Ask a room full of chief information security officers when a quantum computer will break the encryption protecting their company’s data, and you’ll get a room full of different answers, most of them hedged. Citigroup’s Institute put it starkly in a January 2026 assessment: the probability of a cryptographically useful quantum computer existing by 2030 is roughly 40 percent, and plenty of physicists think even that is generous. Push the window to 2044, and the odds climb to somewhere between 60 and 82 percent. Nobody serious is claiming certainty, in either direction.
That uncertainty has become the industry’s favourite excuse for inaction. If nobody can say whether “Q-Day” — the moment a quantum machine can factor a 2048-bit RSA key in practical time — is four years away or twenty, then it’s tempting to treat it the way most boards treat any low-probability, long-horizon risk: worth a slide in the annual risk review, not a budget line. That instinct is exactly backwards, and understanding why requires abandoning the question executives keep asking.
The question is not “when will quantum computing arrive.” The question is “what have I already encrypted that will still matter when it does.” Those are entirely different problems, and the second one has already been decided for most large organisations, whether their boards have noticed or not.
The attack already happened. You just can’t see it yet.
Intelligence agencies have a term for this: harvest now, decrypt later. It doesn’t require a working quantum computer today — only patience, storage, and a reasonable bet that one will exist before the data stops being useful. Encrypted traffic, stolen or intercepted now through routine espionage, breach, or even legal interception in transit, sits in an adversary’s archive until the decryption capability catches up. For a retailer’s transaction logs, that’s a non-event; the data is worthless in six months regardless. For a defence contractor’s design specifications, a pharmaceutical company’s clinical trial data, a bank’s decades of KYC records, or a government’s diplomatic cables, it is a live and compounding liability, because the sensitivity window on that information — ten, twenty, sometimes fifty years — is longer than almost anyone’s confidence interval on Q-Day arriving.
This is why the U.S. and India have stopped waiting for consensus on the physics and started legislating around the uncertainty instead. In August 2024, NIST finalised FIPS 203, 204 and 205 — the first standardised quantum-resistant algorithms for key exchange and digital signatures, built on lattice and hash-based mathematics rather than the factoring problems quantum computers are expected to crack. The NSA followed with CNSA 2.0, a binding timeline for U.S. national security systems: vendors were required to support the new algorithms in browsers, servers and cloud infrastructure by 2025 — a deadline that has already passed — with all newly acquired national security equipment required to comply by 2027, and full transition across deployed systems mandated by 2030 and 2033.
India’s own task force under the National Quantum Mission, chaired by C-DOT chief executive Rajkumar Upadhyay, published an even more compressed schedule in early 2026: critical information infrastructure — defence, power, telecom, ISRO, DRDO, ONGC — must complete cryptographic inventories and launch migration pilots by 2027, migrate high-priority systems by 2028, and reach full post-quantum adoption by 2029. Everyone else gets until 2033, but the report is explicit that where an organisation straddles both categories, “the highest-risk persona governs.” The Reserve Bank of India has since convened its own Q-SAFE committee, under IIT Madras’s Anil Prabhakar, to map cryptographic exposure across the banking system and report within six months. None of these bodies is asserting that quantum computers are imminent. They are asserting that the migration itself — inventorying every certificate, every embedded system, every vendor dependency — takes so long that starting after certainty arrives guarantees you’re too late.
Why this is not Y2K, and why that’s worse
Every CEO who lived through 1999 has an instinctive reference point for this kind of mandated, deadline-driven technical remediation, and it’s the wrong one. Y2K remediation cost the world an estimated $300 to $600 billion at the time — $600 billion to $1.1 trillion in today’s money — but it was a fixed, one-time correction: find the two-digit date fields, fix them, done. Post-quantum migration is not a single fix. It’s the creation of a permanent institutional capability — cryptographic agility, the ability to swap algorithms across an entire technology estate without operational disruption, repeatedly, indefinitely, because today’s “quantum-safe” lattice-based standards may themselves need replacing if their own mathematical assumptions are eventually weakened. Steve Suarez, CEO of the crypto-security firm HorizonX, has called it “the largest upgrade of cryptography in human history,” and the comparison to Y2K undersells it precisely because Y2K had an end date and this doesn’t.
The financial exposure for getting it wrong is not hypothetical either. Citigroup’s analysis modelled a scenario in which a quantum-enabled attacker compromised a top-five U.S. bank’s access to Fedwire, the real-time settlement backbone of the American financial system, estimating indirect economic impact at $2 to $3.3 trillion — 10 to 17 percent of GDP — and a six-month recession. Roughly 65 percent of Ethereum’s circulating supply and effectively all of Solana’s sit in wallet formats cryptographically exposed once a sufficiently capable quantum computer exists, according to the same analysis. These are not fringe estimates from cryptography vendors trying to sell a product; they are the kind of tail-risk modelling that should be sitting on the desk of any CFO responsible for systemic counterparty exposure.
What the smart triage actually looks like
None of this means every company needs to panic-migrate every system this quarter, and the vendors currently marketing “quantum-safe” everything are selling urgency, not precision. The organisations getting this right — and Apple’s 2024 rollout of the PQ3 protocol for iMessage, alongside Google and Cloudflare’s move to hybrid post-quantum key exchange in Chrome, are the clearest early examples — treated it as a triage problem, not a blanket one. The first and most important step, and the one both the American and Indian frameworks insist on before any migration begins, is a cryptographic bill of materials: a genuine inventory of where encryption lives across an organisation’s infrastructure, including the embedded firmware, IoT devices and decades-old vendor systems nobody remembers is running RSA-1024. Most large enterprises cannot currently produce this inventory, which is itself the more urgent finding than any quantum timeline.
For Indian conglomerates and global capability centres operating across multiple regulatory jurisdictions, there’s a specific and underappreciated wrinkle: a multinational’s Indian subsidiary may now face a harder CII-linked deadline than its own global parent, simply by virtue of operating adjacent to regulated infrastructure — meaning the compliance clock in Mumbai or Bengaluru could start running years before headquarters in London or New York has budgeted for it.
The strategic implication for any CEO is narrower and more actionable than “prepare for quantum computing.” It’s this: identify the specific slice of your data — usually smaller than 10 percent of total volume — whose sensitivity outlives the most pessimistic Q-Day estimate, and ask whether your crypto-agility runway is longer or shorter than that data’s shelf life. For most boards, that question has never been asked, which means the answer, whatever it is, has already been decided by default.
