Will Quantum Computing Threats Fit into the Cybersecurity Transformation?

The problem of quantum computers and the threats they pose to digital communication is still largely seen as a futuristic risk, often with low or no priority within organisations. At the same time it’s difficult to argue with if we accept that securing an organisation’s operations in the digital world is an operational cost. Future risks will struggle to find support in a cybersecurity budget if they remain just that: future risks, with no clear connection to threats to the business.

Defining the threats

The potential emergence of an effective quantum computer introduces new types of threats that may affect an organisation’s ability to operate in the digital space. Below, we discuss two relevant threats that each organisation should assess independently, as every organisation has a different digital footprint.

HNDL threat

The “Harvest Now; Decrypt Later” (HNDL) threat is unusual because it concerns the future. In particular, encrypted data collected today may potentially be decrypted in the future with the use of a quantum computer.

Although the first step of such an attack, namely collecting the data, even in encrypted form, is itself non-trivial, there are indications that this may already be happening. On the one hand, through the report Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System, and on the other through the European Commission proposal (point 8) COM(2026) 13:

Given the continuously increasing reliance of our society and the economy on digital technologies, it is necessary to take mitigation measures against the quantum threat. The possibility of ‘harvest now - decrypt later attacks’, likely occurring already now, and the future risks induced by quantum attacks on forging signatures, as well as the planned deprecation of certain algorithm implementations and full disallowance of current public-key cryptographic algorithms, increase the urgency of initiating actions for the migration to post-quantum cryptography (PQC).

we can assume a non-zero probability that the “Harvest Now” step is already taking place today. It’s also worth noting that a single global collector may be enough, as the collected data could later be resold to others. As shown in the paper On the Practical Feasibility of Harvest-Now, Decrypt-Later Attacks, the annual cost of storing “1% of the Internet” is in the range of 1 billion USD. To put that scale into perspective, this 1% corresponds to 88,000,000 TB, or 241,095,890 GB per day.

At the same time, assessing its impact and consequences requires a different mental model, one that effectively depends on the future. In other words, it is difficult to assess the consequences of the threat while remaining anchored in the threat landscape and technological capabilities of 2026.

For this reason, when thinking about the impact of HNDL on an organisation, it is worth asking first whether it has an impact, and only then how it has an impact.

MITM threat

The “Man in the Middle” (MITM) threat is more subtle, as it concerns the non-repudiation of today’s digital signatures, which are used across a wide range of areas, contexts, protocols, and business processes. Organisations are often not even aware that digital signatures are in use somewhere within their systems.

MITM threat may allow an attacker to impersonate any identity in the digital world and forge signatures. This may be the identity of a person, a machine, or an AI agent.

Although the impact of this threat increases as we get closer to the emergence of an effective quantum computer, one actually capable of breaking today’s cryptography, mitigating MITM is more demanding because of its scale and scope. Trust distribution systems, one of the primary consumers of digital signatures, are by nature distributed systems and therefore have:

• high inertia — due to the diversity of node characteristics, propagating a change across the system may take a significant amount of time,

  consider across all nodes: updating libraries and/or software, revoking existing trust sources, accepting new trust sources, rotating keys

• slow convergence — the system only reaches a new consistent state across all nodes after some time.

This threat therefore concerns authenticity, a core property of secure digital communication, and may enable third parties to impersonate existing digital identities.

TNFL [Trust Now, Forge Later] and HNFL [Harvest Now, Forge Later] threats

A further specialisation of MITM threat is TNFL/HNFL, which assumes that in the future there will still be systems whose inertia is measured in decades, making change highly problematic, or systems whose components, including cryptography, cannot be replaced or updated.

Unlike MITM, TNFL/HNFL therefore relies on collecting public keys today in order to impersonate a given identity in the future.

PQC migration and emerging threats driven by the transformation of the digital world through “AI”

PQC migration cannot be discussed in isolation, it needs to be considered in a broader context, including the new threats already emerging from the automation of attacks with the support of model harnesses. To clarify, model harness is a software that runs and manages how a specific LLM is used. Recent papers from US providers[Discovering cryptographic weaknesses with Claude] [Ten Advances in Mathematics and Theoretical Computer Science] demonstrate novel model capabilities which may seem impressive today, but could become real threats to production systems tomorrow.

At the same time, access to such model harnesses may today be viewed similar to possessing an effective quantum computer, namely as a source of asymmetric geopolitical advantage. Although the policies of top US and Chinese vendors differ, the approach taken by the latter in particular, together with the rise of open-weight models, suggests that the digital world may run through a relatively rapid and necessary transformation in response to these new threats. This applies at the level of entire systems and the underlying infrastructure, specific communication and authorisation protocols, library implementations, and dozens of other details that until now have largely remained hidden.

In the context of PQC, it highlights an important nuance: the “future threats” mentioned above coming from the presence of an effective quantum computer may turn out to be present-day threats, however approaching from a different angle. Model harnesses and their use in attack automation can have a direct impact on today’s cryptosystems, and while cryptosystems are discussed in detail in the next section, a model harness’s ability to work with structured and unstructured data simultaneously makes it a useful tool for:

• discovering new vulnerabilities and weaknesses in cryptographic libraries and in software that uses them;
• data triage, including identifying similar patterns in collected digital signatures and searching for weaknesses in the underlying PRNG.

Cryptography is not just a NIST standard, but the entire cryptosystem

Finding vulnerabilities is about finding the weakest link. In cryptographic security, that weakest link is very rarely the cryptographic standard itself. Much more often, it is a bug in the implementation or integration of a cryptographic library, poor key management, or insufficient entropy used to generate the keys.

Only all of these elements together, in particular:

• the cryptographic standard,
• the cryptographic library and its integration into a specific system/application,
• cryptographic key management,
• the quality of entropy sources and correct use of the pseudorandom number generator (PRNG),

determine the “robustness” of the component we call a “cryptosystem”, which provides the organisation cryptographic security, and therefore the authenticity, confidentiality, and integrity of its communication in the digital world.

Appendix 1 provides a list of the most important historical and contemporary examples of compromises affecting individual components of a cryptosystem.

Can we see the threat from this perspective, namely not in the context of quantum computers, but of LLMs (their model harnesses), discovering vulnerabilities in cryptosystems?

It is difficult to provide a definitive answer. A more adequate question would be: “does having awareness, including awareness of the cryptographic algorithms used across an organisation, improve its resilience?” Here, the answer can be affirmative. Looking ahead, different forms of bill of materials (BOM), whether SBOM (software BOM) or CBOM (cryptography BOM), will increasingly contribute to organisational resilience by helping minimise exposure to vulnerabilities and enabling a fast response in the right system component.

Threats amplified by the use of model harnesses increase the need for SBOM/CBOM. While they do not mitigate the threat itself, they provide the system knowledge necessary to quickly identify exposure and respond appropriately. This also becomes increasingly relevant as vulnerabilities are disclosed at a growing rate and fixes need to be applied faster.

There is therefore a clear convergence in the need to mitigate threats affecting cryptosystems, both in the context of quantum computers and more immediate threats, particularly those emerging from the development of language models.

While there is still a long way from having a CBOM to completing a PQC migration, CBOM provides awareness, and awareness enables decision-making.

”Cryptosystem” vs. “crypto-agility”

Although the term cryptographic agility (“crypto-agility”) has been used in certain contexts for a long time already (i.e. in the TLS protocol), it is only with the publication of NIST CSWP 39 that we get a novel classification of definitions, understood depending on the context as theagility of:

• a system,
• a protocol,
• an organisation’s governance.

Achieving the desired level of agility, depending on the chosen variant, becomes an organisational, operational, and/or infrastructural challenge.

As a result, the organisation gains the ability to replace cryptographic algorithms. However, due to the way these algorithms are used, especially in the context of digital signatures or digital trust distribution (i.e. X.509 PKI), this operation requires proper coordination across the entire ecosystem. Digital trust distribution is, by nature, a distributed system, that naturally has a certain degree of inertia, thus reaching convergence takes time (see also MITM threat section. This introduces possible vulnerabilities (i.e. downgrade attacks), which may still lead to compromise of the entire ecosystem despite having crypto-agility in place.

Achieving crypto-agility via intent-based cryptographic API design

One recently proposed approach to cryptographic agility is “Intent-Based Cryptographic API Design for Cryptographic Agility”, which proposes reversing the existing dependency and focusing only on the intent, for example Sign("ABC"), within a particular implementation. This intent is then delegated to the appropriate service in the ecosystem, let us call it a “cryptographic control plane”, and executed according to the assigned permissions and the assigned signature provider. The result of executing Sign("ABC") will therefore be a digital signature, but what kind of signature exactly will depend on how the “cryptographic control plane” is materialised.

This approach achieves cryptographic agility at the level of organisational governance by hiding the details of the cryptosystem inside a newly introduced ecosystem service, but at the same time requires very good technological coordination and significant infrastructure automation. Adopting such posture, in turn, significantly impacts budgeting. It is therefore far from a universal solution.

Regardless of the adopted definition of cryptographic agility, such capability concerns the replacement of entire “cryptosystem”. In one solution, this may be a bottom-up change in the software source code, while in another it may be a top-down decision at the level of organisational governance.

What we can be certain of is that heterogeneous ecosystems spanning multiple trust domains, i.e., physical access to premises and digital access to resources, exhibit significant inertia. Crypto-agility can facilitate their migration, but it cannot eliminate the need for cross-domain coordination and the iterative upgrade of individual, potentially conflicting parts of the ecosystem.

PQC migration and the threat of compromising the cryptographic standard

Historically, the cryptographic scheme (algorithm) standard has been the strongest link in the entire cryptosystem. At the same time, historically, there has been no migration comparable in scale and scope to PQC migration. In particular, this migration involves replacing public-key cryptographic algorithms and proposes variants that:

• are relatively new and therefore not yet sufficiently studied, with a hypothetical possibility of a compromising weakness — this applies primarily to variants based on a particular mathematical problem, rather than concepts relying on the security of hash functions, such as SLH-DSA,
• are, in almost every aspect, namely: public key size, digital signature size, the number of CPU cycles required for signing or signature verification, generally less efficient than their current “classical” pre-quantum counterparts, which can be seen very clearly here.

In other words, organisations that are not looking for regulatory compliance, but for a specific capability provided by a particular cryptographic algorithm, should also consider:

• the threat of compromise of the standard itself — it is worth noting here the compromised/weakened schemes SIKE and HAWK[1][2]; in the case of HAWK, a few days later another paper appeared, reducing the Shortest Vector Problem to 3n/4+1, and although Anthropic’s result is better (n/2+1), it appears that timing made the difference, as the authors of the “Trace Zero Attack” approached the problem from a different direction,
• the threat of performance regression, and therefore the need to replace a given cryptographic scheme with another one offering better parameters as soon as such a scheme is recommended by the relevant institution.

Although SIKE and HAWK were compromised/weakened before any official recommendation, the use of AI agents may accelerate not only the analysis of implementations, but also the search for weaknesses in the theoretical foundations of cryptographic algorithms, and this is how HAWK was broken.

Cryptanalysis augmented by an LLM and/or an agentic framework is inevitably entering the mainstream.

When expecting specific capabilities, we should therefore also accept that migration to post-quantum cryptography carries threats of its own, including the threat that the adopted standard itself may be compromised. In other words, relying only on post-quantum variants should come with a concrete threat analysis. Although one commonly recommended approach is a “hybrid” solution, using a classical and a post-quantum algorithm in parallel, it is not a necessary condition in every case.

To sum up, if a post-quantum algorithm is compromised, it stops providing security not only against a future adversary equipped with a quantum computer, but also immediately stops fulfilling its security function today.

The attack on Hugging Face infrastructure and the threats posed by an effective quantum computer

The recent attack by an autonomous agent on Hugging Face infrastructure shows how the exploitation of seemingly unrelated vulnerabilities can, step by step, lead to privilege escalation due to the volume of operations being performed. Although this was not the direct objective in this case, it is difficult not to also consider more subtle scenarios, such as MITM attacks or kleptographic attacks, where even preventive key rotation may not fully cut off the attacker’s access. Naturally, there are also ways to address this, for example similarly to what Hugging Face did after the attack by “rebuilding the core infrastructure”, but this opens the broader topic of situational awareness, which is also discussed in the Hugging Face report.

Threats related to quantum computers are threats from the future, while in parallel we are already facing challenges that, from an information security perspective, are impossible to ignore and require appropriate prioritisation. Geopolitics is already shaping the world of LLMs, and if the direction taken by China does not change, Kimi K3 will be followed by more models. They may remain behind the top US models, but the UK AISI / U.S. CAISI report suggests that the gap is measured in months, not years. There is little indication that open-weight models are going to disappear from the market.

From this perspective, the cybersecurity domain is inevitably heading towards a major transformation driven by automation, and the threats resulting from the existence of effective quantum computers will somehow have to fit into that transformation. Will they?

PQC migration and the current regulatory landscape

The vast majority of credible organisations responsible for cybersecurity standards at national and/or EU level have issued recommendations on the need to migrate cryptography to post-quantum variants. In addition, standards bodies in some countries have already defined their own migration rules, procurement requirements for external suppliers, and deadlines for phasing out pre-quantum cryptography in public administration. Although the current Polish Cybersecurity Strategy treats post-quantum migration as one of its priority tasks, there are still no concrete requirements for any specific sector.

From an EU regulatory perspective, there are currently no changes on the horizon that would bring enforcement comparable in rigidity to NIS2 or DORA. The proposal COM(2026) 13, amending NIS2 and introducing point 8, discusses the threats posed by quantum technologies. It states that “Member States should be required to adopt policies for the transition to post-quantum cryptography as part of their national cybersecurity strategy”, meaning that in practice implementation will depend on national guidance. We therefore remain largely in the area of recommendations, including ENISA ECCG Agreed Cryptographic Mechanisms v3 and the NIS “A Coordinated Implementation Roadmap for the Transition to Post-Quantum Cryptography”.

In other words, regulatory requirements may apply only to specific sectors or through local requirements imposed by national institutions, such as BSI or ANSSI, which may lead to fragmentation and policies moving at different speeds.

PQC migration and organisational continuity

Although the emergence of an effective quantum computer is still the future, the threats associated with it may already affect organisations today by creating risks that could become significant later. In practice, HNDL and TNFL are the first of such threats that directly concern the future. Without going into whether these specific threats are realistic or not, let’s look how they may affect an organisation.

Impact: intellectual property

The first consequence to consider is the organisation’s intellectual property (IP). In particular, whether any valuable information is being exchanged today through digital communication that will also retain its value in the future.

Although relatively few categories of information retain significant value over a long time horizon, the potential to correlate them materially changes the picture.

Impact: reputation and organisational credibility

Another impact is the loss of the organisation’s reputation, meaning whether and how the potential disclosure of sensitive data in the future may affect its operations, credibility, and relationships with customers and business partners.

Although events such as ransomware attacks may have similar consequences today, the emergence of an effective quantum computer changes their scale.

Impact: operational continuity

MITM threats, including TNFL, may affect the organisation’s ability to manage its own assets, access sensitive information, and keep critical systems from being compromised or taken offline.

Both MITM and TNFL affect the authenticity and integrity of information, enabling, among other things, signature forgery, impersonation of trusted entities or identities, and the acquisition of unauthorised privileges.

What next?

Threats resulting from future quantum computers are new risks, but they also affect the organisation’s cryptosystem. At the same time, risks that are already present today, resulting from implementation errors, improper key management, supplier vulnerabilities, or the automation of attacks through “AI”, may be more immediate and tangible.

Information security is a set of actions and measures aimed at countering threats that may affect the organisation’s operations. It includes assessing threats and vulnerabilities that may have a direct impact on achieving business objectives, and finding appropriate countermeasures and mitigations.

Each organisation should therefore assess the impact of individual threats on its own, while at the same time looking for synergies in how they can be addressed. The threat horizons resulting from the development of “AI” and quantum computers are different, but strengthening the ability to protect infrastructure against more immediate threats may at the same time prepare the ground for responding to future ones.

Regulatory requirements resulting from DORA or NIS2 may already effectively make use of SBOM or asset inventories, which may strengthen an organisation’s situational awareness, including the inevitable progress in automation driven by the development of “AI”.

Having a CBOM or crypto-agility capabilities will certainly depend on the organisation, but at the same time, without regulatory requirements, they may be postponed to future budgets (even at sector level) and treated as a low priority compared with other emerging threats.

Appendix 1 — historical compromises of cryptosystem components

A list of the most important historical and contemporary examples of compromises affecting individual components of a cryptosystem, showing that the weakest link rarely lies in the mathematical problem behind a particular cryptographic algorithm, and much more often in its implementation, integration, or handling.

Although the history of every component of a cryptosystem shows that there is no such thing as “complete resilience”, in practice, demonstrated weaknesses in cryptographic standards have a very different impact on a given ecosystem than vulnerabilities resulting from the use of those standards in specific software implementations. Statistically, cryptographic standards are the strongest component of any cryptosystem.

Cryptographic standard

• MD5 — rogue CA (2008) — attackers created a fraudulent CA certificate trusted by all major browsers. This made it possible to impersonate any HTTPS website, including banks.
• MD5 — Flame (2012) — malware impersonated Microsoft within Windows Update. Systems in the Middle East were infected as part of a state-sponsored operation.
• SHA-1 — SHAttered (2017) — the first practical SHA-1 collision, demonstrating that the algorithm was no longer secure. SHA-1 was deprecated in TLS, while Git continued to use it by default.

Cryptographic library and its integration

• Heartbleed (2014) — a bug in OpenSSL allowed attackers to read server memory, including private keys. Around ~17% of HTTPS servers worldwide were vulnerable (~6.5 million certificates). Administrators had to replace certificates at scale.
• ROBOT (2017) — a 19-year-old RSA implementation flaw allowed attackers to impersonate servers. Nearly one-third of the top 100 domains were vulnerable, including Facebook and PayPal. Researchers demonstrated the impact by signing a message using the private key of facebook.com.
• xz-utils backdoor (2024) — a backdoor inserted into the open-source supply chain, intended to compromise SSH on Linux systems. It was discovered almost by accident shortly before reaching RHEL.

Cryptographic key management

• CISA GitHub leak (2026) — AWS GovCloud keys and passwords remained in a public repository for six months. CISA — the US cybersecurity agency — ignored nine automated GitHub Secret Scanning alerts.
• GitHub RSA SSH key (2023) — GitHub.com’s private host key was accidentally published. An attacker could potentially impersonate GitHub globally.
• ROCA (2017) — millions of RSA keys generated by Infineon chips, used in Lenovo, Dell, and HP devices, could be broken using only the public key. This resulted in key replacement at enterprise scale.

Quality of entropy sources and correct use of PRGs

• Coldcard wallet RNG (2026) — a flaw in the random number generator used by a hardware wallet. The attacker reconstructed the seed and stole USD 88 million in Bitcoin.
• Debian OpenSSL PRNG (2008) — a bug introduced in a Debian patch reduced the key space to around ~32,000 possible values. SSH keys and certificates generated on Debian/Ubuntu over a period of two years became predictable. Keys had to be replaced at scale.
• PS3 ECDSA (2010) — Sony used a constant random value in ECDSA signatures. Sony’s private key was recovered from two signatures and published publicly, compromising the PS3 security model.