The G7 just put out guidance urging organizations, public and private, to get ready for quantum computing’s impact on cybersecurity. If your reaction is “quantum computers that break encryption aren’t here yet, so why worry now,” you’re technically right, but you’re missing the point the G7 is making.
Here’s the thing about quantum risk: it’s not really a future problem, it’s a right-now problem wearing a future costume. Bad actors can steal encrypted data today and just sit on it, waiting for quantum computers powerful enough to crack the encryption later. Security teams call this “harvest now, decrypt later.” So even if a cryptographically useful quantum computer is years away, any sensitive data you’re transmitting or storing today with current encryption could already be compromised the moment that capability exists. That’s what makes this urgent instead of theoretical.
The math behind it is straightforward. A lot of today’s encryption relies on problems that are extremely hard for regular computers to solve, like factoring huge numbers. Quantum computers, once mature, could solve those problems fast. That would unravel the encryption protecting everything from bank transactions to patient records to classified communications.
This is why the G7’s push matters across so many sectors, not just cybersecurity shops. Financial institutions move trillions of dollars through encrypted channels daily, and decades of transaction history sitting in breached databases suddenly becomes readable is a nightmare scenario for regulators and customers alike. Healthcare systems hold medical records that are sensitive for a patient’s entire lifetime, meaning data encrypted today needs to stay protected for 50-plus years. Government agencies handle classified and diplomatic communications where exposure could have national security consequences long after the fact.
The practical ask isn’t “buy a quantum computer defense.” It’s about starting the transition to quantum-resistant encryption standards now, since inventorying your systems, figuring out where sensitive data lives, and swapping out cryptographic algorithms takes years, not weeks. Organizations that wait until quantum computers are a proven, immediate threat will already be behind.
It’s also a reminder that government guidance like this tends to move slower than the technology it’s addressing. The G7 flagging this now, even without a firm timeline for when quantum breaks encryption, is itself a signal that risk planners think the window for calm, orderly preparation is closing.
Questions Worth Chewing On
- Should regulators set hard deadlines for migrating to quantum-resistant encryption, or is voluntary guidance enough?
- Which sectors are actually most exposed if “harvest now, decrypt later” attacks are already happening quietly?
- Does this kind of guidance risk becoming another compliance checkbox rather than a genuine security shift?
- Who should bear the cost of re-encrypting decades of stored sensitive data, the organizations holding it or the vendors who built the original systems?