IBM’s Curioni says under 10% of firms are quantum-safe

Fewer than one in ten organizations worldwide are protected against the security threat posed by quantum computing, Alessandro Curioni, IBM's International Business Machines Corporation ↘ 1.26% vice president for Europe and Africa, told AFP on Wednesday, Oct. 14. He warned that the technology could eventually break today's encryption and enable large-scale cyberattacks.phys.org

"If you look at the world, how many organizations became quantum-safe? I would say less than 10% today," Curioni said on the sidelines of an IBM conference in London. Curioni also heads IBM's research lab in Zurich. He listed "the internet, all the blockchains, the banks, financial contract, digital signature" as areas at risk, and said attackers might go after financial institutions first, then industry and banks.france24.com+1

Harvest now, decrypt later

Today's quantum computers are not powerful enough to carry out such attacks, and no one knows when they will be. Security experts worry, however, that encrypted data is already being stolen and stored so it can be decrypted once the machines improve.phys.org

"I think the biggest risk for us is actually that data has probably already been harvested," David Debnam, operational risk director at British insurer Aviva, told the conference.phys.org

Race to a fault-tolerant machine

IBM competes with Microsoft ↘ 1.80% and Google Alphabet Inc. ↘ 1.68% in quantum computing. It aims to deliver a "large-scale, fault-tolerant" quantum computer to commercial clients by 2029. Ray Harishankar, an IBM fellow for quantum-safe technology, has said the company's roadmap targets fault tolerance "in the 2029 timeframe" and has urged banks to start listing where they use cryptography now.theasianbanker.com+1

McKinsey estimates that quantum computing could generate up to $2.7 trillion in economic value by 2035. Curioni said the technology, combined with AI, could "simulate problems that were too complex from a physical viewpoint".phys.org

Governments set deadlines

Britain's National Cyber Security Centre (NCSC) has set out three phases for moving to post-quantum cryptography. Organizations should finish discovery and planning by 2028, complete their highest-priority migrations by 2031 and move all systems, services and products by 2035. The agency says 10 years is enough time for standards and products to mature. The most widely used post-quantum algorithms were standardized by the U.S. National Institute of Standards and Technology in 2024.ncsc.gov.uk

The United States has set a similar 2035 target for federal agencies, along with interim milestones for inventories and early migration. Curioni's estimate suggests that most organizations have not yet started that work.openssl-corporation.org