For years the quantum threat to encryption came with a comfortable footnote: yes, a quantum computer could break RSA someday, but you would need roughly 20 million qubits to do it, and nobody was close. Security leaders filed it under "problems for the 2030s" and moved on.
That footnote is gone. In under twelve months, three research papers cut the estimated cost of breaking modern encryption by more than an order of magnitude. The machine did not get built. The math got smarter. And that distinction is exactly why this matters now.
What Actually Changed
Start with the numbers, because they do the heavy lifting.
In May 2025, Craig Gidney of Google Quantum AI showed that factoring a 2048-bit RSA key - the encryption behind most banking, email, and TLS certificates - could be done with fewer than one million noisy physical qubits in under a week. His own 2019 estimate had been 20 million. Nothing about the hardware improved. The 20x reduction came entirely from better algorithms: more efficient arithmetic, denser storage of idle qubits, and cheaper generation of the resource states fault-tolerant computing needs.
In February 2026, a Sydney startup called Iceberg Quantum pushed the RSA-2048 estimate below 100,000 physical qubits using a different error-correction architecture. That is another 10x, though it trades away some hardware assumptions and has only been proven in simulation, not silicon.
In March 2026, Google published again - this time on elliptic curve cryptography, the scheme protecting most digital signatures and every major cryptocurrency. Their estimate: under 500,000 qubits, with a runtime measured in minutes. ECC needs about 100x fewer logical operations than RSA, so once the machine exists, it falls faster.
Three papers. One direction. The cost of the attack keeps dropping while the hardware timeline keeps compressing.
Why "Harvest Now, Decrypt Later" Is a Today Problem
Here is the part that trips people up. The quantum computer that breaks RSA does not exist yet. So why act now?
Because the attacker does not need the machine today. They need your data today.
"Harvest now, decrypt later" is a threat model where an adversary captures encrypted traffic or exfiltrates encrypted archives right now, stores them, and waits. When a capable quantum computer arrives, they decrypt the whole haul retroactively. Nation-state collectors have the patience and the storage. They are not waiting for permission.
That reframes the entire risk calculation. The relevant question is not "when will a quantum computer break RSA." It is "how long does my data need to stay secret." If you handle information that must remain confidential for ten or fifteen years - patient records, financial instruments, intellectual property, classified designs, critical infrastructure schematics - then the clock started the day that data was created. Anything an adversary captured last year is already sitting in a queue.
For regulated industries, the exposure window is not theoretical. It is the retention period written into your compliance obligations.
The Migration Is the Hard Part, Not the Algorithm
Here is what works in your favor: the defense already exists. NIST finalized its post-quantum cryptography standards in 2024 - FIPS 203, 204, and 205, covering key exchange and digital signatures. NSA, CISA, and NIST have issued joint guidance urging organizations to begin migrating now. The algorithms are ready.
The problem is that swapping cryptography is not a patch. It is an inventory-and-replace project across every system that touches encryption, and most organizations have no complete map of where that is. Encryption hides inside TLS libraries, VPNs, hardware security modules, code-signing pipelines, database engines, embedded firmware, and third-party dependencies you have never audited. Some of it is on gear you cannot easily upgrade.
Cryptographic migration at large organizations is measured in years, not quarters. Cloudflare, one of the more prepared companies on the planet, is targeting 2029 for full post-quantum coverage. That is the honest timeline for an org that does this professionally. Most enterprises have not started.
So the real work is not choosing an algorithm. It is answering three questions most teams cannot answer today: Where is cryptography used across my environment? Which of that data has a long enough shelf life to matter? And what breaks when I change it?
Where This Fits Into Offensive Security
Cryptographic inventory sounds like a governance exercise. In practice it is a discovery problem, and discovery is what offensive work does well.
The same techniques used to map an attack surface - enumerating services, fingerprinting protocols, tracing data flows, finding the forgotten systems nobody documented - are the techniques that surface where weak cryptography actually lives. You do not find harvest-now exposure by reading a policy document. You find it by looking at what is really running, which certificates are in use, which handshakes negotiate down to vulnerable ciphers, and where sensitive data crosses the wire.
This is the layer that runs between formal engagements: continuous validation of what your environment is actually doing versus what your architecture diagram claims. Quantum readiness is one more thing that map needs to show.
The Takeaway
Nobody is decrypting your RSA traffic this afternoon. That is not the point. The point is that the timeline moved, quietly, through math rather than hardware, and the data an adversary needs to benefit from that shift is the data you are protecting right now.
Post-quantum migration belongs on the roadmap this year - not as a fire drill, but as a deliberate program that starts with knowing where your cryptography lives and which of your data cannot afford to wait. The organizations that start the inventory now will migrate calmly. The ones that wait for a working quantum computer will migrate in a panic, and by then the harvested data is already gone.
If you want to know where your quantum exposure actually sits, that starts with seeing your environment the way an attacker does.
Sources
- Gidney, Google Quantum AI, "How to factor 2048 bit RSA integers with less than a million noisy qubits" (May 2025)
- Iceberg Quantum, Pinnacle architecture announcement (February 2026)
- Google Quantum AI et al., cryptocurrency ECC whitepaper (March 2026)
- NIST FIPS 203, 204, 205 - Post-Quantum Cryptography Standards (2024)
- The Quantum Insider, "Q-Day Just Got Closer" (March 31, 2026)
- Cloudflare, "Cloudflare targets 2029 for full post-quantum security" (April 2026)
