The quantum threat has a deadline. What should businesses protect first?

[SINGAPORE] Singapore’s quantum security agenda is moving from long-term planning to defined migration timelines.

The country’s Cyber Security Agency (CSA) recently set 2031 as the target year for critical-information infrastructure systems to complete quantum-safe migration.

Meanwhile, other organisations exposed to quantum risks are encouraged to develop their migration plans by the end of 2027 – and complete migration by 2035.

For businesses, the immediate challenge is not simply understanding the threat, but also deciding what matters most and must be protected first.

Leaders must ask: Which information would create the greatest risk if exposed, and which systems will take longest to migrate?

Quantum risk begins before quantum computers arrive

Cybercriminals may already be collecting encrypted information to decrypt in the future, once sufficiently powerful quantum computers become available – a threat known as “harvest now, decrypt later”.

THE BUSINESS TIMES INSIGHTS

Powering Asean's Future 2026

Find out how enterprises are navigating power constraints and sustainability targets

ACCESS THE INSIGHTS

This threat changes the timeline for data protection, and more companies should take note. The 2026 Thales Data Threat Report found that 61 per cent of organisations have identified future decryption of existing data as their leading quantum-related concern.

Financial records, intellectual property and sensitive communications that must remain confidential for years could be “harvested” today and exposed later.

Their confidentiality lifespan becomes a critical measure of quantum risk: If information needs protection for another 10 or 20 years, organisations cannot base migration decisions solely on when sufficiently powerful quantum computers arrive.

SEE ALSO

Singapore must look beyond AI and build its quantum tech talent now

Singapore, Germany to collaborate on AI use in industries, step up research on new tech

Singapore and Luxembourg working to deepen ties in quantum tech, AI, space, satellite communications

Migration should follow business risk, not a blanket timetable

Organisations should prioritise quantum-safe migration according to risk, rather than attempt to upgrade every system simultaneously.

Three factors should determine what moves first: how sensitive the information is; how long it must remain protected; and how long the underlying system will take to migrate.

Priorities will differ by sector.

Financial institutions may focus on payment infrastructure and sensitive financial communications; healthcare providers on long-lived patient records; and critical-infrastructure operators on systems supporting essential services.

Migration lead time matters, too. Some critical systems operate for decades and depend on legacy infrastructure, specialised hardware or multiple suppliers.

Changing their cryptography – mathematical algorithms that protect and obscure data in communication or storage – may require extensive integration and testing to avoid disrupting operations.

A system that will take years to migrate may therefore require attention earlier than one with similar risk that can be updated quickly.

Know what is exposed

Organisations cannot prioritise migration if they do not know where cryptography is used.

Cryptographic mechanisms sit in applications, digital certificates, authentication systems, cloud platforms, hardware and third-party services. A cryptographic inventory can show what data is protected, which algorithms and keys are used, where they sit and which systems depend on them.

Those dependencies determine how difficult migration will be. Replacing an algorithm or certificate can affect authentication, application-to-application communications or compatibility with older infrastructure.

This visibility gives organisations a basis for deciding what to migrate first, where supplier coordination is required and which environments need longer testing periods.

Singapore’s approach reflects this challenge. The CSA’s Quantum-Safe Kickstarter Grant includes support for cryptographic discovery and inventory, end-to-end system migration, and operational technology and legacy infrastructure.

Build for further change

Businesses should consider not only how to replace today’s cryptography, but also how easily their systems can accommodate future changes.

This is the principle behind “crypto-agility”: the ability to update or replace cryptographic algorithms, protocols and keys without redesigning entire systems.

As standards and threats evolve, this flexibility can reduce the cost and disruption of future changes. Businesses can begin by testing post-quantum cryptography in their own environments and incorporating quantum-safe requirements into planned technology upgrades and procurement.

This requires decisions beyond cybersecurity teams.

Technology, procurement, compliance and business leaders need to account for operational requirements, supplier dependencies and investment cycles when planning migration.

The cost of waiting is losing room to act

The priority is not to predict exactly when quantum computers will break today’s encryption. It is to make deliberate decisions before migration becomes an operational constraint.

This starts with identifying which information would still matter if decrypted years from now, and which systems would take the longest to change.

With Singapore encouraging exposed organisations to have migration plans in place by the end of 2027, businesses have a defined planning horizon.

Mapping cryptographic dependencies and prioritising systems according to sensitivity, confidentiality lifespan and migration lead time gives organisations a practical basis for deciding what moves first.

Acting now also gives businesses time to manage the transition, before deadlines compress their options.

The writer is head of cyber services, South-east Asia, Thales