The deadline for protecting digital networks from quantum computer attacks has shifted from 2035 to potentially 2030, according to a detailed examination published by Infosecurity Magazine in 2026. The report examines how cybersecurity vendors are preparing for Q-Day, the hypothetical moment when quantum computers become powerful enough to break standard public-key cryptography including RSA and elliptic-curve algorithms. While governments are accelerating post-quantum cryptography migration mandates, the readiness of security vendors protecting today's networks varies widely, creating potential vulnerabilities even as organizations upgrade their own encryption.
Major governments are now enforcing tighter timelines for quantum-safe encryption adoption. The US government has required all federal agencies to complete their post-quantum cryptography migration by 2030 or 2031 at the latest depending on use cases, following two executive orders signed by the Trump administration on June 22. France's national cybersecurity agency ANSSI will stop approving products lacking quantum-safe encryption starting in 2027, with post-quantum security becoming mandatory in procurement of some security products by 2030. The move applies to around 90 products and services currently qualified by the agency. Other nations including Canada, Australia, Japan, and the UK follow similar schedules, targeting 2035 for full government system transitions and 2028 or 2030 as checkpoints for quantum-safe critical infrastructure. Large technology companies like Cloudflare, Google and Microsoft have established a 2029 deadline for complete post-quantum migration, while Apple, AWS, IBM and Meta have begun integrating NIST-approved algorithms into their products.
Cybersecurity vendors face distinct challenges in quantum readiness compared to the tech giants. Thibaud Ecarot, a post-quantum cryptography engineer and associate professor at the University of Sherbrooke in Canada, told the publication that IT vendors currently have minimal incentive to promote quantum-safe offerings. "They generally don't see PQC as a competitive advantage at this point," he said after attending the Quantum Safe Cryptography Conference 2026 in Ottawa. Patricia Titus, field CISO at Abnormal AI, added that vendor communities respond to customer demands, meaning without explicit requests, "vendors are going to put [PQC migration] on the backburner." Some vendors like Cloudflare have already completed post-quantum migration within internal systems where algorithms are available, while Palo Alto Networks has embedded quantum-resistant capabilities into fourth- and fifth-generation firewalls and VM-Series products. Others like Keeper Security and 1Password are executing multi-year phased rollouts using hybrid cryptographic schemes, and cloud-reliant providers like Abnormal AI are waiting on third-party vendors to ship production-ready, NIST-validated post-quantum cryptography before setting internal dates.
The primary threat driving urgency is "harvest now, decrypt later," where attackers collect encrypted valuable data today to decrypt with quantum computers once available. Yet full post-quantum migration isn't currently possible even for willing organizations, the report notes, because not all encryption use cases have standardized algorithms yet—for instance, there's no standardized post-quantum algorithm for digital signatures. Another obstacle is the absence of a common definition of what "fully quantum safe" means. Bas Westerbaan, principal research engineer at Cloudflare, explained that while vulnerable algorithms like RSA and ECC are known, and symmetric algorithms like AES-128 and AES-256 are generally considered quantum-resistant, there's no accepted threshold for how much encryption must be quantum-safe to claim transition completion. If organizations upgrade to quantum-resistant encryption while the vendors securing their networks don't, they'll have effectively reinforced the front door while leaving windows open for attackers to enter.