Preparing for Quantum Threats to Encryption

Cybercriminals are already collecting encrypted information they cannot read, betting that future quantum computers will eventually unlock it. The tactic is known as “harvest now, decrypt later.” 

The threat extends to digital signatures and certificates used to verify identities and authorize transactions. And while no one knows exactly when quantum computers will become powerful enough to break widely used encryption, preparing for that possibility could take years. 

In “The Specter Haunting Cybersecurity,” an article by Katie Kuehner-Hebert in ProSight’s October Executive Report, experts explain why banks should begin preparing now, even with an uncertain timeline. 

Their recommendations offer a starting point: 

Get a handle on existing encryption. Chris Hickman, chief security officer for Keyfactor, described how organizations have traditionally treated cryptography as “a set-and-forget parameter.” That approach leaves banks with limited visibility into protections embedded throughout their systems. A Cryptographic Bill of Materials can help identify where encryption is used, including the algorithms and keys managed by third-party providers. 

Start where the risks are greatest. Replacing encryption throughout an institution could be overwhelming. Colin Soutar, a managing director and quantum cyber leader at Deloitte, recommends a staged, risk-informed approach. Banks should identify cryptography used in critical systems and business processes, develop a roadmap for upgrading those protections, and gradually extend the work across their operations and supply chains. The National Institute of Standards and Technology standardized post-quantum cryptography algorithms in 2024. 

Make sensitive information harder to reach. Troy Leach, executive director of the CSAI Foundation, emphasized the need for stronger identity and access management. That includes examining permissions granted to AI agents and other non-human identities, which may have more access than necessary. Limiting who—or what—can reach encrypted information can reduce opportunities for attackers to harvest it. 

Prepare for ongoing changes. Hickman urges institutions to build “crypto agility” into their programs so they can update encryption algorithms as new threats emerge. Banks also need to coordinate with vendors and other financial institutions whose systems connect through payment networks and other shared infrastructure. “It’s an entire ecosystem that has to move,” he said, and the transition will take many years. 

The takeaway: Quantum readiness begins with understanding the protections banks already depend on. A clear inventory, a risk-based migration plan, tighter access controls, and coordination with technology partners can help institutions prepare for a threat whose arrival date remains uncertain.