Why UK businesses must prepare their cyber security capabilities and talent before quantum computing threatens today’s encryption.
Executive summary
Quantum computing could transform industries, from finance and pharmaceuticals to materials science. But it also presents a serious future challenge for cyber security.
Powerful quantum computers could eventually break some of the encryption methods that protect sensitive information, digital identities and online communications. Today’s quantum computers cannot yet do this at the scale required, and the timing remains uncertain. However, organisations cannot afford to wait until the threat becomes immediate before preparing their systems.
The UK’s National Cyber Security Centre (NCSC) has set out a clear timetable for moving to encryption designed to resist quantum attacks. Organisations are expected to assess their systems and plan their migration by 2028, complete their highest-priority migration activities by 2031, and aim to finish the transition by 2035.
Meeting these milestones will require more than new technology. Businesses will need people who understand cyber security, existing IT systems, supplier relationships, risk management and complex technology programmes.
Businesses don’t need to use quantum computers themselves to be affected by quantum computing. They need to understand how the technology could affect their security and have the skills to prepare.
1. Quantum computing is creating a new cyber security deadline
Most businesses rely on encryption every day, whether they realise it or not.
Encryption protects information such as financial transactions, customer records, confidential emails and data sent between systems. It works by using mathematical methods that make information difficult to read without the correct key.
Some of these methods could become vulnerable when sufficiently powerful quantum computers become available. This doesn’t mean that all encryptions will suddenly stop working. The main concern is that quantum computers could undermine certain widely used methods, including those used to protect digital identities and establish secure connections.
The UK Parliament’s Parliamentary Office of Science and Technology explains how this could affect digital security in its October 2026 briefing, How could quantum computers undermine digital security?.
The important point for businesses is that the risk isn’t limited to the day quantum computers become powerful enough to break current encryption.
Some attackers may collect encrypted information today in the hope of decrypting it in the future. This is often called a “harvest now, decrypt later” attack. It matters most when information must remain confidential for many years, such as sensitive commercial data, intellectual property or long-term personal records.
Organisations therefore need to consider how long their information must remain secure; not just how secure it appears today.
2. Why waiting could leave businesses exposed
It’s understandable that businesses don’t want to invest heavily in a technology that is still developing. Quantum computing isn’t yet a practical solution for every commercial problem, and its future applications remain uncertain.
However, preparing for quantum-related cyber security risks is different from investing in quantum computing itself.
Businesses don’t need to buy quantum computers or build specialist quantum research teams to begin preparing. They need to understand which of their systems rely on vulnerable encryption, where sensitive information is stored or transferred, and what must change.
That work takes time.
Large organisations may have complex technology estates, older systems, bespoke software and suppliers that control important parts of their infrastructure. Replacing or upgrading encryption can involve testing, procurement, integration, risk reviews and coordination across several teams.
The NCSC has established three key milestones for this transition:
- By 2028: identify systems that rely on cryptography, assess what needs to change and create an initial migration plan.
- By 2031: complete the highest-priority migration activities and refine the plan for the remaining work.
- By 2035: aim to complete the transition to post-quantum cryptography across systems, services and products.
These are planning targets, not predictions of the exact date when quantum computers will become capable of breaking current encryption. The NCSC’s full post-quantum cryptography migration guidance explains the expectations and the work involved.
For many smaller businesses, technology suppliers may handle much of the transition through routine product updates. Organisations with bespoke systems, complex infrastructure or greater security requirements may need more direct planning and investment.
Either way, businesses should understand their dependencies rather than assume someone else will take care of everything.
3. The talent challenge extends beyond quantum specialists
When businesses hear about quantum computing, they may assume they need to recruit people with highly specialised quantum physics or quantum software expertise.
For most organisations preparing for post-quantum security, that isn’t the immediate priority.
The more pressing need is for people who can assess existing systems, manage security risks and deliver a complex technology transition. These capabilities already exist, but they may be stretched across other business priorities.
Cyber security and cryptography specialists
Businesses need people who can assess how their current security works, identify vulnerable encryption and help choose suitable alternatives.
This includes understanding how security is implemented across applications, networks, databases and connected services. Specialists must also consider how changes could affect performance, compatibility and existing security controls.
Enterprise and solution architects
Changing encryption isn’t simply a matter of installing an update everywhere.
Architects help organisations understand how systems connect, where data moves and which components depend on one another. They can identify technical dependencies, plan changes and reduce the risk of disrupting business operations.
Technology programme and project leaders
A migration that affects multiple systems, suppliers and business units requires coordination.
Programme and project leaders can establish priorities, manage budgets, track dependencies and keep technical teams aligned with business requirements. They also help ensure that security work progresses alongside other essential technology projects.
Risk, governance and procurement professionals
Quantum-related security risks are not solely technical decisions.
Risk and governance teams need to understand which information is most sensitive, how long it must remain protected and what obligations the business must meet. Procurement teams need to ask suppliers about their plans, product support and migration timelines.
These roles help turn technical recommendations into decisions that the wider business can act on.
4. Why businesses may struggle to find the right expertise
The challenge isn’t necessarily a shortage of people with “quantum” in their job titles. It’s finding the right combination of skills and experience.
An organisation may have capable cyber security specialists but lack the architecture expertise needed to map a complicated technology estate. It may have strong project managers who have never delivered a security migration of this scale. Or it may rely on suppliers without having enough internal knowledge to assess their plans.
This creates a workforce planning problem: businesses need to identify the capabilities required before they know precisely how much work the migration will involve.
Research by EY and the UK’s National Quantum Computing Centre highlights a broader readiness gap. Its 2026 Quantum Business Readiness Report found that 87% of surveyed UK business leaders expected quantum computing to disrupt their industry by 2030, while only 13% planned to recruit the talent they expected to need within the next two years.
These figures relate to the report’s survey of 500 leaders at companies with revenues of £150 million or more; they should not be treated as representative of every UK business. Nevertheless, they illustrate the gap that can emerge between recognising a technological shift and preparing the workforce to respond.
Businesses may also face competition for people who combine deep technical knowledge with experience of complex, regulated or business-critical environments. Recruiting those people can take time, particularly when their skills are already in demand for other cyber security and transformation projects.
The answer isn’t to recruit every possible specialist in advance. It’s to identify the capabilities the business will need, understand which ones it already has, and plan how to close any gaps.
5. How businesses should prepare their workforce
A practical approach begins with understanding the business’s exposure. Recruitment decisions should follow that assessment, rather than lead it.
Step 1: Establish what needs protecting
Start by identifying the information, systems and services that rely on encryption.
Consider which data would cause the greatest harm if it were exposed in the future, which systems support essential operations, and how long sensitive information must remain confidential.
Include suppliers and third-party services in the assessment. Important security dependencies may sit outside the organisation’s direct control.
Step 2: Assess existing skills and capacity
Identify who can assess the current environment, plan technical changes, evaluate suppliers and manage the migration.
The business may already have many of the necessary skills. The gap could be specialist knowledge, a lack of available time, limited programme management capacity or uncertainty about who owns the work.
Distinguishing between these issues helps prevent unnecessary recruitment and highlights where existing teams need support.
Step 3: Build a realistic migration roadmap
Use the assessment to establish priorities, dependencies, costs and decision points.
Some changes may be handled through normal supplier upgrades. Others may require dedicated projects, specialist advice or substantial investment.
The roadmap should assign clear responsibility, account for other business priorities and reflect the NCSC’s migration milestones. It should also be reviewed as standards, products and technical guidance develop.
Step 4: Decide how to secure the expertise
Not every skills gap requires a permanent hire.
Depending on the scale and duration of the work, businesses could develop existing employees, use specialist external support, recruit permanently for long-term needs or bring in experienced contractors for defined projects.
The right approach depends on the organisation’s current capabilities, internal capacity, risk exposure and expected workload.
Permanent recruitment may make sense when a capability will remain essential. Temporary expertise may be more appropriate for a specific assessment or migration phase. In many cases, a combination of both will be the most practical solution.
The key is to make these decisions deliberately, before a lack of capacity becomes a delivery risk.
6. What technology leaders should do now
Technology leaders don’t need to predict exactly when quantum computing will reach the point of threatening current encryption. They need to make sure their organisations are prepared for the transition.
That means putting four things in place:
- Visibility: a clear understanding of the systems, information and suppliers that depend on cryptography.
- Ownership: named people responsible for assessing the risk and coordinating the response.
- Planning: a realistic roadmap aligned with the organisation’s wider technology and security priorities.
- Capability: access to the technical, architectural, risk and programme management skills needed to deliver the work.
The OECD’s March 2026 paper, Building business readiness for quantum computing, examines the wider challenges organisations face when preparing for quantum technologies, including skills shortages, training costs and uncertainty about commercial applications.
Although adopting quantum computing and preparing for post-quantum security are different tasks, both demonstrate why emerging technology requires more than technical investment. Organisations also need the people, knowledge and planning to turn change into action.
Conclusion: prepare the people before the pressure hits
Quantum computing doesn’t need to become commercially widespread before businesses start feeling its effects on cyber security planning.
The transition to post-quantum cryptography will involve technical change, but it will also require coordination, risk assessment, supplier management and sustained delivery. Organisations that leave these questions until the last minute could face unnecessary pressure on budgets, timelines and specialist resources.
Businesses don’t need to recruit a quantum computing team simply because the technology is advancing. They do need to understand their exposure, assess their existing capabilities and identify where additional expertise will be needed.
The immediate priority isn’t to predict the future perfectly. It’s to build the capability to respond before the deadline becomes a crisis.
How Bristow Holland can help
At Bristow Holland, we understand that emerging technology risks create new demands for specialist skills and experienced technology leadership. If your organisation is assessing its future technology capabilities or planning a complex security programme, our team can help you explore the talent requirements involved.
Contact Bristow Holland to discuss your technology recruitment needs.
