So, the impact is pretty evident, but it’s the likelihood where things get complicated. First, there is the likelihood that this won’t happen at all, as well as that it won’t happen on a time scale that matters for current investment strategies. The remaining likelihood points to an increasingly near-term threat. How do the players that will have access to the technology play into this? As mentioned, quantum will likely remain confined to governments and large companies, with the remaining public likely vetted and monitored.
So, if your organization isn’t currently targeted by a nation-state actor or groups that have access to future quantum computers, is there an impact to them? If most of the time the only compromise is to confidentiality, but relatively little monetary impact, is the risk acceptable to most organizations? With the exception of North Korea, few nation-states cause financial damage as a result of their activities (beyond possible regulatory/compliance fines). Much of their activities are driven by national security concerns like intelligence collection and posturing for future cyber support to a real-world conflict, not financial.
Organizations that are already targets of nation-state actors, such as governments, tech companies, large financial companies and nuclear facilities, will be the first to adopt PQC technology, while thinner-margin companies will likely push it to the back burner due to lack of perceived risk and limited resources.
