Post-Quantum Cryptography is a Planning Problem, Not a Technology Problem
Michael Kingsnorth is the founder of Scramble Technology Inc. (Canada) and AperiMail Ltd. (UK). He writes about privacy, technology, and the future of human agency in the digital world, drawing insight from both entrepreneurship and philosophy.
Post-quantum cryptography is often framed as a future threat, but the real challenge is already here. This article explores why organisations must treat PQC as a governance and planning issue, from data visibility and cryptographic inventories to migration readiness and long-term security.
The quantum threat most organisations are missing
When people hear discussions about post-quantum cryptography (PQC), they often picture a future breakthrough: a powerful quantum computer suddenly appearing and rendering today's encryption obsolete overnight. That image makes for compelling headlines, but it distracts from the real challenge facing organisations today.
The biggest risk is not that quantum computers arrive tomorrow. The biggest risk is that many organisations have little visibility into where cryptography is used, what sensitive data they hold, how long that data remains valuable, or how they would migrate if a major cryptographic transition became necessary.
The conversation around quantum computing is often framed as a technology problem. In reality, it is increasingly becoming a governance, planning, and risk management problem.
Why this matters now
Modern digital security depends heavily on public key cryptography. Technologies such as RSA and Elliptic Curve Cryptography (ECC) underpin secure web traffic, software signing, digital identities, VPNs, cloud services, email security, and countless business applications.
For decades, these technologies have served organisations exceptionally well. However, advances in quantum computing present a potential long-term challenge. The more important question is: How long does your data need to remain secure?
The harvest now reality
An adversary does not need a quantum computer today to create a future problem. They only need the ability to collect and store encrypted information.
Sensitive communications, databases, backups, intellectual property, legal documents, healthcare records, financial information, and identity data can all be captured and archived. If future cryptographic breakthroughs eventually make that information accessible, the value of those archived datasets may be realised years after they were originally collected.
The inventory challenge
Most organisations do not possess a complete inventory of their cryptographic dependencies. Encryption is rarely confined to a single system. It exists across databases, cloud platforms, backup solutions, identity systems, APIs, certificates, software supply chains, mobile applications, file transfer systems, hardware security modules, third-party services, and vendor products.
The importance of cryptographic agility
Cryptographic agility is the ability to replace or upgrade cryptographic mechanisms without redesigning an entire system. Organisations that embrace cryptographic agility design systems with the expectation that cryptographic standards will evolve over time.
Conclusion
Post-quantum cryptography is often discussed as a future technology challenge, but the organisations that succeed will recognise it as a present-day planning challenge.
The organisations that begin building inventories, engaging vendors, improving cryptographic agility, and developing migration plans today will have the flexibility to adapt tomorrow.
Read more from Michael Kingsnorth
Michael Kingsnorth, Technology & Privacy Contributor
Michael Kingsnorth is an entrepreneur, technologist, and writer exploring the boundaries between privacy, technology, and human freedom. As founder of Scramble Technology Inc. in Canada and AperiMail Ltd. in the UK, he develops privacy-first communication systems and decentralized identity frameworks. Through his blog, The Vortex of a Digital Kind, he examines how emerging technologies shape consciousness, ethics, and autonomy. His writing blends technical understanding with philosophical reflection, encouraging readers to question how we live, connect, and think in an algorithmic age.
