Post-Quantum Cryptography: A 2026 Guide for Business

Quick answer: Post-quantum cryptography (PQC) is a new generation of encryption and digital-signature algorithms designed to stay secure even against powerful quantum computers. It matters now, not "someday", for two reasons. First, attackers can harvest encrypted data today and decrypt it later once quantum computers are capable enough. Second, NIST's draft transition plan marks today's RSA and elliptic-curve algorithms (at the common 112-bit security level) as deprecated after 2030 and disallowed after 2035. Migrating a real organization takes years, so the work starts in 2026.

Key takeaways

• The standards are ready. NIST published the first three post-quantum standards in August 2024: ML-KEM (FIPS 203) for encryption and key exchange, and ML-DSA (FIPS 204) and SLH-DSA (FIPS 205) for digital signatures. NIST's advice is to start integrating them immediately (NIST).
• There's a deadline. NIST's draft IR 8547 deprecates quantum-vulnerable RSA, ECDSA and ECDH at 112-bit security after 2030, and disallows them after 2035.
• The web is already moving. Cloudflare reports that well over 60% of human-generated TLS traffic to its network is protected with hybrid ML-KEM (Cloudflare).
• A backup algorithm is coming. NIST selected HQC in March 2025 as a backup to ML-KEM, with a final standard planned for 2027 (NIST).
• The hard part isn't the math. It's finding every place your systems use cryptography, and making them able to swap algorithms (crypto-agility).

What is post-quantum cryptography?

Most of today's internet security relies on public-key cryptography (RSA and elliptic-curve algorithms). It protects HTTPS connections, VPNs, logins, software updates, digital signatures, payment systems and API keys. Its security depends on math problems, such as factoring very large numbers, that ordinary computers can't solve in any practical time.

A large, fault-tolerant quantum computer running Shor's algorithm could solve those problems efficiently and break RSA and elliptic-curve cryptography. Post-quantum cryptography replaces them with algorithms based on different math problems (lattices, hash functions and error-correcting codes) that quantum computers aren't known to break.

Two points often cause confusion:

• PQC runs on normal computers. It's software and protocol changes, not quantum hardware.
• Symmetric encryption is mostly fine. AES-256 and strong hash functions such as SHA-256/384 are considered safe with adequate key sizes. The urgent problem is public-key cryptography.

Why is post-quantum cryptography important now?

"Harvest now, decrypt later"

Attackers, including well-funded state groups, can record encrypted traffic and stolen files today and store them until quantum computers can decrypt them. Anything that must stay confidential for many years is already at risk: health records, financial data, intellectual property, legal files, government and defense information, and long-lived credentials.

A simple rule of thumb, known as Mosca's inequality: if how long your data must stay secret plus how long your migration will take is greater than the time until a capable quantum computer exists, you're already late. Nobody knows exactly when that machine will arrive, which is precisely why waiting is risky.

Regulatory and customer deadlines

• NIST IR 8547 (draft): quantum-vulnerable algorithms at 112-bit security are deprecated after 2030 and disallowed after 2035.
• Government and defense supply chains in the US and elsewhere are adopting PQC requirements, which flow down to vendors and software suppliers.
• Enterprise customers are starting to include crypto-agility and PQC readiness in security questionnaires.

Migration takes years

Past crypto migrations, such as SHA-1 to SHA-2 or moving to TLS 1.2, took most organizations many years. Cryptography is buried in libraries, devices, certificates, partner integrations and old systems nobody has touched in a decade.

What are the NIST post-quantum standards?

• ML-KEM (FIPS 203): a module-lattice key-encapsulation mechanism (formerly CRYSTALS-Kyber). It's the main replacement for RSA and ECDH key exchange, used in TLS, VPNs and messaging.
• ML-DSA (FIPS 204): a lattice-based digital-signature algorithm (formerly CRYSTALS-Dilithium). It's the main replacement for RSA and ECDSA signatures in certificates, code signing and documents.
• SLH-DSA (FIPS 205): a stateless hash-based signature scheme (formerly SPHINCS+). It's slower, with larger signatures, but rests on very conservative assumptions, making it a backup option.
• Coming next: FN-DSA (based on FALCON), with smaller signatures, and HQC, a code-based backup to ML-KEM.

What is hybrid post-quantum encryption?

During the transition, most deployments use hybrid key exchange, combining a classical algorithm (such as X25519) with ML-KEM. The session stays secure as long as either algorithm holds. This is what modern browsers and large CDNs already use for TLS 1.3, and it's the safest way to adopt PQC today.

What happens if you don't prepare?

• Exposed secrets: data captured today can be decrypted in the future, causing breaches years after the fact.
• Forged signatures: once signatures can be forged, attackers could push malicious software updates, fake documents or impersonate servers.
• Compliance failure: systems still relying only on RSA or ECC after the deadlines won't meet government or enterprise requirements.
• Rushed, expensive migrations: organizations that start late will face emergency projects, vendor bottlenecks and higher costs.
• Lost deals: customers in finance, healthcare and the public sector will increasingly choose suppliers who can show a PQC roadmap.

How to migrate to post-quantum cryptography: a 5-step roadmap

1. Build a cryptographic inventory. Find every place cryptography is used: TLS endpoints, VPNs, certificates and PKI, SSH, code signing, databases, HSMs and key management, libraries in your code, IoT devices and third-party services. A cryptographic bill of materials (CBOM) makes this repeatable.
2. Prioritize by data lifetime and exposure. Start with internet-facing systems that carry long-lived sensitive data (the harvest-now-decrypt-later targets), then long-lived signing keys and roots of trust.
3. Build crypto-agility. Centralize cryptography behind well-maintained libraries and configuration, so algorithms can be swapped without rewriting applications. Remove hard-coded algorithms and key sizes.
4. Deploy hybrid PQC where it's ready. Enable hybrid ML-KEM key exchange for TLS 1.3 on servers, load balancers and CDNs. Upgrade OpenSSL, BoringSSL and similar libraries, and pilot ML-DSA certificates and code signing as your ecosystem supports them.
5. Test, monitor and work with vendors. PQC keys and signatures are larger, which can affect handshake sizes, packet fragmentation, old middleboxes and embedded devices. Test performance, ask vendors for PQC roadmaps, and track progress against the 2030 and 2035 milestones.

Quick wins you can do in 2026

• Turn on hybrid post-quantum TLS (X25519 + ML-KEM) wherever your web server, CDN or cloud load balancer supports it.
• Update cryptographic libraries to current versions with PQC support.
• Use AES-256 for data at rest and in transit, and retire legacy algorithms.
• Add PQC readiness questions to vendor and SaaS procurement.
• Create an owner and budget for the cryptographic inventory, because it's the foundation for everything else.

How AQVION LABS helps with post-quantum readiness

PQC migration is a security engineering project and a software engineering project at the same time. AQVION LABS helps teams:

• Map where cryptography lives in their codebases, infrastructure and integrations, as part of a security review.
• Design crypto-agile architecture, so algorithms are configured in one place rather than hard-coded across services.
• Upgrade TLS, libraries and key management across cloud and infrastructure, testing performance before rollout.
• Build new systems PQC-ready from day one, with threat modeling that accounts for long-lived data.

Frequently asked questions

When will quantum computers break RSA?

No one knows precisely. Estimates range from roughly the early 2030s to much later, and the timing depends on progress in building large, error-corrected machines. Because encrypted data can be stored now and decrypted later, the risk to long-lived data starts before that day.

Is AES-256 quantum-safe?

AES-256 is considered secure against known quantum attacks. Grover's algorithm only offers a square-root speed-up, which a 256-bit key absorbs. The urgent migration is for public-key algorithms such as RSA and ECC.

What is ML-KEM?

ML-KEM is NIST's standardized post-quantum key-encapsulation mechanism (FIPS 203), formerly known as CRYSTALS-Kyber. It's used to agree on encryption keys securely, and is already deployed in hybrid mode in modern browsers and CDNs.

Do I need quantum computers to use post-quantum cryptography?

No. PQC algorithms run on ordinary computers, phones and servers. Adopting them means updating software, libraries, protocols and certificates.

What is crypto-agility?

Crypto-agility is the ability to change cryptographic algorithms, key sizes or libraries quickly, without rewriting your applications. It's the most important long-term capability for the post-quantum transition, and for whatever comes after it.

Where should a small business start?

Ask your hosting, CDN and SaaS providers about their PQC support, enable hybrid TLS where available, keep libraries updated, and list the systems that hold data you must protect for 5 to 10 years or more. Those are your priorities.

Get post-quantum ready with AQVION LABS

Not sure where your organization uses RSA or elliptic-curve cryptography, or how big the migration will be? Talk to AQVION LABS about a cryptographic inventory and a practical, phased roadmap.

Related reading: Why Cybersecurity Matters: 2026 Business Guide · Web3 and AI Integration: A 2026 Guide for Business.

---

Sources: NIST, first three finalized post-quantum standards (Aug 2024) · NIST, HQC selected as fifth algorithm (Mar 2025) · NIST IR 8547 (initial public draft) · Cloudflare, post-quantum SASE (Feb 2026). Timelines are based on draft guidance and may change. This article is general guidance, not legal or compliance advice.