The strategy that organizations set now across infrastructure, security, products, and partnerships will determine their long-term resilience.  

Quantum computing brings with it new promises and the potential to solve problems beyond the reach of traditional compute. However, with this new technology also comes risks.  Sufficiently powerful quantum computers could break the public-key cryptography that protects data, identity, and software integrity. Imagine sensitive credentials, financial records, or government communications becoming readable. Or consider a device accepting a fraudulent software update because it cannot reliably verify who signed it. Post-quantum cryptography (PQC) is the industry’s response.

Once treated largely as a future prerogative, PQC is moving from research to execution as standards and policies set timelines requiring action today, and the risk is no longer hypothetical.

Through “Harvest Now, Decrypt Later,” (HNDL), adversaries are already collecting encrypted data to decrypt when quantum capabilities mature. The modern data center is a concrete example of this risk, concentrating valuable, long-lived data across applications, AI workloads, compute, storage, networks, and clouds. This makes protection a priority today, not just when powerful quantum computers arrive.

While the quantum threat has been a subject of ongoing industry research, recent regulatory mandates and updated timelines have now shifted the focus from future-state planning to immediate, infrastructure-level execution.

The mandate is accelerating 

For IT and procurement leaders, these timelines mean that quantum readiness is no longer just a long-term research project—it is now a critical factor in current infrastructure procurement. The mandate to act is clear, even if the path forward is not, and government requirements are compressing timelines further. NSA guidance targets 2027 for compliant new acquisitions supporting National Security Systems. The June 2026 U.S. Executive Order directs high-value and high-impact federal systems to adopt PQC for key establishment by the end of 2030 and digital signatures by the end of 2031. Similar mandates are advancing globally, making quantum safety a worldwide infrastructure priority that will increasingly shape procurement and partner expectations.

Build quantum readiness into today’s infrastructure strategy 

Much of the industry conversation has focused on secure communications — protecting information across networks, applications, clouds, and data centers. This matters but is only half the equation.

Organizations must equally prioritize secure products. Cryptography establishes trust in the infrastructure itself: device identity, secure boot, and software and firmware verification. Without quantum-safe protections, attackers could impersonate trusted devices or introduce malicious firmware. A quantum-safe connection offers little protection if products at either end cannot verify their integrity.

This is especially important as AI accelerates data-center build-outs. Infrastructure deployed today will likely still be running through key PQC milestones. Products lacking cryptographic agility or a credible upgrade path could risk turning an orderly transition into a costly retrofit.

Organizations do not need to replace everything today, nor race ahead of mature standards and validated implementations. However, they do need to:

• Understand their cryptographic exposure across their environment
• Prioritize PQC driven upgrades of long-lived data and critical systems
• Make crypto-agility part of current architecture and procurement decisions

Together, that creates a phased path from classical cryptography through hybrid deployments to quantum-safe infrastructure.

The strategic objective is not a single upgrade. It is to preserve flexibility to evolve securely as technologies, standards, and requirements continue to change.

Making readiness actionable 

What does it take to make a successful post-quantum migration? Increasingly, the answer goes beyond algorithms. It takes visionary strategy, globally-aligned standards, and an ecosystem of partners working together.

One lesson stands out: resilience is a property of entire systems, not individual products. A single non-upgraded node can undermine the benefits of upgrades elsewhere, which is why organizations tend to fare better when they approach PQC holistically rather than in silos. That same thinking shapes how we engage with standards bodies and alliance partners, where progress depends on shared, interoperable approaches.

For our part, we’re working to put this into practice. By December 2026, Cisco plans to enable quantum-safe communications capabilities across the majority of our core portfolio, and new campus, branch, and data center routers, switches, and firewalls are planned for launch with quantum-safe secure boot. Beyond this, our longer-term investments in distributed quantum computing also give us a broader perspective on the security challenges of this transition.

The quantum transition is already underway. The infrastructure choices organizations make today will help determine whether the move to quantum-safe is a planned transition or a disruptive retrofit.

Post-Quantum Cryptography

Learn more about Cisco’s approach:

• Quantum Resilience Needs a Common Language
• Cisco IQ and Quantum Ready Assessments
• Quantum Networking: How Cisco Is Accelerating Practical Quantum Computing