The Quantum Deadline Arrives in Pieces

An enterprise security team went looking for its cryptography. It found digital certificates renewing themselves on schedule, year after year, attached to systems nobody could identify.

Nothing was broken, the automation worked, and the certificates were valid. What was missing was a person.

“The real red flag was that everyone assumed someone else owned them,” says Sourabh Mallick, IBM’s ASEAN technical sales leader for data security and quantum safe. “Discovery isn’t just about finding assets. It’s about finding the gaps in accountability.”

That unowned certificate is one piece of four. The others: a compliance clock that has already started, an inventory most companies cannot produce, and a migration path that breaks systems nobody has load-tested. None of them needs a quantum computer to hurt you; all of them sit on a deadline that does.

Shor’s problem: what breaks, and what only bends

Two mathematical discoveries created the quantum threat, and both are older than most of the systems they endanger.

In 1994, Peter Shor, then at AT&T Bell Labs, proved that a quantum computer could quickly solve two problems that classical computers cannot: factoring very large numbers, and calculating discrete logarithms. Those two problems are the foundation of RSA, Diffie-Hellman, ECDH and ECDSA — the family of algorithms that today secures web traffic, signs software, authorizes payments, verifies firmware updates, and issues every digital certificate in your business. Mallick’s briefing deck, “Securing Your Organization and Data From Quantum Threats,” gives the verdict in six words: No practical mitigation. Must be replaced.

Two years later, Bell Labs researcher Lov Grover found a different quantum shortcut, one that speeds up guessing. Grover’s method weakens the second family of cryptography — AES for encryption, SHA-2 and SHA-3 for data integrity — but does not break it. The remedy is simple arithmetic. Use bigger keys: AES-256 and SHA-384 or stronger.

Remember that split, because it decides your budget. The second family needs a resize. The first family needs demolition, and demolition reaches every system that talks to another system.

The replacement algorithms already exist as published standards. NIST, the US standards body, released ML-KEM, ML-DSA and SLH-DSA in August 2024. The first two began life as CRYSTALS-Kyber and CRYSTALS-Dilithium, submissions IBM co-authored. NIST, Germany’s BSI, France’s ANSSI and Gartner all plan on a quantum computer capable of running Shor’s method arriving between 2029 and 2035.

Half-life: your data must outlive your encryption

The standards exist. That is not the same as having them running in your systems, and it is not why the clock is already ticking. Every organization is exposed to the quantum threat today, even though no quantum computer can break your encryption today.

The reason is a tactic called “harvest now, decrypt later”. An attacker copies your encrypted traffic now and stores it. The data stays unreadable for years. Then the hardware arrives, and the attacker reads everything collected since 2026. This makes the quantum threat everyone’s concern.

Sujith Surendranathan, director of database security and data protection at Sun Life, made the point in a 2024 IBM Institute for Business Value study “The Quantum Clock Is Ticking”: “It’s important for all organizations to recognize that exposure to quantum threats exists independently of their adoption of quantum computing.”

“Nobody wants the accountability of 'I approved this algorithm swap' if it breaks something, so the program sits in committee instead of execution.” – Sourabh Mallick @ IBM

This changes the shape of the question for the board: It is not when the machine arrives; it is which of your data still needs to be secret on the day it does.

The IBV study, which ran with the GSMA and Oxford Economics across 565 executives in 15 countries, found that in financial services, more than 40% expect their data to stay confidential for 25 years or beyond. These include mortgages, actuarial models and underwriting files.

Now set that against a real budget meeting. On one side, a 20-year confidential archive worth little today. On the other, a two-year transactional system worth a great deal right now. Which one gets funded?

“The two-year transactional system gets funded first, every time,” Mallick says. “Boards fund what’s measurable and near-term, and ‘harvest now, decrypt later’ risk to a low-value archive is easy to deprioritize when nobody can price it.”

He argues the decision runs backwards. “The archive is the one thing that’s actually unrecoverable once it’s stolen, while the transactional system can be re-secured after the fact.”

The measurement problem: 21 out of 100

The second piece is measurement. Most organizations cannot yet describe their own cryptography, and IBM’s research puts a number on the gap.

The IBV study scored organizations on a 100-point index across 14 readiness indicators. The global average came in at 21. The highest score any single organization achieved was 44.

The same executives were then asked how long a full move to quantum-safe standards would take, starting from where they stand today. Their answer: 12 years.

Paul Ballard, technology strategy and enterprise architecture director at Nationwide Building Society in the U.K., said in the same IBM IBV study that implementation time is the risk he watches. He compares the work to a marathon: choose a pace that fits your business, so you are neither idle now nor scrambling later.

Twelve years of work, against a threat window that opens in 2029. That gap is the whole story, and it narrows in only one direction.

Decoherence: the 47-day certificate

The third piece has a date on it. Ask the person who manages your digital certificates what breaks first, and nobody mentions quantum computing. They mention March.

A digital certificate is the identity document a server presents to prove it is genuine. Today those documents last up to 398 days. In April 2025, the CA/Browser Forum, the body that sets these rules, passed Ballot SC-081v3 with 29 votes in favor and none against it, cutting that lifespan on a fixed schedule. The first cut has already happened: since March 15, 2027, the ceiling has been 200 days — and most CAs issue at 199 days to avoid tripping the limit. It falls to 100 days in March 2027, then to 47 days in March 2029.

Forty-seven days means roughly eight renewals per certificate per year, across an estate most companies cannot fully list. Mallick’s own warning on the subject is blunt: if you are managing certificates manually, this will break you.

Two other obligations arrive without any quantum hardware involved. PCI DSS 4.0, the card payment standard, already requires a documented inventory of every cipher and protocol you use, reviewed annually. And Mallick’s deck cites a NACSA directive under Malaysia’s Cyber Security Act 2024 that obliges critical infrastructure operators to file a complete cryptographic inventory within three months of notice.

Mallick explains clearly what this really is. Q-day is the time when quantum computers become powerful enough to break standard public-key encryption. “Q-day just gave a scary, board-friendly name to a mess that was already there,” he says. “Sprawling certs nobody tracks, algorithms hardcoded a decade ago by someone who’s left the company, legacy systems too fragile to touch.”

He sees an opportunity in that. “Post-quantum is the excuse organizations needed to finally fund basic crypto-agility work that garden-variety risks never got budget for on their own.”

Observation: four scans, four different answers

Regulators now ask for a cryptographic bill of materials, or CBOM — a structured list naming every algorithm, key length and software library in a given system. It is not a document you write. Rather, it is data a scanner produces. Which raises the practical question: which scanner?

Cryptographic discovery gets discussed as one activity. In practice, it is at least four, and they return different answers.

Static scanning reads source code to find cryptography written directly into applications. IBM’s Quantum Safe Explorer does this across Java, Node.js, Python, Go, Dart, .Net and C/C++, and runs inside the software build process, which is the only way the inventory stays current. Network scanning watches live connections to see which algorithms are actually used. Certificate authority integration reveals what was formally issued. Filesystem scanning finds keys and keystores sitting on disk.

Each of the four methods misses what the others find, so the results must be collected in one place. In IBM’s product line, that is Guardium Cryptography Manager, though the choice of collection point matters far less than having one at all. Run only one type of scan and your inventory will look complete while large gaps stay invisible. That is how a company ends up with a clean report and a failed migration.

Interference: the hybrid trap

The recommended migration path is called hybrid cryptography. A hybrid system runs an old algorithm and a new post-quantum algorithm together in the same connection, so the connection stays safe if either one fails. Vendors present hybrid as the low-disruption option. Mallick expects the first production failures to happen here.

Size is the reason. The old key material is tiny. An X25519 public key is 32 bytes. Its post-quantum replacement, ML-KEM-768, needs a 1,184-byte encapsulation key and sends back a 1,088-byte ciphertext. Digital signatures are worse: an ECDSA P-256 signature runs to about 70 bytes, while ML-DSA-65 produces 3,309.

That size increase has a specific operational consequence. The opening message of a secure connection used to fit inside a single network packet of about 1,460 bytes. With post-quantum key material added, it no longer fits, so it splits across two packets. Load balancers, network appliances and embedded devices built on the assumption of a single-packet opening either stall or drop the connection.

“Hybrid gets treated as done once it's bolted on, so the classical component — often the actual weak point — never gets properly retired or audited.” – Sourabh Mallick @ IBM

“The quiet failure is performance overhead compounding silently across systems never load-tested for hybrid’s doubled handshake and key sizes,” Mallick says. “It’ll surface as latency and timeout cascades in high-throughput and embedded systems sized for classical crypto alone.”

Then comes the failure he considers more dangerous. “The bigger risk is complacency. Hybrid gets treated as done once it’s bolted on, so the classical component — often the actual weak point — never gets properly retired or audited.”

Two practical notes for planning. First, the migration is uneven: key exchange is moving quickly, with hybrid protection now shipping by default in major browsers and supported across large content delivery networks, while certificates and signatures lag well behind. Your web traffic may already be partly protected while your certificate systems have not moved at all. Second, some cryptography can never be swapped. Firmware roots of trust and hardware security modules check signatures using logic burned permanently into chips. You don’t migrate those devices; you replace them on a hardware refresh cycle, which makes them a capital expenditure conversation years before they become a security one.

Entanglement: the risk nobody will claim

Every problem described above has a known technical solution. None of them explains why quantum-safe programs stall. Mallick’s explanation is not money, and not lack of a mandate.

“Remediation work — swapping algorithms, updating certs, touching legacy systems that just work — cuts across app teams, infra and security, and none of them wants to be accountable for something breaking in production for a threat model that still feels theoretical,” he says.

Asked to name the single cause when programs stall, he does not hesitate. “Control the CISO won’t cede, or more precisely, control nobody will claim.” The consequence is predictable. “Nobody wants the accountability of ‘I approved this algorithm swap’ if it breaks something, so the program sits in committee instead of execution.” And without a named owner, he adds, a mandate “just produces another inventory nobody acts on.”

Suppliers create the same vacuum, one step removed. Mallick describes a client that asked a major vendor to explain the inventory and reasoning behind several long-lived certificates. The vendor could confirm only that the certificates were still being renewed.

“The client had quietly outsourced ownership, classification and risk decisions, assuming the supplier was managing them,” he says. “In reality, the supplier was only operating the process.”

Ballard, at Nationwide, describes the same weakness from the buyer’s side in the IBV report. His concern is not the large cloud providers but the smaller tier-two and tier-three suppliers, where visibility fades and, as he puts it, safety is only as strong as the weakest link in the partnership.

Geography widens the gap further. Singapore has issued guidance in sequence through MCI, MAS and CSA. Malaysia has moved. Several neighboring markets have no equivalent requirement at all. Mallick has watched regional companies misread that difference. “A multinational assumes its strongest-market compliance covers the region, then discovers, via a local regulator, auditor or incident, that the standard never existed where it was needed, so nothing was formally done there.”

Collapse: one question, no consultant

There is a single test that reveals whether an organization can actually change its cryptography, and Mallick puts it to chief data officers directly.

“If we found a crypto dependency today that needed replacing, could you tell me exactly what to do next?”

A capable organization answers within hours: where the algorithm is used, who owns that system, what breaks if it changes, and how to replace it. “If they need weeks to figure that out,” Mallick says, “it’s still just a claim.”

His advice for a company with 90 days and one budget line is deliberately unglamorous, and it excludes buying anything. “Don’t start replacing algorithms or buying new tools yet. First get clear on what you have, where it matters, and who is accountable.”

Then watch for the signal that a program has stopped being real. “The earliest warning sign is when the program starts producing reports instead of decisions,” Mallick says. “You see lots of assessments, meetings and dashboards, but nobody can say which systems will be changed, who owns them, or what happens next.”

The quantum computer arrives sometime in the 2030s. The certificate window shrank in March, the inventory is due on notice, the handshake is already too big, and the owner column is still blank today.

Image credit: iStockphoto/bpawesome