The arrival of a cryptographically relevant quantum computer – often referred to as «Q-Day» – was long considered a distant theoretical challenge. That possibility has now moved close enough to demand immediate planning and action from corporate security teams.

This is particularly important for the financial industry, given the highly sensitive financial and personal data it holds and the potentially significant financial and reputational damage a breach could cause. Cybercriminals are already collecting and storing encrypted corporate data, records, and other intellectual property with the intention of decrypting and exploiting it once sufficiently powerful quantum hardware becomes available.

Post-quantum cryptography (PQC) is therefore becoming essential, particularly the integration of quantum-safe capabilities into the foundational layers of hybrid cloud infrastructure. This allows companies to protect their digital assets today while preparing for the approaching «Q-Day.»

Organizations that wait until powerful quantum computers are available risk falling three to five years behind – and may discover that archived data has already been compromised. While Switzerland has yet to issue an official recommendation on the matter, Germany’s Federal Office for Information Security has already responded by recommending phase-out deadlines for conventional encryption methods such as RSA and ECC: the end of 2030 for particularly sensitive data and the end of 2031 for all other data.

These timelines can also serve as a useful benchmark for companies in Switzerland. In any case, organizations need to take action themselves to mitigate the risks posed by «Q-Day.» Four measures are particularly important:

1. Map your cryptographic footprint

If an organization does not know where encryption is being used, it cannot adequately protect it. Most organizations operate thousands of automated connections based on outdated, quantum-vulnerable algorithms, often buried deep inside applications and largely unnoticed.

Security teams should therefore begin by conducting a comprehensive inventory across the entire hybrid cloud environment, identifying exactly which encryption methods are being used and where. Particular attention should be paid to highly sensitive assets such as AI model weights and training data.

2. Test new cryptographic methods in isolated environments

Moving to quantum-safe algorithms changes response times, computing requirements, and overall system behavior. Before production systems are affected, new cryptographic standards should be tested in isolated environments under realistic conditions.

This allows performance degradation and other issues to be identified early, before they can have serious consequences in production environments.

3. Shift responsibility from individual applications to the platform

Requiring every development team to manually migrate all of its applications to post-quantum cryptography can quickly lead to delays and configuration errors.

A more effective approach is to embed encryption centrally at the platform level, for example within the operating system or container infrastructure. One major advantage is that updates can then be implemented centrally and automatically protect all workloads running on top of the platform.

4. Maintain control over where data resides and is processed

Quantum security involves more than updating algorithms. Organizations also need clarity about where their data actually resides and where it is processed.

Companies that hand over complete control of infrastructure decisions to individual providers become dependent on those providers’ choices. Isolated platform environments with clearly defined boundaries between workloads help ensure that data flows remain transparent and that information does not inadvertently move into environments where it could be compromised.

Combined with hardware-assisted technologies such as Confidential Containers, these environments provide an additional layer of protection, particularly for data that is actively being processed.

Jean-Philippe Jung is an expert in post-quantum cryptography and confidential computing at open-source specialist Red Hat.