QCC organisations are aware of the quantum threat - but most haven't done the homework yet

Quantum computing may still be years away from breaking current encryption standards, but experts warn the countdown has already begun, especially in the GCC region. José Lemos, product delivery manager at QuantumGate, explained that sensitive data intercepted today could be decrypted later when quantum computers become powerful enough.

He emphasized that organizations must start protecting confidential information now, not just once quantum computers arrive. The timeline for when quantum computers will break classical cryptography is rapidly decreasing, with estimates shifting closer to 2030, similar to the rapid development of AI. Regulatory efforts in the UAE, such as the cybersecurity Council's PQC migration framework, are helping organizations transition to post-quantum cryptography by creating a cryptographic inventory and mapping their cryptographic posture.

However, a readiness gap exists between awareness and action, as only 36% of GCC organizations have started a formal cryptographic inventory. Financial institutions, defense-sector entities, and organizations handling sensitive data should prioritize the transition to post-quantum cryptography, but it is a multi-year process that requires end-to-end ownership and understanding of the organization's infrastructure.