For years, post-quantum cryptography has been treated as a future problem. Something to get to eventually. A long-term item on the security roadmap that could wait while more pressing things got handled.
That calculus just changed.
In late March 2026, Google updated its internal timeline for the threat posed by quantum computing and moved the deadline up. The company now considers 2029 the point at which organizations need to have completed their migration to post-quantum cryptography (PQC). That’s not a distant horizon. That’s three years.
Google isn’t a neutral observer here. The company is simultaneously responsible for securing a substantial portion of global internet communications and actively building its own quantum computers, giving it a uniquely informed vantage point on how close this technology actually is. If you’re new to the topic, our overview of navigating the quantum cybersecurity frontier is a solid starting point, and should your business care about quantum computing yet answers the question we hear most often from SMB leaders.
Until recently, Google had aligned with the NIST timeline, which set 2030 as the target for deprecating quantum-unsafe algorithms and 2035 for full disallowance. Moving that deadline up, even by a year, is a meaningful signal. The resources required to break current encryption have dropped dramatically. Research that previously suggested 20 million quantum computing units to break RSA has been revised to as low as 100,000. The bar keeps getting lower.
Here’s what makes this urgent even before quantum computers are fully capable: sophisticated attackers don’t need to wait. They’re already collecting encrypted data today, intending to decrypt it later once quantum capability catches up. This is a form of data exfiltration that won’t show up in your current threat monitoring because the harm is deferred. And as AI-powered cybercrime enters a more dangerous era, the sophistication of these long-game attacks is only increasing.
The threat isn’t purely future-tense. For any data with long-term sensitivity, the window of exposure has already opened.
Research from the Trusted Computing Group found that the vast majority of businesses don’t have a roadmap in place to address quantum threats. Fewer than half have begun a readiness assessment. Some of that gap comes from genuine misconceptions, including the belief that quantum is only a concern for large enterprises. Before assuming you’re the exception, it’s worth conducting an honest cybersecurity assessment that specifically covers your cryptographic posture.
It’s also worth understanding the broader shift underway in how organizations think about security fundamentals. The collapse of perimeter security means that encryption and identity are increasingly the last line of defense, which makes getting post-quantum cryptography right even more critical. And cyber resilience vs. cybersecurity is a distinction worth understanding as you plan your transition.
NIST has finalized four quantum-resistant algorithms and selected a fifth, the path exists. What’s lagging is execution. A practical post-quantum readiness effort starts with a cryptographic inventory and a forward-looking approach to data encryption. From there, the focus shifts to cryptographic agility: the ability to swap algorithms without wholesale system replacements; a design principle that should inform new systems being built today.
High-priority assets such as authentication systems, anything with long-term data sensitivity, or financial infrastructure, should move to the front of the migration queue. Organizations should also be tracking the cybersecurity metrics that signal cryptographic health as part of their broader posture. And for SMBs without a dedicated security leader, the SMB CISO problem — who owns risk when you don’t have one — is a question worth answering before a quantum-era breach forces the answer.
Three years sounds like a comfortable amount of time until you account for the reality of enterprise technology transitions. Full cryptographic migrations in complex environments take time; time to inventory, assess, test, phase, and remediate what doesn’t go as planned.
Organizations that start now have options. They can be deliberate and methodical, phase the work across budget cycles, train staff, and avoid the compressed emergency timelines that drive up cost and risk.
Organizations that wait until 2028 will find themselves in a very familiar position: paying the migration tax, on a deadline, with no leverage.
The quantum threat isn’t hypothetical anymore. The timeline has moved. The question isn’t whether to act, it’s whether to act now, on your terms, or later, on someone else’s.
