Quantum computing and cryptography risk are colliding now

At a glance

What this is: This is a practitioner-focused analysis of quantum computing’s benefits and limits, with its key finding that the strongest near-term security issue is cryptographic risk rather than raw computational speed.

Why it matters: It matters to IAM practitioners because quantum risk changes certificate, key, and workload identity planning, especially where secrets, federation, and long-lived trust assumptions intersect.

By the numbers:

• 72% of experts predict a fully fault-tolerant quantum computer will be available by 2035.

👉 Read Keyfactor's analysis of quantum computing’s advantages, limits, and cryptographic risk

Context

Quantum computing is moving from theory into long-range security planning because the main governance issue is no longer whether the technology is real, but whether current cryptographic trust models will survive its arrival. For identity teams, the problem is not abstract physics. It is whether certificates, keys, and authentication dependencies can be migrated before long-lived trust becomes a liability.

The article argues that quantum systems may eventually create value in optimisation, simulation, and security, but the immediate enterprise concern is the mismatch between future capability and present-day cryptographic dependence. That makes this a governance issue for IAM, PKI, and workload identity programmes, not just a research topic.

Key questions

Q: How should security teams prepare for post-quantum cryptography migration?

A: Start by inventorying every cryptographic dependency, including certificates, signing keys, TLS endpoints, federation flows, and workload identities. Then rank systems by data sensitivity and required confidentiality lifetime. The goal is not a big-bang swap. It is a controlled migration path that lets you replace algorithms while preserving trust and availability.

Q: Why do quantum computing risks matter to identity and access management?

A: IAM depends on cryptographic trust for authentication, federation, and secure communication. If current public-key algorithms become unsafe, the identity plane inherits the risk because certificates, tokens, and trust anchors all rely on those primitives. That is why quantum readiness belongs in identity governance, not just in cryptography teams.

Q: What should organisations get wrong less often about quantum computing risk?

A: A common mistake is treating quantum risk as a distant, purely technical issue. The real issue is trust durability. If sensitive data must remain confidential for many years, then harvest-now, decrypt-later attacks make present-day encryption choices relevant today. Security teams need to plan for that timing now, not at the moment quantum hardware matures.

Q: Who should own post-quantum readiness in the enterprise?

A: Ownership should sit across security architecture, IAM, PKI, application engineering, and risk governance. The reason is simple: cryptography is embedded in identity flows, not isolated inside a single platform. Without cross-functional ownership, migration stalls at the boundaries between certificates, applications, and operational change management.

Technical breakdown

Why superposition changes what quantum computers can compute

Quantum computing relies on qubits, which can exist in superposition instead of a single binary state. That changes the computational model from deterministic step-by-step processing to interference-driven calculation, where algorithms suppress wrong answers and amplify the right ones. The practical consequence is not universal speed, but the ability to attack certain classes of problems, such as complex optimisation and quantum simulation, that do not map well to classical parallelism. This is why the value proposition is uneven: some workloads may benefit dramatically, while ordinary enterprise tasks still favour classical systems.

Practical implication: separate speculative quantum use cases from ordinary compute workloads when setting architecture and security priorities.

Why quantum hardware fragility and error correction slow adoption

Quantum systems are highly sensitive to decoherence, meaning vibration, heat, and electromagnetic interference can collapse qubit state and corrupt results. Error correction tries to compensate by using many physical qubits to create one logical qubit, but that overhead sharply reduces usable capacity. This is why current systems remain far from production scale for most enterprise problems. The challenge is structural, not merely engineering delay. Even when the science works, the infrastructure needed to keep qubits stable constrains cost, scale, and practical deployment.

Practical implication: assume near-term quantum risk comes from future cryptographic impact, not from broad enterprise adoption today.

Why post-quantum cryptography is the real security planning issue

The article’s security message is rooted in cryptographic transition risk. Shor’s algorithm threatens the mathematical foundations behind RSA, Diffie-Hellman, and elliptic curve cryptography, which protect certificates, TLS, and many identity flows. The main danger is not only future decryption, but harvest now, decrypt later, where encrypted data is stolen today for use when quantum capability matures. That makes crypto-agility central. Organisations need to know where public-key dependencies exist, how long data must remain confidential, and which systems can be migrated without breaking trust chains.

Practical implication: inventory cryptographic dependencies now so certificate, token, and federation migrations can happen on a controlled timeline.

NHI Mgmt Group analysis

Quantum computing turns cryptographic lifecycle management into a board-level identity problem. The article is not just about future decryption power. It is about the fact that certificates, keys, and trust anchors already underpin authentication, federation, and workload access. That means post-quantum planning belongs inside identity governance, not only inside cryptography teams. Practitioners need to treat crypto inventory as an identity control surface, because the trust fabric is the thing at risk.

Harvest-now, decrypt-later is the clearest assumption break in this topic. The assumption that encrypted data is safe until an attacker can decrypt it was designed for a world where algorithmic capability changes slowly enough for rotation and retirement to catch up. That assumption fails when data can be captured now and decrypted later at scale. The implication is that retention, confidentiality horizon, and migration timing must be evaluated together, not separately.

Crypto-agility is the named concept this market is converging on. In practice, it means organisations must be able to swap algorithms, certificates, and trust dependencies without redesigning every dependent system. The article shows why this matters across IAM, PKI, and workload identity, because modern authentication stacks are full of embedded cryptographic assumptions. Practitioners should view agility as an architectural property, not a one-time migration project.

Quantum readiness also exposes how much of enterprise identity is already bound to long-lived trust. Federation protocols, signed tokens, and certificate-backed access all depend on confidence that the underlying primitives will remain trustworthy for years. That is a governance challenge because many identity programmes still optimise for current operational convenience rather than future cryptographic resilience. The practical conclusion is that identity roadmaps now need a migration horizon, not just a renewal calendar.

From our research:

• 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
• Only 5.7% of organisations have full visibility into their service accounts, which means most identity teams still lack the inventory needed for cryptographic transition planning.
• For a broader governance baseline, Top 10 NHI Issues helps teams connect identity sprawl, privilege, and lifecycle control before post-quantum migration begins.

What this signals

Crypto-agility is becoming part of identity architecture, not a separate security project. As quantum risk shifts planning from theory to transition, teams need to know where certificate lifecycles, federation trust, and workload identities intersect. For the governance baseline, the NIST Cybersecurity Framework 2.0 remains a useful control map for prioritisation and ownership.

The immediate question for practitioners is whether their current identity estate can absorb algorithm change without breaking services. If the answer is no, then the programme has a resilience gap, not just a cryptography gap.

Long-lived secrets and long-lived trust are now linked problems. Any environment that still depends on static keys, legacy certificates, or hard-coded trust assumptions should be treated as migration-sensitive. Teams should start with the systems that are hardest to rotate, because those are the systems most likely to become quantum exposure points.

For practitioners

• Inventory cryptographic dependencies across identity systems Map every certificate, key, token signing dependency, and federation trust relationship across IAM, PKI, and workload identity so you know which systems rely on vulnerable public-key primitives.
• Build a crypto-agility migration path Define how your organisation will swap algorithms without rewriting dependent applications, and test that path in environments where certificates, tokens, and service identities are tightly coupled.
• Classify data by confidentiality horizon Identify which datasets must remain secret for years, because harvest-now, decrypt-later risk is driven by how long stolen data needs to stay protected rather than by current exploitability alone.
• Prioritise certificate lifecycle visibility Track where long-lived certificates exist, how they are renewed, and which services fail if trust anchors change, so you can sequence post-quantum changes with fewer outages.

Key takeaways

• Quantum computing is valuable for some classes of problems, but its biggest enterprise impact today is the pressure it puts on current cryptographic trust models.
• The most serious risk is not future speed alone, but the fact that stolen encrypted data may be held now and decrypted later when capability catches up.
• Identity teams should treat post-quantum readiness as a lifecycle and architecture problem, with crypto inventory, agility, and migration sequencing handled together.

Key terms

• Post-Quantum Cryptography: Post-quantum cryptography is a set of algorithms designed to resist attacks from both classical and quantum computers. It matters because many current identity and communication systems rely on public-key methods that a sufficiently capable quantum computer could weaken or break.
• Crypto-Agility: Crypto-agility is the ability to change cryptographic algorithms, certificates, and trust dependencies without redesigning the whole system. In identity programmes, it means authentication, federation, and signing components can be updated in a controlled way as threat models change.
• Harvest Now, Decrypt Later: Harvest now, decrypt later is an attack strategy where adversaries capture encrypted data today and wait until future cryptographic capability makes it readable. It is especially relevant for identity and access systems because long-lived trust data and retained secrets may remain valuable for years.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.

This post draws on content published by Keyfactor: Advantages and Disadvantages of Quantum Computing: What You Need to Know. Read the original.