Post-quantum security: what product and delivery teams need to understand

A supplier says its platform is preparing for post-quantum security. Your team needs to decide what that means for a product roadmap, budget and testing. “We will upgrade later” is not enough information to plan from.

Post-quantum cryptography (PQC) uses algorithms intended to resist attacks from future sufficiently capable quantum computers. It is a change to cryptographic methods, not a requirement for your team to buy a quantum computer.

You do not need to choose algorithms yourself to contribute. You can help identify dependencies, clarify ownership and turn supplier statements into questions that technical specialists can assess.

Why planning is happening now

Some widely used public-key cryptography could be broken by a sufficiently powerful future quantum computer. Public-key methods support tasks such as secure key exchange and digital signatures. The UK’s National Cyber Security Centre (NCSC) describes migration as a substantial technology change that organisations should prepare for.

UK NCSC: preparing for post-quantum cryptography

In October 2026, Microsoft highlighted certificate ecosystems as a readiness challenge. Certificates help systems establish identity and trust. Changing them can affect applications, devices and operational processes as well as cryptographic algorithms.

Microsoft: post-quantum authentication readiness, 8 October 2026

Three terms that make the discussion clearer

Encryption

Purpose: Understand protection of information.

Encryption transforms information so it can be read only with the appropriate key. Long-lived confidential information matters in planning because an attacker may store encrypted data now and attempt to decrypt it later.

Digital signatures and certificates

Purpose: Understand how systems check identity and integrity.

A digital signature lets a verifier check a signed message or object. A certificate connects identity information to a public key under a trust relationship. Migration can therefore affect software updates and service authentication as well as stored information.

Cryptographic dependencies

Purpose: Find where the product relies on these mechanisms.

A dependency may be a supplier, certificate service, software library or device. Product planning needs to show which parts can change independently and which need coordinated work. A feature list rarely captures all of these relationships.

UK NCSC: preparing for post-quantum cryptography

Use the UK targets as planning context

The NCSC’s guidance sets milestones for discovery and initial plans by 2028, highest-priority migrations and refined plans by 2031, and completing migration by 2035. These are guidance targets, not a prediction of the date quantum attacks will become practical or a blanket legal deadline.

UK NCSC: post-quantum migration timelines

Do not turn a target into an assumption

Ask which guidance, contractual expectations and sector requirements apply to your organisation. A small service consuming managed products may have a different migration role from a business operating its own cryptographic infrastructure.

Your technical and security owners should interpret the obligations and dependencies. A roadmap discussion can expose missing information without pretending to settle the underlying cryptography.

A fictional product: Harbour appointments

Map the dependencies before estimating the work

Harbour is an invented appointment service. It uses a managed hosting provider, a separate identity provider and a mobile application. It also keeps records that users expect to remain confidential for years.

Its product owner starts a dependency note. The hosting supplier owns one part of the transport protection, the identity supplier owns another authentication component, and the mobile release process needs its own technical review.

The team has not verified readiness simply by listing suppliers. The note identifies who must answer the next questions.

Questions to send to a supplier

Microsoft’s October guidance recommends inventorying dependencies and testing interoperability. Its certificate pilot is for controlled, non-production testing; pilot certificates are not intended for public production trust. A pilot announcement should not be read as a general instruction to replace production certificates.

Microsoft: post-quantum authentication readiness, 8 October 2026

Which cryptographic dependencies in our service are in scope?
What is supported today, what is being tested and what is only planned?
Which changes will require action by our team?
What compatibility, performance or operational testing is needed?
What evidence can we review, and when will it be available?
Who owns the migration, and how will changes be communicated?

Create a readiness note for one service

A worksheet you can use in planning

Start with one important service instead of an unsupported estimate for the entire organisation. The first useful deliverable is a dependency note that specialists can review, with evidence and unanswered questions kept separate.