By Antony Russel, CTO at Telviva

Every major organisation is sitting on something incredibly valuable that not many people understand: cryptographic trust. It enables businesses to move billions through online banking, run contact centres in the cloud and even authenticate remote workers spread across the country and the world. “Q-Day” could turn that all on its head.

Quantum computing is an advanced field of computing that works off the principles of quantum physics to solve complex problems exponentially quicker than the world’s most powerful supercomputers. We’ve seen just recently that China has leapfrogged the best machines in the US to boast the world’s fastest supercomputer. Quantum computing would be able to solve complex mathematical problems, such as cryptographic keys, in seconds, a task that would take the fastest current supercomputers trillions of years to unlock. Let that sink in, and if it sounds fanciful, look it up.

All of which brings us to Q-Day, a hypothetical or looming milestone where quantum computers become powerful enough to break standard public-key encryption. Will Q-day ever really arrive? Google has officially announced that it expects Q-Day to arrive as soon as 2029. More recently, the US government has also called for the development of a quantum computer by 2028.

This all means that there is a very real risk that quantum computing could devalue or destroy cryptographic trust. But what if it never comes to pass? Surely, prudent planning to prevent nasty surprises is more important than burying heads in the sand, hoping that this is all just sci-fi fearmongering?

The uncomfortable truth is that many boards are acting as if the risk does not exist at all, while standards bodies, regulators, and leading technology companies are already working towards building a replacement for cryptography as we currently know it. 

Challenging the status quo

Today, when a customer sees a padlock on their browser, or an agent logs into a cloud platform, public-key cryptography is at work: two strangers, in full view of the internet, are agreeing on a secret key that attackers with classic computers cannot realistically recover. 

A quantum computer with cryptographically relevant capabilities changes that assumption completely. What was once considered secure shifts because it becomes feasible for bad actors to derive private keys from public keys, and with that, the ability to read or forge what was meant to be secure.

Businesses looking at shoring up their defences face two different risks. The obvious is the day after Q-Day. This is where attackers are able to access encrypted sessions, such as those between customers and portals or agents and company cloud services, or even internal systems across the internet, and decode them. 

The second, more insidious, risk is already happening. It’s called harvest now, decrypt later (HNDL). Bad actors can capture encrypted traffic they cannot read today and store it fairly cheaply. Then, when Q-Day arrives, yesterday’s “secure” communications become tomorrow’s leak. 

Why act now?

Quantum readiness cannot be filed to one side as an obscure IT project. When the very mechanism that underpins confidentiality and authenticity fails – in other words, trust – it becomes a governance problem, not a configuration bug.

Quantum computing is progressing through punctuated breakthroughs such as longer-lived quantum states, more usable qubits, and more. Progress is happening, that much is certain, perhaps best exemplified by the fact that Google has brought forward its internal target for migrating to post-quantum cryptography. 

When a business that size, running one of the world’s biggest cloud environments while building quantum hardware, accelerates its own timetable, then boards that shrug and say “hypothetical” or “too early” are playing a dangerous game. Inaction is increasingly becoming an indefensible risk decision.

The next generation of cryptographic infrastructure is already being standardised. Bodies such as the US’ National Institute of Standards and Technology (NIST) have selected and defined post-quantum algorithms: ML‑KEM for key establishment and ML‑DSA and SLH‑DSA for digital signatures. A further standard, FIPS 206, is nearing draft approval to embed this thinking into the formal security stack. 

These are the building blocks providers will use when they start offering “quantum-resistant” products. Business leaders don’t need to understand all the details of these building blocks, but they should recognise what their existence signifies: the industry has moved from “if” to “how fast”. 

The EU’s Digital Operational Resilience Act (DORA) is not a “quantum regulation”, so to speak, but it does require that financial entities and their critical service providers understand where and how they rely on cryptography. It requires them to prove they can maintain resilience when technology or threat models change. 

What can organisations do now? One practical step is to demand a cryptographic bill of materials, which is a concise map of where a business depends on public-key cryptography for critical functions such as customer logins, payment flows, API gateways, remote access, and more. Without that crystal-clear visibility, any talk of a “quantum strategy” is mere guesswork.

Cloud communications and contact centres sit at the intersection of an organisation's most sensitive customer interactions and the public internet. When selecting providers, businesses are outsourcing a significant slice of their cryptographic posture.

It is no longer enough to ask about uptime and features. Businesses should be asking whether unified communications providers can rotate certificates at scale, how they are shortening token lifetimes, and how they plan to adopt post‑quantum standards such as ML‑KEM and ML‑DSA as the ecosystem matures.

The precise date of Q‑Day will only be obvious in hindsight, probably because of a breach or a quiet but urgent standards update. Perhaps it never happens. However, boards that treat quantum readiness as part of their broader duty to protect digital trust will, at the very least, have robust protections in place if it all turns out to be theoretical, and a credible answer and line of defence in the event Google and others were right all along. The rest will be left to explain why they waited for a calendar invite that was never going to arrive.