Q-Day has already begun. Are you ready?

When Cloudflare began exploring quantum-safe cryptography in 2017, they didn’t have many predecessors to model. The National Institute of Standards and Technology (NIST) had just put out a call the year before requesting new algorithms that quantum computers could not break. But for Cloudflare, one of the largest content delivery networks (CDNs) on the internet, the stakes were too high to wait.

“We saw this as a foregone conclusion,” Trey Guinn, Field CTO at Cloudflare, told IBM Think in an interview this April. “About a quarter of the internet flows through us, so it’s much broader than just fixing the cryptography stacks being used inside of Cloudflare. We wanted to be able to upgrade the default cryptography used by the whole internet.”

— Shohini Ghose, quantum physicist and professor at Wilfrid Laurier University

The “foregone conclusion” is known as “Q-Day”—the day a quantum computer becomes powerful enough to crack the code behind current cryptography. Well, it’s not actually a day. The good news is that Q-Day won’t be, as in some media depictions, a hacker apocalypse triggering societal collapse. It will be a years-long series of vulnerabilities, with multiple opportunities for organizations to avoid catastrophe. The bad news is that, in a way, Q-Day has already arrived.

“It’s not that Q-Day is in the future. Q-Day is, in a sense, in the past,” said Shohini Ghose, a quantum physicist and professor at Wilfrid Laurier University, in an interview with IBM Think. In other words, anything encrypted with today’s public key ciphers is at risk of being decrypted by tomorrow’s quantum computers.

Attackers are playing the long game, gathering and storing encrypted data now with the intent to decipher it once quantum capabilities mature, in a tactic known as “harvest now, decrypt later.” Nation-state actors are reportedly “data harvesting on a grand scale.” For the average business, that means “if you have very high-value data that has a very long life, then that data is at risk,” said Zygmunt Lozinski, a Senior Technical Staff Member and Quantum Ambassador at IBM focused on quantum-safe networks. Threat actors, he says, could wait years to exploit a bank’s customer records, clinical trial information for a pharmaceutical company’s new drugs, plans for an aerospace firm’s unique engine, or designs for a manufacturer’s upcoming chips.

— Zygmunt Lozinski, Senior Technical Staff Member and Quantum Ambassador at IBM

Ray Harishankar, an IBM Fellow who leads strategy for IBM Quantum Safe, prefers the term “steal now, forge later.” “Today’s trusted digital signatures, certificates and identity proofs could be stolen now and then forged as fake signatures when quantum computers are capable of breaking underlying encryption algorithms,” Harishankar told IBM Think in an interview. “This threatens integrity, authenticity and nonrepudiation more than privacy. That is, it attacks the trust layer itself.”

The economic impact could be dire. The global average cost of a data breach is already millions of dollars, but a quantum-enabled cyberattack could result in trillions of dollars in losses.

To counter the threat, enterprises must migrate to quantum-safe cryptography now. “We have the digital equivalent of needing to change every door lock on the planet,” Lozinski told IBM Think in an interview. “We’re going to do this by planning for it. If we plan now, we don’t have to panic later.”

Quantum computers have the potential to accelerate drug discovery, design novel materials and model future energy solutions. But they’re also poised to solve the complex math problems behind most modern encryption algorithms. Experts refer to such a quantum computer as being “cryptographically relevant.”

Not all cryptography is at equal risk. For now, NIST classifies cryptographic hash functions and symmetric encryption algorithms as relatively less vulnerable to quantum attacks. Cryptographic hash functions such as SHA-256 and SHA-3 generate “digital fingerprints” that establish the authenticity and integrity of data, including digital signatures and blockchain and cryptocurrency transactions. Meanwhile, symmetric encryption algorithms, such as the oft-hailed gold standard AES-256, help protect VPNs, files stored on hard disks and other storage devices, information stored in databases, and other large amounts of enterprise data on-premises and in the cloud. (In the constantly evolving field of post‑quantum cryptography, however, maintaining security requires ongoing re-evaluation of risk.)

The cryptographic schemes that quantum computers could break involve asymmetric, or public key, encryption and digital signatures, including the Diffie-Hellman (DH) key exchange, the Digital Signature Algorithm (DSA), elliptic curve cryptography (ECC) and the Rivest-Shamir-Adleman (RSA) algorithm. A lot of critical technologies depend on these algorithms: authentication mechanisms, blockchain and cryptocurrencies, digital certificates, email encryption and the transport layer security (TLS) protocol, which requires an initial handshake and key exchange process to establish secure communications over the internet.

If hackers can derive keys, they can decrypt and unveil the confidential or sensitive data those keys lock away. If cybercriminals can forge digital signatures, they can tamper with digital contracts or software, delivering malware or ransomware masquerading as valid updates. And if threat actors can forge digital certificates, they can impersonate users and websites to commit fraud, gain unauthorized access to platforms or even endanger vital infrastructure like electric grids or transport systems.

Asymmetric cryptography relies on math problems that classical computers struggle to solve, such as computing the discrete logarithm or finding the prime factors of large integers. However, Shor’s algorithm, introduced in 1994 by MIT mathematician Peter Shor, demonstrated that a quantum computer could solve the mathematical underpinnings of asymmetric key cryptography.

And while current quantum computers haven’t matured enough to break public key cryptography, they’re getting closer. The IBM Quantum roadmap targets 2029 to deliver IBM Quantum Starling, a large-scale, fault-tolerant quantum computer designed to operate correctly even in the presence of errors and capable of running circuits with 100 million gates on 200 qubits. While Starling’s expected performance is not considered cryptographically relevant, crossing the fault-tolerant threshold will speed up what’s possible with quantum computers.

“In this period we’re living through right now, quantum computing is easily one of the biggest technological innovations,” Lozinski said. Quantum computers, according to researchers, could help solve some of the most difficult optimization problems and challenging systems of equations, simulate some of the most complex properties and enhance AI and machine learning models. “There are some really cool applications that quantum computing will have,” Lozinski added, pointing to such examples as improving radio networks in telecoms, creating new types of molecules for medical research and enabling breakthroughs that could slash carbon emissions. “The hope is that we can crack some of the world’s critical problems,” he said.

Meanwhile, IBM Quantum Blue Jay, a system fit to run circuits with a billion gates on 2,000 qubits, is projected to debut as soon as 2033. Such a quantum computer is expected to provide significant value to solving hard problems. However, it may also be sufficient enough to break asymmetric encryption.

It seems like years away, but that timeline could shrink. “While the hardware capabilities are maturing, people are also improving the algorithm,” said Harishankar, citing researchers’ recent enhancements of Shor’s quantum algorithm. Breakthroughs in both hardware and software are “driving faster execution or requiring a smaller number of qubits in the machines,” he added.

Lory Thorpe, a Strategy Consultant within IBM Quantum who leads the Quantum Safe for Industries and Partnership agenda, promotes a reframed view. “We should be looking at this as an opportunity to prepare,” she said in an interview with IBM Think. A major part of that preparedness, she explained, includes moving to post-quantum cryptography (PQC) standards—even if a cryptographically relevant quantum computer has yet to be built.

Researchers from IBM and other partners developed two of those standards, while the third was codeveloped by a scientist who has since joined IBM. “We have the algorithms ready,” Michael Osborne, CTO for IBM Quantum Safe, told IBM Think in an interview. “It’s an easy first step to protect against harvest now, decrypt later. ... All the complexity around the algorithms is hidden in the protocol. You never get to see the new algorithms—all you’re doing is updating and configuring protocols to use a new cipher suite or a hybrid cipher suite.”

The difficulty, he warned, lies in updating the “hundreds of protocols in the world,” including TLS and the Secure Shell (SSH) protocol for secure data exchange between networked devices, to adopt the new standards. Factor in all the dependencies that also need updating—such as the libraries backing those protocols and the languages for those libraries—and post-quantum migration becomes a massive endeavor.

Cloudflare had a five-year headstart before NIST announced its chosen quantum-resistant algorithms in 2022. This gave the company time to experiment. The team tried out various candidate algorithms to secure TLS sessions. But real-world performance at scale was crucial—after all, the internet was Cloudflare’s broad remit.

And it wasn’t enough to support post-quantum cryptography on the server side. Cloudflare had to factor in the client side, which encompassed a variety of web browsers. So the team partnered with Google Chrome, testing the feasibility of deploying post-quantum cryptography in TLS.

Across half a decade, Cloudflare kept refining its implementations, investigating how the proposed encryption and digital signature schemes would fit into its protocols and collaborating with academia and industry. The next step entailed “post-quantumifying” a few of its internal services, including those handling logging, managing private keys and private networking, to trial quantum-safe cryptography in practice.

“We were trying to discover what was possible, then incrementally spinning things up, finding what breaks, fixing those things and starting again,” said Field CTO Guinn.

All that hard work paid off: only three months after NIST’s selection of quantum-safe algorithms, Cloudflare enabled post-quantum encryption using one of the IBM-developed algorithms for all APIs and websites served through its network.

In 2023, secure messaging app Signal was ready to begin its quantum-safe shift. “We had real, viable, scrutinized solutions that we could use. The pieces are here. It’s time to go ahead and act,” said Rolfe Schmidt, a Research Engineer at Signal, in an interview with IBM Think.

— Rolfe Schmidt, Research Engineer at Signal

An independent nonprofit organization with a limited budget, Signal started simple. Instead of considering the app’s entire protocol for end-to-end encryption, Schmidt and his team focused on the core function of secure messaging, specifically the area that computes a shared secret at the beginning of a new chat or call. This, Schmidt said, helped protect conversations against “harvest now, decrypt later” threats that could compromise current sessions.

“When we started, we weren’t thinking about the whole app at all,” he said. “We didn’t map out all of our quantum risk. We just saw there’s this one massive exposure”—the start of the chat or call—“and something fairly straightforward we could do about it. We can adjust it to make sure that the secret generated is going to be quantum-safe without taking away any of the guarantees we already have.”

Once that upgrade was done, the team chipped away at other parts of the protocol. It was far from an easy task, however, and not just a case of swapping out a traditional cryptographic algorithm for a quantum-safe one. With the new algorithm, the team had to navigate challenges around drastic size increases for both the keys and the encrypted data, which could raise the bandwidth required for every message sent. They had to reengineer the Signal protocol to fit the new algorithm’s parameters, building new designs, writing a lot of new code and rewriting some existing code—all while ensuring the protocol remained lightweight enough to keep network costs low for users.

To make sure everything worked as it should, the team ran tests and simulations. They integrated formal verification into the design process, with machine-checked proof of the correctness and security of their implementation.

The transition was a delicate balancing act for Rolfe and his small team. “We have features we need to build, maintenance we need to do. We have a lot of threats coming our way—quantum is not the only threat. We have to assess where we put our limited resources.” They tackled it opportunistically, treating post-quantum migration as part of ongoing operations. “That just goes into the mix. We’re already touching this piece of code, so we can go ahead and migrate it now,” he said.

According to a 2024 survey by the IBM Institute for Business Value (IBV), enterprises expect it will take more than a decade to fully integrate quantum-safe standards into their business. “Keep in mind that this is a journey with a long tail,” IBM Fellow Harishankar said. “If you haven’t started, you have to start now.”

While awareness has grown, only a few have taken action. A separate IBV report found that even though 73% of organizations are working on their quantum-safe strategy, just 19% have near-term goals for their quantum-safe initiatives. In 2025, IBM’s Quantum-Safe Readiness Index showed a low average global score: 25 on a 100-point scale.

The chasm between strategy and execution might be explained by a lack of knowledge. The IBV report points to a crucial 36% skills gap, with organizations operating with only around two-thirds of the quantum-safe cryptography expertise needed to implement quantum-safe protocols.

“Right now, the urgency is technical knowledge and know-how,” Rob Campbell, a Quantum Safe Project Executive for IBM Sales Federal Market in the US, told IBM Think in an interview. “We don’t have very many people who understand these algorithms and how to put them in operational systems.”

Harishankar agrees, noting that the scarcity of skills in the space is “what keeps me awake at night.” In addition to training and upskilling, he believes automation and AI-driven recommendations could help ease the transformation and reduce the skill level needed to implement post-quantum migration. That way, he said, “we are not found with an insurmountable task with no skills available.”

IBM Quantum Safe CTO Osborne refers to AI as the “knight in shining armor” because “it makes skilled people extremely efficient.” He adds that AI can help with some of the more challenging technical aspects of moving to post-quantum cryptography, making AI adoption an important piece of the migration puzzle. “Organizations need to react to AI in a way that helps them migrate to quantum safe,” he said.

Some businesses may also be struggling to choose where to begin, but there are certain actions they can take now. IBM’s Lozinski recommends forming a governance team to own and plan the migration, including an executive owner, a project manager, a security specialist, an enterprise architect who understands the scope of IT throughout the organization and a procurement specialist to handle vendors across the software supply chain.

While experts typically suggest kicking off the planning process by discovering where and how you use cryptography, Harishankar points out that conducting a full inventory could be overwhelming and might even hold you back.

“Doing inventory for the sake of inventory is not going to give you any insight,” said Harishankar. Instead, he recommends a risk-based analysis, prioritizing high-risk areas where the crown jewels of businesses lie: critical data like personally identifiable information (PII), information with a long shelf life like healthcare records or competitive differentiators like intellectual property. “Identify those first, and then do an inventory within that scope.”

A digital transformation or modernization program in progress could also serve as an opportunity to incorporate quantum-safe encryption and prevent piling on technical debt. “The last thing you want is to go back and include a requirement for quantum readiness. See whether there is an easy way to include it at a limited incremental cost,” said IBM’s Thorpe.

Another vital consideration revolves around the dependencies that form the software supply chain, including application platforms, frameworks, libraries and third-party services. “Engage with your vendors early on, and ask them about their plans for implementing post-quantum cryptography,” Thorpe said. She added that holding vendors accountable is integral to collectively handling this sea change.

Looking back at Cloudflare’s migration journey, Field CTO Guinn noted one thing the company would have done differently: “If we had a crystal ball 10 years ago, we probably would have solved this more as a crypto-agility problem than just an upgrade to post-quantum cryptography.” Crypto-agility refers to the ability to migrate to another cryptographic method without spending too much time, effort and resources on the process. It boils down to being as agile as the threats to encryption.

Crypto-agility will be even more essential as post-quantum cryptography standards advance, according to IBM’s Osborne. For instance, NIST recently announced nine candidates for its third round of additional digital signature schemes to be standardized, four of which IBM and other partners codeveloped. Many of those candidates have compact key and signature sizes and optimized implementations.

“Protocols will evolve to be more efficient when they use these new algorithms,” Osborne said. “Organizations need to deal with all of these things changing and becoming ready at different stages. The strategy to deal with that is agility.”

Nearly a decade after Cloudflare’s initial efforts, more than 65% of traffic to its network is post-quantum encrypted. “It’s incredible to think that two-thirds of the internet now is running post-quantum encryption because of that collaborative work and deciding to invest the time to make the internet work for the long term,” Guinn said.

For Signal, the measure of success was the absence of disruption. “What I’m happiest about our migration is that I don’t think any users noticed—it was just quiet. That’s the goal, and I do hope it continues to be that way,” said Schmidt.

Both organizations are maintaining the momentum. Cloudflare’s next goals include switching to post-quantum authentication and raising adoption even further, working with browsers, operating systems and other clients to migrate big cohorts of users to quantum-safe cryptography. Guinn cautioned that challenges abound in legacy systems, including old middleware boxes, proxies and scripts. “When you talk about upgrading the protocols that millions of different users, networks and servers on the internet use, you’re going to find a lot of edge cases,” he said.

Meanwhile, Signal has zeroed in on protecting private groups on its app, which has proven to be much harder to transition. The team is working with IBM Research to redesign its private group system, making it more efficient and quantum safe.

Other companies need to catch up, according to Lozinski. The energy, financial services, government and telecom sectors are leading the way with their preparations, he observed, but “when I look at all other industries, I do not see the same level of awareness, and I don’t see the same level of action.” He’s particularly concerned about smaller vendors that may not have the same capability to analyze and understand their cryptographic systems, as well as industrial control systems, Internet of Things (IoT) devices and operational technology for manufacturing plants. “They don’t necessarily do frequent software updates, so this is going to be difficult for them,” he said.

What can help, Lozinski stressed, is spreading awareness. “It’s important that we keep sharing the lessons we’re learning as we’re doing this. In cybersecurity, you are as secure as the weakest link. We benefit by sharing best practices because we’re all interconnected.”