Post-quantum security is not a concern that most business owners need to act on today. However, it is a development worth understanding, both because of what it tells us about where cyber threats are heading and because of the practical lesson it contains for how businesses should approach their technology now. Microsoft has announced it is accelerating work to make its major services quantum-resistant before the end of the decade. The threat it is preparing for has not yet arrived. The preparation is happening anyway, and for good reason.
What Quantum Computing Means for Encryption
The encryption protecting data across the internet, including the connections businesses use every day for email, financial transactions, cloud storage, and website authentication, relies on mathematical problems that are extremely difficult for conventional computers to solve. Breaking that encryption through brute force would take an impractical amount of computing time. This is what makes it effective.
Quantum computers work on fundamentally different principles from conventional ones. They are still being developed and are not yet capable of the performance levels that would threaten current encryption. However, the expectation within the technology and security industry is that sufficiently capable quantum computers will eventually be able to solve the specific mathematical problems that today’s encryption relies on, and solve them far more quickly than any conventional computer could.
Nobody knows when that will happen. It could be a decade away or longer. The uncertainty is genuine. What is not uncertain is that the transition to quantum-resistant encryption for major systems is a large and complex undertaking that takes years to complete properly. Microsoft’s decision to start now reflects that reality rather than a belief that the threat is imminent.
What Harvest Now, Decrypt Later Actually Means
One of the reasons organisations responsible for protecting large amounts of sensitive information are already taking post-quantum security seriously is a risk known as harvest now, decrypt later.
Imagine that an attacker intercepts and copies encrypted information today. They cannot read it currently because the encryption is effective. The data appears useless to them in its current form. However, if quantum computers eventually become capable of breaking that encryption, the stolen data could be decrypted years after it was captured.
For most businesses, this risk is not immediately relevant. Customer emails, financial records, and operational documents are not typically the kind of long-term high-value intelligence that would justify an attacker storing them for a decade in hopes of future decryption. For organisations handling government secrets, critical infrastructure data, or commercially sensitive information with long-term strategic value, the risk is different and the urgency is higher.
The point for most businesses is not to begin replacing encryption systems today. It is to understand why large technology companies and security organisations are making decisions that look premature from the outside. They are making those decisions because the timescales involved in large-scale security transitions are much longer than the timescales on which threats actually arrive.
The Practical Lesson for Most Businesses
The most useful thing about Microsoft’s post-quantum security preparations for most business owners is not what it requires of them now. It is what it illustrates about the right approach to security more broadly.
Businesses that handle change in technology well share a common characteristic. They do not wait for problems to force their hand. They update systems before they become unsupported, review security policies before something goes wrong, replace ageing hardware before it fails at an inconvenient moment, and maintain backups that are current and tested rather than assumed to be working. They have built flexibility into their technology environment rather than leaving everything to the last possible moment.
This is precisely what Microsoft is doing with post-quantum security. It is preparing for an attack that may happen years from now because large technology changes take time to implement safely. The businesses that will cope best when new threats emerge are those that have already built that kind of forward-looking approach into how they manage their technology.
Our article on Windows 10 Extended Security Updates covers a current example of exactly this dynamic: businesses that delayed moving from Windows 10 are now facing a more urgent and disruptive transition than those that acted earlier. The principle applies equally across every area of technology management.
What Strong Foundations Look Like Right Now
Post-quantum threats are not the immediate cyber security concern for most businesses. The threats that are immediate and well-documented, ranging from phishing and ransomware to credential theft and software vulnerabilities, are addressed by the same foundations that will position any business well for whatever comes next.
Keeping all software consistently updated closes the vulnerabilities that automated attacks probe for. Maintaining reliable, tested backups provides the recovery capability that limits the damage a ransomware attack can cause. Ensuring staff have current awareness of phishing tactics, including the more sophisticated methods now in use, reduces the chance of a successful entry through human behaviour. Multi-factor authentication on all critical accounts adds a meaningful barrier even when credentials are compromised. Our article on why cyber attacks are rising covers the current threat environment and why these foundations matter more than ever.
These are not glamorous preparations. However, they are the practices that distinguish businesses which handle security incidents well from those that do not. And they are the same practices that will position any business well for the security transitions that are coming over the next decade, including eventually post-quantum ones.
Our cyber security page covers how a structured approach to security foundations provides the most resilient defence for businesses building toward a more secure future.
What This Means For Businesses
Post-quantum security is not on the immediate agenda for most businesses in Burgess Hill or across Sussex. However, the fact that Microsoft is investing heavily in it now is a useful prompt to ask whether your own technology foundations are as forward-looking as they should be.
Are the systems your business relies on actively supported and regularly updated? Are ageing devices and software being replaced before they become a liability rather than after? Are your backups current, tested, and protected against the specific attack methods that ransomware uses? Is your team’s security awareness current enough to address the phishing tactics that are in use today rather than those from several years ago?
If the honest answer to any of these questions is no or uncertain, those are the priorities. Businesses with strong, current foundations are in a better position to handle whatever the next threat brings, whether that arrives in two years or ten. Our managed IT services include ongoing security management and technology planning for businesses across Sussex and the South East, helping business owners build the kind of proactive approach that handles change well rather than being caught out by it.
Final Thoughts
Post-quantum security is a meaningful long-term development that will eventually require attention from organisations of all kinds. For most businesses today, the practical lesson is not about quantum computers. It is about the value of acting before problems become urgent.
The businesses that will be best prepared when the next significant security transition arrives are those that are already maintaining strong, current, and flexible technology foundations. That work is worth doing now, regardless of whether the specific threat it prepares for is post-quantum, some other emerging risk, or simply the well-established threats that are already in operation today.
Post-quantum security refers to the development of encryption and security systems that can withstand attacks from quantum computers. Today’s encryption relies on mathematical problems that conventional computers cannot solve quickly enough to be a practical threat. Quantum computers, when sufficiently developed, could potentially solve these problems much faster. Post-quantum security prepares for that possibility by using different mathematical approaches that are expected to remain secure even against quantum computing.
Nobody knows with certainty. Current quantum computers are not yet capable of breaking today’s encryption. The timeline for when they might be is estimated at a decade or more by many in the technology and security industry. The uncertainty is genuine. Microsoft and others are preparing now because implementing quantum-resistant encryption across major systems is itself a multi-year undertaking that cannot be left until the threat is imminent.
For most businesses, no immediate action is required specifically around post-quantum security. The practical lesson is about maintaining current security foundations generally: keeping software updated, maintaining tested backups, ensuring multi-factor authentication is in place, and replacing ageing systems before they become unsupported. Businesses with these foundations in good order will be well positioned for any future security transition, including eventually post-quantum ones.
Harvest now, decrypt later describes a scenario where an attacker captures encrypted data today that they cannot currently read, intending to decrypt it in the future when better computing tools are available. For most businesses, the information they handle does not have value over the multi-decade timescales this scenario requires. However, for organisations handling government, financial, or commercially sensitive data with long-term strategic value, this risk influences security planning today.
Keeping software and operating systems updated, maintaining reliable and tested backups, enabling multi-factor authentication on all critical accounts, and ensuring staff have current awareness of phishing and social engineering tactics. These foundations address the threats businesses actually face today and position any business well for the security transitions that will follow in the years ahead.
