Quantum Computing Will Not Break the Internet Overnight, but We Should Still Be Preparing

Drew Stone
6 days ago
7 min read

Over the past several years, we have all heard some version of the same warning:

Quantum computers are going to break encryption.

Depending on who is explaining it, this can sound either like distant science fiction or an impending digital apocalypse.

As usual, the truth is more complicated and much more interesting.

I recently read HP’s article, HP Quantum-Resistant Cryptography, and it caught my attention for reasons that are both professional and personal. It brings together several areas I care deeply about: quantum computing, enterprise technology, cybersecurity, and the long-term trustworthiness of the devices we rely on.

More importantly, the article approaches quantum security as an engineering problem that needs to be addressed now, not as a crisis that begins on some mysterious future date.

What Is the Actual Quantum Threat?

When people talk about quantum computers breaking encryption, they often imagine a single dramatic moment.

A sufficiently powerful quantum computer is switched on, passwords are suddenly exposed, banks become vulnerable, and the internet stops being secure.

You will sometimes hear this hypothetical moment described as “Q-Day.”

I do not believe the transition will happen that way.

Quantum computers could eventually threaten widely used public-key cryptographic systems such as RSA and elliptic-curve cryptography. These technologies help secure websites, software updates, digital signatures, identity systems, and private communications.

However, building a quantum computer capable of reliably defeating modern cryptography remains an enormous scientific and engineering challenge.

The danger is not that every encrypted system will fail tomorrow morning.

The danger is that changing the cryptographic foundation of modern technology will take years, perhaps decades.

Harvest Now, Decrypt Later

One of the most important concerns is commonly called Harvest Now, Decrypt Later.

An attacker may intercept and store encrypted information today, even if they cannot currently read it. The attacker can preserve that information in the hope that a future quantum computer, or some other cryptographic breakthrough, will eventually make decryption possible.

That may not matter for information that loses its value after a few days.

It matters considerably more for national security information, medical records, intellectual property, financial information, research data, and communications that must remain confidential for many years.

This changes the question organizations should be asking.

Instead of asking:

When will a quantum computer be able to break encryption?

We should ask:

How long must our information remain secure, and how long will it take us to replace the systems protecting it?

That is a much more practical question.

Why HP’s Approach Caught My Attention

Most discussions about post-quantum security focus on internet traffic, VPNs, digital certificates, or encrypted communications.

Those are all important.

HP’s article goes deeper by focusing on firmware integrity and hardware roots of trust.

Before we can trust an operating system, application, or network connection, we must first trust the device that started it all.

Firmware helps initialize hardware and establish the foundation on which the rest of the system operates. If an attacker can modify that firmware without being detected, many of the protections above it become far less meaningful.

HP has incorporated quantum-resistant firmware verification into selected business PCs and printers. Its approach uses both traditional RSA signatures and the Leighton-Micali Signature scheme, commonly called LMS. LMS is a hash-based digital signature system standardized by the National Institute of Standards and Technology.

Using both classical and quantum-resistant signatures creates a transitional layer of protection. The existing technology remains available, while the device also gains a method designed to withstand future quantum attacks. HP describes this as part of a broader strategy to establish quantum-resistant trust at the hardware and firmware level.

This is an important distinction.

HP is not claiming that one feature makes an entire organization “quantum safe.”

Instead, it is beginning with one of the most foundational and difficult-to-replace parts of the technology stack.

That feels like the right place to start.

Hardware Life Cycles Matter

Enterprise computers, printers, collaboration systems, and other infrastructure may remain deployed for many years.

Government agencies and large organizations do not replace every device whenever a new cryptographic algorithm becomes available. Hardware refreshes require budgets, procurement cycles, testing, approvals, deployment planning, and ongoing support.

Some cryptographic functions may also be embedded deeply within hardware or read-only components. Those systems may not be easily upgraded later.

A product purchased today could still be operating when the risks from quantum computing become more practical.

This is why quantum readiness is not only a future software problem. It is also a hardware procurement and lifecycle-management problem.

Organizations should increasingly ask vendors:

Which cryptographic algorithms are built into the product?
Can those algorithms be replaced through updates?
How are firmware and software updates authenticated?
Does the vendor have a documented post-quantum migration strategy?
Will the product remain supportable as security standards evolve?

Those questions may eventually become as routine as asking whether a product supports secure boot, multifactor authentication, or modern encryption.

Security Is Never One Upgrade

Another common misconception is that organizations will eventually install a single update and become quantum resistant.

Technology rarely works that way.

Post-quantum migration will affect many interconnected systems, including:

Digital certificates
Public key infrastructure
VPNs
Identity and authentication services
Firmware validation
Secure boot
Code signing
Software distribution
Hardware security modules
Cloud services
Device management platforms
Encrypted messaging and collaboration tools

Organizations must first discover where vulnerable cryptographic algorithms are being used. They must then determine which systems can be upgraded, which must be replaced, and which carry the greatest risk.

NIST finalized its first three principal post-quantum cryptography standards in August 2024. These include ML-KEM for establishing shared encryption keys, ML-DSA for digital signatures, and SLH-DSA as a hash-based signature standard. NIST now recommends that organizations begin applying these standards and planning their migrations.

This does not mean every organization should immediately replace every cryptographic system.

It does mean that cryptographic discovery, inventory, and planning should already be underway.

Where Artificial Intelligence Fits

As I read the HP article, I kept thinking about the role artificial intelligence may play in this transition.

Consider the complexity of finding every cryptographic dependency across a large global enterprise.

An organization may have millions of certificates, thousands of applications, countless firmware versions, legacy systems, cloud services, network appliances, and devices that were installed years ago.

Some may be well documented.

Many will not be.

AI could help organizations analyze software inventories, identify vulnerable algorithms, examine certificates, prioritize systems based on risk, and monitor migration progress.

It could also assist engineers by analyzing compatibility issues, recommending transition paths, reviewing configurations, and identifying systems that have been overlooked.

That does not eliminate the need for cybersecurity professionals.

It makes their work more scalable.

People will still need to make decisions about risk, architecture, procurement, compliance, and acceptable trade-offs. AI may simply help them understand an environment too large and complicated for any individual team to evaluate manually.

There is an interesting symmetry here.

Quantum computing may create one of the most complex security transitions in modern technology, while AI may become one of the tools that helps us manage that transition.

Quantum Resistant Does Not Mean Quantum Cryptography

There is also an important distinction between post-quantum cryptography and quantum cryptography.

Post-quantum cryptography uses mathematical algorithms designed to run on conventional computers while resisting attacks from both classical and quantum computers.

Quantum cryptography uses principles of quantum mechanics itself, such as quantum key distribution, to protect communications.

HP’s work is focused on post-quantum cryptography.

That is the more practical path for protecting most existing technology because it can be incorporated into today’s hardware, firmware, operating systems, and network protocols without requiring an entirely new quantum communications infrastructure.

The term “quantum resistant” should also be used carefully.

No responsible engineer can promise that an algorithm will remain secure forever. Post-quantum algorithms are selected because the best available research indicates that they resist known classical and quantum attacks.

Cryptography is always based on evidence, continuous analysis, testing, and the ability to adapt when new weaknesses are discovered.

That is why crypto-agility, the ability to replace algorithms without rebuilding an entire system, may be just as important as the algorithms chosen today.

Should Organizations Be Worried?

I do not believe organizations should panic.

I do believe they should prepare.

A useful first step would be to determine which information must remain confidential for many years. Organizations should also begin documenting where public-key cryptography is used and evaluate whether their current hardware and software can support future algorithms.

Procurement decisions should begin accounting for quantum readiness, especially when purchasing systems expected to remain deployed well into the 2030s.

The goal is not to predict the exact date when a cryptographically relevant quantum computer will exist.

The goal is to avoid discovering, too late, that replacing a critical security foundation takes longer than expected.

My Take

One of the reasons I enjoy following quantum computing is not because I expect it to transform the world in a single dramatic moment.

I enjoy watching the future quietly arrive.

Major technological changes usually emerge through thousands of smaller decisions. Standards are developed. Hardware is redesigned. Software is updated. Engineers solve problems most people never see.

Then, seemingly all at once, the new technology becomes part of everyday life.

That is what I find compelling about HP’s work.

Quantum-resistant firmware verification may not sound as exciting as a revolutionary quantum computer, but this is how meaningful technological change actually happens. Someone recognizes a future risk, studies the architecture, and begins strengthening the foundation before the problem becomes an emergency.

I also appreciate that HP is beginning at the device level.

Throughout my career, I have seen how difficult it can be to secure, manage, and modernize technology across large organizations. Even a seemingly small change can affect procurement, compatibility, support, compliance, and thousands of deployed endpoints.

Preparing for post-quantum cryptography will be a much larger undertaking.

It will require collaboration among researchers, manufacturers, governments, software developers, cybersecurity teams, and customers. Artificial intelligence may help us manage the complexity, but human judgment will remain essential.

To me, this is not really a story about quantum computers breaking the internet.

It is a story about responsible engineering.

It is about acknowledging that the technology we deploy today may still be protecting critical information many years from now.

The future is not something that simply happens to us.

It is something we build, one thoughtful decision at a time.