Majority unprepared for quantum computing’s security risks

Most organisations remain unprepared for the security and business implications of quantum computing, despite growing concerns among professionals about the potential risks it poses to current encryption methods, according to recent research from ISACA.

The ISACA Quantum Computing Pulse Poll, which surveyed more than 2,600 professionals in fields such as digital trust, cybersecurity, IT audit, governance and risk, found that while awareness of quantum computing's transformative potential is increasing, concrete planning and readiness measures are largely absent from organisational agendas.

According to the poll, 62% of technology and cybersecurity professionals are concerned that quantum computing could break today's internet encryption, raising the possibility of vulnerabilities in digital signatures, websites, utilities and medical records. However, just 5% of respondents said that their organisation considers quantum computing a high priority for near-term planning, and only 5% report having a defined strategy for it.

Jamie Norton, ISACA Board Director, highlighted the accelerating pace of quantum computing and the significant implications for sectors that handle large volumes of sensitive data. He said, "Too many Australian and New Zealand organisations remain in reactive mode and underestimate quantum computing's potential to break existing encryption. Now is the time to assess whether you have the expertise to implement post-quantum cryptography solutions and start building internal capability. This is essential to mitigate its impact and protect sensitive data, maintain customer trust and ensure long-term business resilience."

The research underscores that many see potential for quantum technology to drive major advancements. Sixty-three percent of respondents expect quantum computing to significantly speed up computational tasks or data analysis, and 46% anticipate that it will lead to revolutionary innovation. Nearly half (48%) are optimistic about the impact quantum computing could have within their sector.

At the same time, respondents are alert to new risks, with 63% saying quantum computing will increase or shift cybersecurity risks. More than half (57%) believe it will create new business risks, 52% expect that it will change the skill sets required by businesses, and 50% foresee challenges around regulation and compliance. Among participants from Oceania, concern was even higher across all these areas by at least 10 percentage points.

A total of 62% of respondents expressed concern that quantum computing could break current internet encryption before new, quantum-resistant algorithms have been fully implemented. More than half (56%) cited fears around the so-called "harvest now, decrypt later" threat, whereby data is stolen now with the intention of decrypting it using quantum computers in the future.

Despite a quarter of poll respondents believing that quantum computing will have an industry-wide impact within five years, and 39% saying they expect it in six to ten years, many organisations are taking a wait-and-see approach. Forty-one percent report no plans to address quantum computing at this time and 40% are not aware of their company's intentions regarding quantum issues.

When questioned on the role of quantum computing in their current technology strategies, only 15% indicated it was on a long-term roadmap, while 19% had discussed it in some form but made no formal plans, and 37% had not discussed it at all. Nearly a quarter (24%) were unsure of their organisation's view on the matter.

The poll findings also point to significant knowledge gaps. Only 7% of respondents claimed to have a strong understanding of the new post-quantum cryptography standards developed by the US National Institute of Standards and Technology (NIST), while 44% said they had never heard of them.

Many organisations have yet to take decisive action to prepare for quantum computing. More than half (55%) have not started any preparatory steps. Of those that have, actions cited include: assessing regulatory or compliance implications (46%); exploring quantum-safe cryptography (38%); collaborating with quantum hardware or software providers (28%); training staff (27%); and investing in research and proof-of-concept initiatives (27%).

The poll also found that 30% of global cyber and IT professionals do not feel they have a good understanding of quantum computing's capabilities, highlighting the need for training and skills development in this area.

Rob Clyde, chairman, Crypto Quantique, and past ISACA board chair, advised that organisations begin preparing now. He said, "Start by 1) identifying where encrypted data are stored and devices that use encryption, 2) developing a plan to transition to post-quantum cryptography prioritising critical data and systems, and 3) continuously monitoring for updated software and firmware with post-quantum cryptography. Waiting until quantum computing is here is too late, especially given today's harvest-now, decrypt-later threat."