Q-Day is coming. Is your organisation ready for post-quantum encryption?

Quantum computing will eventually break the encryption that protects almost everything we do online. The risk to your data isn’t in the future - it’s already here. Here’s where to start.

What is Q-Day?

Q-Day is the point at which the first Cryptographically Relevant Quantum Computer (CRQC) becomes available - a quantum machine powerful enough to break today’s encryption with ease.

The method it would use already exists. Shor’s algorithm, developed by researcher Peter Shor, shows how a quantum computer could break the encryption that underpins secure communication online. Speaking to New Scientist this year, Shor said: “We have good methods for post-quantum cryptography, we just have to implement them.” The caveat: “This will be incredibly hard.”

Sooner than you think

The consensus from leading tech firms and governments is that Q-Day lands sometime in the 2030s. But there’s a strong push to get there faster. The US Department of Energy is targeting and investing in quantum machines to support chemistry, plasma physics and materials science by 2028 - and that level of capability is likely to be CRQC-level technology.

We’d argue Q-Day arrives earlier still. The very first CRQC will hand an enormous advantage to whichever organisation or nation owns it. That isn’t something likely to be announced with a fanfare.

The risk is already here

Why does this matter now? 

Because the risk isn’t in the 2030s. It’s today.

Harvest Now, Decrypt Later (also known as Store Now, Decrypt Later) is exactly what it sounds like. Attackers intercept your traffic or steal your encrypted data now, sit on it, and decrypt it the moment a CRQC makes that possible.

Harvest Now, Exploit Later uses the same technique to decrypt security content - keys, tokens and credentials - that can then be used in wider attacks.

We’re already at the point where data encrypted today will still hold real financial, strategic or security value when Q-Day arrives. And updating encryption across an entire ecosystem isn’t a quick job. It’s a big, slow change that touches everything.

Where organisations are at now

At DigiGov 2026, we had several in-depth conversations with public sector organisations about PQE readiness. Understanding of the challenge comes in layers:

→ Most people now know Q-Day is coming.

→ Many are aware of Harvest Now, Decrypt Later and its variants.

→ Few have considered all the places encryption algorithms are used beyond data encryption and TLS.

→ Only one had an actual plan, with backing, to address the risks.

And that’s from the delegates who were interested enough to talk about it.

Where to start

The message from every one of these conversations was the same: start now.

The good news is that post-quantum encryption algorithms are already available.

There’s nothing to wait for - just a clear plan to put in place.

Encryption only protects data for as long as that data has value. So the starting point is to identify the data that will still be valuable after Q-Day, and prioritise it. From there:

1. Map how that data is protected. Not just certificates and TLS, but your Public Key Infrastructure (PKI), service identities, signing, recovery processes and more. For most large organisations, that starts with an inventory of encryption across your internet-facing services.

2. Work out what an attacker would need to capture. What data would they need to steal it - or which traffic could they store now and decrypt later?

3. Build a prioritised, phased plan. So you’re ready to make changes calmly as PQE-ready algorithms arrive from your vendors. This is a programme, not a project.

The organisations that start now will do this calmly, over years. The ones that wait will do it in a panic, after the announcement that never comes.

How we can help

We’re now booking conversations to share our tooling, experience and process.

Alongside our partners at Klarvant, we can inventory your use of encryption across your internet-facing services at scale - giving you a clear picture of where you stand, and what to prioritise first.

Not sure what data you hold that will outlive today’s encryption? Get in touch at enquiries@throughtechnology.uk.