Quantum Computing: The Invisible Threat to Your Digital Security

By Kike Gandia · Threats · 6 min read

Illustration of a Bloch sphere with an orange state vector, quantum waves on the left and a crossed-out shield in the corner

Your passwords are worthless. Your bank knows it. Governments know it. And hackers are already betting on it

Right now, as you read this on your "secure" smartphone, there are servers packed with your encrypted data (emails, transactions, private messages) waiting patiently in some clandestine data center. They can't read it. Not yet. But they will. It's only a matter of time.

Welcome to the world of "harvest now, decrypt later": the most patient and terrifying strategy in modern cybercrime.

The weapon that changes everything

Quantum computers aren't faster than conventional ones. They're different. While your laptop processes bits (0 or 1), these machines work with qubits that can be both at the same time. It's like comparing a flashlight to a nuclear laser.

In 1994, a mathematician named Peter Shor designed an algorithm that, run on a quantum computer, can break RSA-2048, the standard that protects your online banking, in hours. Not centuries. Not millions of years. Hours.

The catch: you need around 20 million stable qubits to make it happen. Today's machines barely exceed 1,000 qubits and have brutal error rates.

The good news: in 2024, IBM unveiled a roadmap to reach 100,000 qubits by 2033. Google demonstrated "quantum supremacy" on specific tasks. China invested $10 billion in quantum research.

20M: stable qubits needed to break RSA-2048 with Shor's algorithm
~1,000: qubits that today's machines barely exceed, with brutal error rates
100,000: qubits on the roadmap IBM unveiled for 2033
$10B: invested by China in quantum research

The gap between what is needed and what exists, which is the entire migration window.

The question isn't "if" but "when".

Your bank is already being robbed (but nobody knows it)

Picture this: a group of state-sponsored hackers breaks into your bank's servers, copies terabytes of encrypted transactions and... leaves. Without a trace. Without decrypting anything. Without stealing a cent.

Why? Because they're playing chess while you're playing checkers.

They know that by 2035, maybe sooner, they'll have access to quantum computers capable of tearing through that encryption like wrapping paper. Then, and only then, they'll decrypt everything: your transfers, your investments, your login credentials.

This is already happening. US intelligence agencies confirmed in 2023 that foreign adversaries are stockpiling encrypted traffic at scale. The NSA issued an urgent directive for government agencies to migrate to post-quantum cryptography before 2030.

The data you protect today will be tomorrow's exposed secrets.

Q-Day: when does everything collapse?

Experts call it "Q-Day": the exact moment a cryptographically relevant quantum computer (CRQC) goes live.

2035-2040: optimistic scenario for Q-Day
2030-2033: aggressive scenario
34%: probability within the next 10 years

Estimates of when a cryptographically relevant quantum computer goes live.

When it arrives, the effect will cascade:

Finance: broken SSL certificates, vulnerable bank transactions, compromised blockchains
Government: exposed diplomatic communications, unprotected military command systems
Healthcare: stolen medical records, leaked pharmaceutical research
Infrastructure: power grids, water systems, air traffic control, all of it hackable

This isn't paranoia. It's pure math.

The solutions exist (but nobody is using them)

1. Post-quantum cryptography: the new order

In August 2024, the US NIST published the first official standards for quantum-resistant algorithms:

FIPS 203 CRYSTALS-Kyber: Key exchange based on mathematical lattice problems. Qubits can't solve them efficiently.
FIPS 204 CRYSTALS-Dilithium: Digital signatures that are just as resistant.
FIPS 205 SPHINCS+: A hash-based fallback scheme.

NIST's first official post-quantum standards, published in August 2024.

The catch: these algorithms produce keys 10 times larger than RSA. A digital signature that used to take 256 bytes now needs 2,420 bytes. Multiply that by millions of transactions a day and you have a brutal bandwidth problem.

Hybrid approach: use classical AND post-quantum algorithms at the same time. If one fails, the other holds. It's like having two locks on your door.

2. Quantum key distribution (QKD): science fiction made real

China already runs an operational 2,000 km QKD network linking Beijing and Shanghai. Here's how it works:

You send cryptographic keys using individual photons
If someone intercepts them, the photon's quantum state changes
Interception is physically detectable

The catch: it costs millions, requires dedicated optical fiber and doesn't work beyond 400 km without quantum repeaters (which barely exist).

For the average citizen: forget it. For governments and banks: start investing.

3. Crypto-agility: the art of changing fast

In 2013, the NSA recommended SHA-1 for digital signatures. In 2017, Google showed that SHA-1 was vulnerable. Organizations that were slow to migrate were left exposed.

Lesson: design your systems so you can swap algorithms without rewriting all your code. Today you migrate from RSA to Kyber. Tomorrow, from Kyber to whatever comes next.

Why nobody is doing anything

A 2025 survey of 500 CISOs found:

Acknowledge the quantum threat	62%
Have assessed their cryptographic inventory	23%
Have started an actual migration	8%

2025 survey of 500 CISOs: from awareness to action, the figure drops by 54 points.

Why the paralysis?

Cost "It's too expensive": Upgrading legacy infrastructure can cost millions. But waiting will cost billions.
Complexity "It's too complex": Many systems are 20 years old. Changing their cryptography is like replacing a plane's engine mid-flight.
Timeline "We have time": 2035 seems far off. But enterprise migrations take 5-10 years. If you start in 2028, you'll be late.
Talent "We don't have the experts": There's a global shortage of post-quantum cryptography specialists. The few who exist command six-figure salaries.

The four excuses behind the paralysis, and what each one really costs.

What to do now (a survival guide)

For organizations

Weeks 1-4 — Full inventory
Identify every algorithm in use (RSA, ECC, Diffie-Hellman), map which systems use them and rank them by criticality.
Months 2-6 — Risk assessment
Which data needs to stay confidential beyond 2035? Trade secrets, medical data and intellectual property: top priority. Temporary logs and public data: low priority.
Years 1-2 — Hybrid implementation
Deploy TLS with hybrid support (classical + PQC), upgrade VPNs to quantum-resistant protocols and replace certificates with Dilithium signatures.
Year 3+ — Continuous monitoring
PQC is constantly evolving: keep the ability to swap algorithms quickly and take part in standardization working groups.

The migration in phases: what needs doing, and when.

For individuals

Let's be honest: you're not going to implement CRYSTALS-Kyber in your WhatsApp.

But you can:

Use services that have already migrated: in 2024 Signal announced it would implement PQXDH (post-quantum key exchange) in 2025
Turn on hardware authentication: physical security keys (YubiKey, Titan) add a layer that Shor's algorithm can't break
Assume today's secrets will leak: don't email anything you wouldn't want to see made public in 2035

The cost of inaction

In 2017, Equifax suffered a breach that exposed the data of 147 million people. Total cost: $4 billion in fines, lawsuits and reputational damage.

Now multiply that by 1,000. That's the scale of Q-Day.

When quantum computers break RSA, it won't be "a hack". It will be the hack. Simultaneous. Global. Irreversible.

Banks will collapse when historical transactions are exposed. Companies will go under when decades of trade secrets leak. Governments will fall when classified communications are published.

And you won't be able to "patch" retroactively. Data stolen in 2025 will still be stolen in 2035.

The uncomfortable truth

Quantum computing is inevitable. Quantum attacks are inevitable. The only variable is: will you be protected, or will you be a victim?

Migrating to post-quantum cryptography isn't just another IT project. It's the digital survival project of the next decade, and it starts like any other: with a risk assessment and a prioritized roadmap.

The tools exist. The standards are ready. What's missing is leadership, budget and, above all, urgency.

Because unlike other cyberattacks, this one won't come as a surprise. You'll have had decades of warning.

And even so, most will be late.

Don't be part of that statistic.

Q-Day is coming. The question isn't whether you're worried. It's whether you're prepared.

Topics

#Cybersecurity #Security #Quantum-computing #quantum #security

Keep reading

Assess our exposure