Beyond cryptography: building quantum resilience in practice
Post-Quantum Cryptography (PQC) is often presented as a future technology problem. In reality, organisations should view it as a business resilience challenge that requires action today.
The UK's National Cyber Security Centre (NCSC) has published guidance recommending that organisations prepare for PQC migration and, where appropriate, complete high-priority migrations by 2031. Similar timelines are emerging internationally, signalling a global shift in how organisations will protect sensitive information in the decades ahead.
The challenge is not simply replacing one cryptographic algorithm with another. The real challenge lies in understanding where cryptography exists across the enterprise and how dependent critical services are upon it.
The myth of the "simple software upgrade"
There is a common perception that PQC migration will be achieved through routine software updates.
For some systems, that may be true. Modern cloud services, browsers and operating systems are already beginning to support quantum-resistant algorithms. However, many organisations operate complex environments containing:
Legacy applications
Operational technology and industrial control systems
Telecommunications infrastructure
Embedded devices
Long-life security appliances
Third-party managed services
In these environments, cryptographic dependencies are often poorly documented and difficult to replace without operational impact.
The first challenge is therefore not migration. It is discovery.
Organisations need a cryptography inventory
Many organisations maintain asset inventories but relatively few maintain cryptographic inventories.
Without knowing:
Which algorithms are in use
Which certificates are deployed, and where
Which suppliers provide cryptographic functionality
The difficulty of upgrading existing systems
it becomes impossible to create a credible migration plan.
A cryptographic discovery exercise frequently reveals unexpected dependencies in identity systems, VPNs, mobile networks, public key infrastructure (PKI), machine-to-machine communications and software signing processes.
Quantum resilience is a supply chain issue
One of the most underestimated aspects of PQC readiness is supplier risk.
Most organisations rely on software vendors, cloud providers, telecommunications operators and managed service providers for critical cryptographic controls. Successful migration therefore requires engagement far beyond the security team.
Boards should consider asking:
Are our key suppliers developing PQC migration roadmaps?
What quantum-resistant capabilities are already available?
Which services will require major upgrades or replacement?
How will compliance obligations be demonstrated?
These questions are particularly important within critical national infrastructure sectors, where complex supply chains often determine the pace of technological change.
Focus on risk, not hype
There is understandable excitement surrounding quantum computing, but organisations should avoid viewing PQC as either an urgent crisis or a distant problem.
The most effective approach is a structured, risk-based programme that combines:
Cryptographic discovery
Technology assessment
Supplier engagement
Migration planning
Ongoing governance
Organisations that start now will be able to make informed investment decisions and align with emerging regulatory expectations. Those that delay may later find themselves conducting large-scale migrations under significant operational and compliance pressure.
Preparing for the next cryptographic era
Quantum resilience will not be achieved through a single technology deployment. It will require visibility, governance and coordinated action across technology, risk and supply chain teams.
The organisations that succeed will treat PQC not as a cryptography project, but as a long-term resilience programme that strengthens trust in their digital services for decades to come.
