Hackers are stealing encrypted data now to crack it later, so starting a "hybrid" security plan today makes the 2030 quantum deadline a total non-event.

CSO Online offers insights into cybersecurity, risk management, and IT leadership, providing articles, reports, and expert analysis to help security professionals navigate the evolving threat landscape and protect their organizations from cyber attacks. By exploring CSO Online's curated content, CISOs, security managers, and IT executives can learn about threat intelligence, security frameworks, and incident response strategies for building resilient cybersecurity programs. Whether you're defending against ransomware, phishing attacks, or insider threats, CSO Online offers resources to strengthen your security posture and safeguard your digital assets.

CSO Online

With NIST finalizing post-quantum cryptography standards in 2024 and adversaries already harvesting encrypted data for future decryption, US enterprises face a real 2030 deadline. A hybrid approach—combining classical algorithms like ECDHE with post-quantum algorithms like ML-KEM—lets organizations reduce long-term risk without breaking existing systems. The recommended roadmap includes building a cryptography inventory tied to data sensitivity, picking three early migration surfaces you control end-to-end (internal mTLS, VPN, code signing), standing up a hybrid-ready lab, improving crypto agility, running a limited pilot with measurable success criteria, and embedding post-quantum requirements into procurement contracts starting now.

Why US companies must be ready for quantum by 2030: A practical roadmap