“Q-Day,” the point at which quantum computers begin to break the encryption protecting most of the internet, lives in the same mental category as other far-off technology risks: real eventually, but not something requiring immediate action. That assumption is no longer safe.
In March, Google LLC set 2029 as its own migration deadline for post-quantum cryptography. This demonstrates how an organization with a genuine view into how quickly quantum hardware is advancing, and it’s years ahead of the National Security Agency’s 2031 target and the National Institute of Standards and Technology’s 2035 guideline for national security systems. Google said it accelerated its timeframe because of faster-than-expected progress in quantum hardware and error correction that has lowered the number of qubits needed to threaten current encryption.
The same month, a research team spanning the California Institute of Technology, the University of California at Berkeley, and quantum startup Oratomic Inc. published a paper showing that a fault-tolerant quantum computer capable of running Shor’s algorithm, which breaks RSA and elliptic-curve encryption, may require as few as 10,000 to 26,000 qubits. That’s roughly two orders of magnitude below the millions once assumed necessary. Two independent lines of research thus concluded that the hardware bar is lower than the industry is planning for, and the timeline is compressing aggressively.
Everywhere all at once
This isn’t a breach story where one company gets hit, and others watch from a safe distance. Public-key cryptography underpins everything: the Transport Layer Security handshake that secures web sessions, the digital signatures that authenticate software updates, the key exchanges banks use to move money, the certificates that let one server trust another. When these layers break, they break for everyone simultaneously because they’re all standing on the same mathematical foundation.
The closest historical parallel is the Year 2000 problem, but Y2K was a known, dated failure point, and it triggered roughly two years of coordinated, well-funded, all-hands remediation across the industry. Q-Day is shaping up to be a comparable failure with a similar or shorter runway, and it is getting a small fraction of the attention.
Furthermore, the “harvest now, decrypt later” strategy many adversaries are pursuing means the damage won’t wait for Q-Day. They can capture encrypted data today and hold onto it until decryption becomes possible. Some of what organizations consider secure right now is already compromised; they just don’t know it yet.
Piecemeal patching won’t work
The instinctive response is to treat this like any other vulnerability: Inventory the systems, patch them and move on. But that approach breaks down at large scale. Modern organizations don’t run a handful of applications with clean ownership; instead, they run thousands of services, many built on third-party code that they can’t independently re-architect. Dependency chains run deep, and the whole chain is only as strong as its weakest cryptographic link.
Changing the landscape application by application before 2029 is not a realistic plan. There are too many control points, too many owners and too little visibility into where encryption actually lives.
The more immediate fix is to move to post-quantum readiness at the network layer itself, where a small number of control points can be upgraded instead of thousands of applications. A handful of infrastructure updates, rolled out once across the fabric that carries traffic between systems, can cover ground that would otherwise require perfect coordination across dozens of teams and vendors. That’s the difference between a migration that can realistically finish by 2029 and one that’s still in progress when the deadline arrives.
The network fabric that carries and secures traffic between applications can be updated once with new cryptographic standards and rolled out across the environment. Fewer control points means a faster rollout and far less dependence on dozens of teams executing correctly on deadline. It shifts post-quantum migration from an unmanageable, distributed project into a centralized one.
Work is underway — slowly
My conversations with carriers, enterprises and governments indicate that quantum-readiness assessments are already happening. What they’re finding largely confirms that app-by-app progress is slow.
Independent research confirms this. DigiCert Inc.’s 2026 Quantum Readiness Outlook found that 87% of organizations are planning, testing or implementing post-quantum initiatives, yet only 7% have deployed quantum-safe or hybrid cryptography across a meaningful share of their digital certificates.
Axiad IDS Inc. found that 51% of enterprise security leaders have never formally tested their public-facing infrastructure for post-quantum key exchange, and nearly half lack a named leader responsible for the migration. A Ponemon Institute LLC study, sponsored by Entrust Corp., found that only 38% of organizations globally report actively transitioning to post-quantum cryptography.
Awareness is high, but execution is stalled, largely because organizations are trying to solve this problem at the wrong layer.
What to do now
Most organizations aren’t acting with enough urgency. The practical starting point isn’t to wait for a regulatory mandate or a fully patched application stack, but to start an assessment at the infrastructure level now. That means understanding where encryption lives across the network, which systems can be upgraded centrally and which control points would give the fastest, broadest coverage if updated first.
Google didn’t set a 2029 deadline lightly, and additional research suggests that the timeline could move even earlier as quantum technology continues to improve faster than expected. Organizations that start building infrastructure-level crypto-agility today will be the ones still standing when that date arrives.
Shaikh is chief executive of network-as-a-service company Graphiant Inc. He wrote this article for SiliconANGLE.
