-safe migration should not mean replacing every cryptographic system at once. The priority is to build the visibility, controls and flexibility needed to move in stages.
- Start with sensitive data and long-term exposure. Identify information that must remain confidential for ten years or more, then map the cryptographic assets protecting it.
- Apply consistent controls across hybrid environments. Data and applications span on-premises, cloud and SaaS environments, so protection needs to remain consistent as information moves between them.
- Validate priority use cases before scaling. With 59% of organisations globally naming the prototyping and evaluation of PQC algorithms as their leading path to becoming quantum safe, the priority should be validating interoperability, performance, rollback and operational monitoring before wider deployment.
- Use the transition to reduce cryptographic complexity. PQC migration is an opportunity to simplify fragmented tooling, improve key and certificate management and build crypto-agility so organizations can adapt as standards continue to evolve.
- Build continuous visibility into sensitive data. Cryptographic inventories provide a starting point, but organizations also need to know where sensitive data resides, who can access it and how it is protected as environments change. Data Security Posture Management can help maintain that visibility over time.
Migrate on your own terms
Post-quantum migration will take years for many organizations. That can make waiting for greater certainty seem reasonable. But waiting does not remove the work; it only compresses the time available to do it. Organizations that start now can decide which systems move first, test changes before scaling, manage operational impact and build the governance needed for a controlled transition.
That is the real advantage of starting early: control. Those that prepare now can shape the pace and conditions of migration. Those that wait until quantum risk becomes urgent may face the same transition with far less flexibility. The post-quantum challenge is not simply choosing what comes next. It is making sure the foundations of trust can evolve with it.
