For enterprises, the danger does not begin on the day a sufficiently powerful quantum computer arrives. Security experts are already warning about‘ harvest now, decrypt later’ attacks, in which adversaries collect encrypted information today with the intention of decrypting it once quantum technology becomes capable of breaking the cryptography protecting it.

That changes the timeline considerably. Medical records, intellectual property, financial information, government intelligence and other sensitive data may need to remain confidential for another 10 or 20 years. Protecting that information means organisations need to begin preparing for a postquantum world long before cryptographically relevant quantum computers become a reality.

The quantum threat to cybersecurity may still appear distant, but the risk to today’ s encrypted data has already begun. As organisations across the GCC prepare for a post-quantum future, the immediate challenge for CISOs is discovering where vulnerable cryptography sits and determining what needs to change before the countdown reaches zero.

Across the GCC, that transition is beginning to gather momentum. According to The State of Post-Quantum Readiness in Key GCC Markets, published by QuantumGate and the UAE Cyber Security Council with support from the National Cryptography Center and the Technology Innovation Institute, 64 % of surveyed organisations have a budgeted post-quantum initiative, while 84 % are planning a transition.

Yet planning and preparedness are not necessarily the same thing. Cryptographic discovery, which creates an inventory of the keys, certificates, algorithms and protocols an organisation uses and identifies what they protect, has begun at only 35 % of surveyed organisations.

This visibility is becoming critical because organisations cannot protect cryptography they do not know exists.

This visibility is becoming critical because organisations cannot protect cryptography they do not know exists.

WWW. INTELLIGENTCISO. COM / MIDDLE-EAST 25