The race toward quantum computing is accelerating – and the security implications are something we should consider now. When Google unveiled its latest quantum breakthrough with Willow, in December 2024, it marked a significant step forward in the quantum journey. But amid the buzz, it’s important to recognize that Willow represents just the second of six critical milestones toward scalable, usable quantum hardware and software. We’re still in the early innings, but now is the time for security leaders to get serious about preparing for a quantum future.
Why does this matter? Because quantum computing, once realized at scale, threatens to fundamentally disrupt the cryptographic foundations of our digital world. Today’s encryption standards, from RSA to elliptic curve algorithms, are considered secure not because they’re unbreakable, but because breaking them would take thousands of years with current classical computing power. Quantum systems, however, could shorten that timeline dramatically.
Consider a simple HTTPS connection between a user and a website. The secure handshake that protects the session relies on asymmetric key exchange algorithms. These algorithms are resilient today because brute-force attacks would take longer than the universe has existed. But a sufficiently powerful quantum computer could, in theory, solve those same problems exponentially faster – potentially rendering much of today’s encryption obsolete.
While quantum hardware isn’t in the hands of adversaries yet, government agencies and high-security industries aren’t waiting. They’re already investing in post-quantum cryptography (PQC) – encryption designed to resist quantum attacks. In fact, in 2024 the U.S. National Institute of Standards and Technology (NIST) finalized its first group of post-quantum encryption standards, following a years-long global vetting process. Adoption of these standards will play a vital role in future-proofing digital security.
The good news? PQC isn’t theoretical. It’s available today and relatively straightforward to implement. Security teams can begin evaluating and testing post-quantum algorithms without needing a wholesale overhaul of infrastructure. In most cases, PQC can be integrated at the protocol or software layer, without visible impact to users or systems.
Still, quantum preparedness isn’t just a technology question, it’s a strategic one. Organizations must build quantum resilience into their roadmaps now. That means staying close to evolving standards, investing in cryptographic agility, and ensuring teams are prepared to pivot quickly as quantum capabilities mature.
For most consumers and businesses, post-quantum encryption won’t be a pressing issue – yet. But for CISOs, CIOs, and security professionals, the time to act is before the tipping point arrives. Just as we’ve seen with AI, technological inflection points can come faster than anticipated, bringing rapid shifts in threat models and risk profiles.
Quantum computing may not be ready to rewrite the rules of cybersecurity tomorrow, but the smart move is to start preparing today. Because when the breakthrough comes, the organizations that have already laid the groundwork will be the ones best equipped to thrive in a post-quantum world.
About the Author
Jason Rader is the CISO of Insight Enterprises. He assumed the role in 2021 after joining the company in 2015 to build the security consulting group. Today, he builds upon more than 25 years of experience to develop Insight’s end-to-end security consulting portfolio and share Insight’s transformation journey with fellow security leaders. Jason can be reached online on LinkedIn and at our company website www.insight.com.
