Quantum Computing and the Future of Cyber Security

In this piece for DLA Piper’s Legal Edge blog, authors Gareth Stokes, Ross McKean, Rachel de Souza & Laura Dobson analyze the growing implications of quantum computing for cybersecurity, data protection, and regulatory compliance. While quantum computers are not yet capable of breaking modern encryption, their unique ability to solve certain complex mathematical problems far more efficiently than classical computers poses a significant future threat to the cryptographic systems that secure financial transactions, communications, personal data, and critical infrastructure.

The authors explain that governments and regulators are already preparing for this transition. Organizations in the UK, EU, and US are being encouraged—or may soon be required—to adopt post-quantum cryptography and develop migration plans well before quantum computers become capable of compromising existing encryption standards. Regulators increasingly view quantum readiness as part of an organization’s broader cybersecurity and data protection obligations.

The article highlights the legal and operational risks of inaction, particularly in light of the “harvest now, decrypt later” threat, where attackers collect encrypted data today with the intention of decrypting it once quantum capabilities mature. Businesses that fail to assess and address quantum-related risks could face regulatory scrutiny, financial penalties, litigation, and reputational damage if sensitive information is later exposed through foreseeable vulnerabilities.

Finally, the authors warn that the convergence of quantum computing and artificial intelligence could accelerate cyber threats even further, enabling more sophisticated attacks and faster exploitation of vulnerabilities. They recommend that organizations begin preparing now by inventorying cryptographic systems, adopting crypto-agile technologies, reviewing vendor readiness, integrating quantum risk into governance and compliance processes, and treating quantum readiness as a long-term strategic priority rather than a distant technological concern…