The Future of Security: Why Post-Quantum Cryptography Matters

Key Takeaways

• Timeline: NCSC phased roadmap (2028, 2031, 2035 deadlines) for complete Post-Quantum Cryptography (PQC) migration
• For: CISOs, IT Directors, Security Architects, Risk Officers, Board Members across UK/EU sectors
• Key Threat: “Harvest now, decrypt later” attacks happening today – adversaries collecting encrypted data for future quantum decryption
• Regulatory Context: DORA (January 2025), GDPR Article 32, NIS2, PCI DSS v4.0 converging on quantum-safe cryptography requirements
• Key Actions: Cryptographic inventory, hybrid deployment, crypto-agility, NCSC-aligned roadmap

Reading Time: 12 minutes

Why Post-Quantum Cryptography Matters Now

In an age where digital security supports everything from money transfers to national defence, quantum computing increasingly threatens traditional cryptography. As a result, post-quantum cryptography (PQC), also known as quantum-resistant cryptography, is becoming essential.

PQC uses algorithms that resist attacks from both classical and quantum computers. Unlike current standards, which rely on mathematical problems such as integer factorisation or discrete logarithms – problems that quantum computers can solve exponentially faster – quantum-resistant encryption leverages alternative hard problems, such as lattice-based or hash-based signatures.

The Quantum Threat: From Theory to Urgency

The urgency for PQC stems from the rapid progress in quantum technology. Companies like IBM, Google and IonQ are scaling up quantum processors. As a result, some systems now exceed 100 qubits. In practice, the goal is to build fault-tolerant quantum computers within the next decade.

This shift is not hypothetical; rather, it represents a ticking clock, where every day brings us closer to an unknown deadline. The question is no longer if quantum computers will break modern encryption — it is when. Consequently, for UK and European organisations, post-quantum cryptography (PQC) has transitioned from theoretical concern to operational imperative.

In March 2025, the UK’s National Cyber Security Centre (NCSC) released comprehensive guidance. Specifically, it outlines a three-phase timeline to support migration to quantum-resistant encryption by 2035.

Meanwhile, adversaries are already executing “harvest now, decrypt later” attacks – collecting encrypted data today with the intention of decrypting it once quantum capability becomes available.

As a result, organisations face a paradox under GDPR’s accountability principle. You may be compliant today; however, you could become non-compliant in the future if stored data is later decrypted.

What is Post-Quantum Cryptography?

Post-quantum cryptography refers to cryptographic algorithms designed to withstand attacks from both classical and quantum computers. Unlike quantum key distribution (QKD), PQC algorithms run on existing classical computers – making them practical for widespread deployment.

“Harvest Now, Decrypt Later” as Data Sovereignty Threat

State-sponsored actors are already harvesting encrypted communications today, anticipating future quantum decryption. Consequently, this represents a significant data sovereignty risk for UK organisations.

In particular, it affects sensitive business communications, M&A negotiations, intellectual property, and GDPR-protected personal data. Moreover, certain data types – such as health records – may remain sensitive for decades, further increasing long-term exposure.

Understand how harvest now, decrypt later attacks work

The UK and EU Strategy for Post-Quantum Cryptography

A National Priority for Cybersecurity

The UK and EU are taking a proactive and structured approach to post-quantum cryptography as part of their broader cybersecurity and resilience strategies. In particular, the UK’s National Cyber Security Centre (NCSC) has positioned the transition to quantum-resistant cryptography as a national priority, recognising both the scale of the risk and the time required to respond effectively.

The NCSC Migration Roadmap (2025–2035)

In March 2025, the NCSC published detailed guidance outlining a three-phase migration roadmap, with key milestones set for 2028, 2031 and 2035.

Importantly, this roadmap is not simply advisory; it provides a clear framework for organisations to begin planning and executing their transition in a controlled and measurable way.

As a result, organisations operating in the UK and across Europe are expected to start preparing now, rather than waiting for quantum capabilities to fully materialise.

Regulatory Requirements: GDPR, DORA, NIS2 and PQC

At the same time, the regulatory landscape is evolving to reinforce this direction. The Digital Operational Resilience Act (DORA), which came into force in January 2025, requires financial entities to demonstrate cryptographic resilience and the ability to adapt to emerging threats.

Specifically, Articles 6 and 7 mandate robust encryption policies and cryptographic key lifecycle management, while also emphasising the need for crypto agility.

Similarly, GDPR’s Article 32 requires organisations to implement security measures appropriate to the risk. Consequently, as quantum threats become more tangible, failing to adopt quantum-resistant cryptography could be interpreted as a failure to meet regulatory obligations — particularly for data with long-term sensitivity.

In addition, NIS2 extends these expectations across critical infrastructure sectors, reinforcing the need for forward-looking cryptographic strategies.

From Guidance to Action

Taken together, these developments signal a clear shift: post-quantum cryptography is no longer a theoretical consideration but a regulatory and operational requirement.

Therefore, organisations must begin by understanding their current cryptographic exposure, aligning with the NCSC’s roadmap, and developing a structured migration strategy that supports long-term resilience.

• For official NCSC timelines and guidance read: NCSC Guidance on PQC: What UK/EU Organisations Need to Know Now

Why Post-Quantum Cryptography Matters for UK Organisations

“Quantum computing is set to revolutionise technology, but it also poses significant risks to current encryption methods. Our new guidance on post-quantum cryptography offers a clear roadmap for organisations to protect their data. It helps keep today’s confidential information secure for years to come, even as future threats emerge. As quantum technology advances, upgrading our collective security is not just important – it’s essential.”

NCSC CTO Ollie Whitehouse

The Regulatory and Business Case for Post-Quantum Cryptography

Early PQC adoption signals forward-looking security to regulators and customers. With DORA in force and NCSC’s roadmap providing clear timelines (2028, 2031, 2035), organisations cannot claim ignorance. Consequences of inaction could include GDPR fines of up to 4% of global turnover. It could also lead to DORA enforcement and personal liability of up to €1M for leaders. Other risks include shareholder litigation and reputational damage.

Detailed guidance for finance sector: Quantum Threats to UK/EU Financial Services and Implementing PQC in Financial Services

The Transition Challenge: From Classical to Quantum-Safe

What is “the Cryptographic Inventory Problem?

Modern enterprises operate thousands of systems with embedded cryptography. For example, a typical large UK financial institution may have over 50,000 TLS/SSL certificates.

• More than 10,000 applications with cryptographic libraries.
• 500+ HSMs.
• Hundreds of third-party APIs may be in use. Many may have no complete inventory.

However, the challenge extends far beyond inventory. PQC algorithms such as CRYSTALS-Kyber may require keys up to 10 times larger than RSA. As a result, this creates significant bandwidth and storage demands, particularly in constrained environments such as IoT and mobile networks.

More

Furthermore, performance remains a key consideration. Lattice-based schemes can be slower for key generation and encryption, while hash-based signatures offer strong security but produce larger signatures. Consequently, this can limit their suitability for high-throughput environments such as blockchain or real-time communications.

Moreover, the human element cannot be overlooked. Cryptographers and developers need retraining as PQC introduces new paradigms. Side-channel resistance must be reevaluated, as quantum adversaries could exploit timing or power analysis in novel ways.

Crypto Agility: A Critical Requirement for PQC Transition

Rapidly swapping algorithms without redesigning systems is essential. DORA explicitly requires this, with Article 6 mandating provisions to “update or change cryptographic technology based on developments in cryptanalysis.” Agile architecture requires algorithm independence, configuration-driven cryptography, hybrid capability, and continuous monitoring.

During transition (likely through 2030 and beyond) most organisations will adopt hybrid cryptography, running classical and quantum-resistant algorithms together. This provides backwards compatibility, defence in depth, and regulatory confidence.

A Practical Roadmap to Quantum-Safe Cryptography for UK/EU Enterprises

Key Takeaways Timeline: Start now-3-5 year migration timelines mean immediate action required For: CISOs, IT Directors, Security Architects, implementation teams Approach: 5-step practical methodology applicable across…

Continue reading

Conclusion: Preparing for a Quantum-Safe Future

The transition to post-quantum cryptography represents one of the most significant security transformations in digital history. However, for most organisations, this transition will take several years and will require a structured transformation programme rather than a simple technology upgrade.

In practice, it involves discovering cryptographic assets, prioritising high-risk systems, and gradually adopting quantum-safe algorithms alongside existing encryption.

At the same time, the quantum threat is both real and increasingly urgent. In response, the NCSC published its March 2025 roadmap, setting key milestones for 2028, 2031 and 2035. Meanwhile, the Digital Operational Resilience Act (DORA) has been in force since January 2025. Validated PQC implementations are now entering the market. As a result, organisations now have both the urgency and the tools required to act. Importantly, the NCSC’s Phase 1 deadline is 2028, which is just two years away. This means cryptographic inventory and migration planning must start immediately.

About Venari Security

Venari is the leading provider of Adaptive Cryptographic Intelligence for enterprise organisations. Our AI-powered platform delivers live visibility, guided migration, and continuous assurance – turning cryptographic complexity into business clarity. Trusted by financial institutions, critical infrastructure operators, and government agencies across the UK and Europe.

Venari helps organisations manage the move to post-quantum security. This lets them make the transition with confidence.