“Q-Day” sounds like a cinematic moment when a machine suddenly breaks the internet. The practical risk is slower and already present. Organisations rely on cryptography embedded in software, identity systems, devices, contracts and long-lived infrastructure. Replacing it takes years.
Attackers can also collect encrypted information now and wait to decrypt it later. For health, government, research and commercial secrets with long sensitivity, the threat timeline begins before a capable quantum computer exists.
What could break
Large quantum computers running Shor’s algorithm could undermine common public-key methods used for key exchange and digital signatures. Symmetric encryption is affected differently and can often respond with larger keys.
The distinction matters because migration priorities depend on each system and data life.
Inventory before panic
An organisation cannot replace cryptography it cannot find. Certificates, libraries, embedded devices, vendor services and archived signatures need mapping.
Crypto-agility means being able to change algorithms without rebuilding the entire service.
Standards are arriving
Post-quantum algorithms are being standardised and deployed, but implementation errors, performance and interoperability require testing. Hybrid approaches may reduce transition risk.
Procurement contracts should require upgrade pathways and disclose cryptographic dependencies.
Small organisations still depend on the chain
Most businesses will not design their own migration. They rely on cloud, banks, software vendors and government identity systems. Clear guidance and coordinated timelines are therefore public infrastructure.
Legacy medical, industrial and transport devices may be the hardest part because replacement cycles are long.
Prepare without pretending certainty
No one can name Q-Day reliably. Waiting for certainty would leave too little time; claiming it is imminent can waste resources and credibility.
The sensible response is disciplined migration: identify long-lived secrets, inventory systems, test standards and demand vendor plans. Quantum risk is less a countdown clock than a reminder that security transitions begin while the old system still appears to work.
Sources and further reading: ABC Science Q-Day feature; NIST post-quantum cryptography.
