For years, post-quantum cryptography was treated as a problem for a future leadership team. Important, yes, but still far enough away that many organisations could postpone the harder decisions for the next cycle.
That is changing rapidly. Over recent months, Google and Cloudflare have both set 2029 as a target for full post-quantum security across their infrastructure, driven by rapid advances in quantum research and a shrinking margin for delay. These are operational decisions made by companies that sit deep inside the global technology supply chain.
The same shift is now visible in national security. In her lecture at Bletchley Park, GCHQ director Anne Keast-Butler warned of a “narrowing window” for the UK and its allies to maintain their technological advantage as AI, cyber capabilities and quantum technologies advance at the same time.
From our work across standards bodies, regulated sectors and technology suppliers, the challenge now is coordination. Transition deadlines will only be met if semiconductor providers, OEMs, network security vendors and critical national infrastructure operators move in step.
That makes 2026 a critical year, when sector-specific Post Quantum Cryptography (PQC) requirements need to become clear enough to shape procurement research and decisions and IT refresh cycles. Google’s 2029 commitment gives the market a real planning signal. As other hyperscalers follow, pressure will build quickly across the supply chain, especially for the vendors that the organisations that make up the Critical National Infrastructure (CNI) depends on most.
Supply chains will determine the pace of transition
Cloud and data centre hyperscalers and internet infrastructure providers sit at the centre of enormous digital ecosystems. When they accelerate post-quantum timelines, the effect moves through hardware manufacturers, software suppliers, managed service providers and eventually the organisations that depend on them.
This matters most in sectors with complex operational environments, including critical national infrastructure, financial services, energy and manufacturing. One unsupported system, one legacy platform or one unprepared supplier can slow progress across a much wider estate. For many organisations, success will depend on how well they coordinate across suppliers and how early they start turning broad policy goals into procurement requirements.
Progress starts inside existing change and budget cycles
One of the most common misconceptions about post-quantum migration is that nothing meaningful can happen until an organisation launches a dedicated transformation programme. In practice, that is rarely true.
Cloud migrations, infrastructure refreshes, application modernisation work and hardware replacement cycles are already under way across most enterprises. The organisations making progress are folding post-quantum readiness into these programmes as a resilience requirement, rather than setting it up as a separate initiative competing for attention and budget.
Replacing cryptography as part of a planned upgrade is cheaper and less disruptive than retrofitting it later under tighter deadlines. Every scheduled technology refresh is a chance to introduce quantum-safe capability, assess supplier roadmaps or retire systems that may become difficult to support later.
Prioritisation matters just as much. Organisations do not need to solve everything at once.They need to focus first on the systems that matter most, the dependencies that are hardest to replace and the points where delay would create the biggest operational and security risk.
Don’t let perfect be the enemy of good
A common reason organisations stall is the belief that they need a perfect answer before they can act.
A better starting point is to identify the suppliers and systems that matter most, and use that to set clear priorities. That can be done quickly through structured conversations across procurement, vendor risk and technical teams.
Once those priorities are in place, organisations can start measuring progress in ways that matter to the business. Vendor readiness, dependency concentration and coverage of critical services are more useful indicators than abstract discussion of algorithms. They show where resilience is improving, where gaps remain and where executive attention is still needed.
They also create momentum. When leaders can see real progress, they are far more likely to support the next phase of migration. Different suppliers will move at different speeds, but the broader transition will increasingly follow the path set by the largest providers and the sectors under the greatest regulatory pressure.
Post-quantum migration sits inside asset management, supplier governance and sound operational planning. The organisations that start early, set priorities clearly and coordinate across their supply chain will have more options, face less disruption and build greater confidence across the business.
Ben Packman is Chief Strategy Officer at PQShield
