Microsoft's Post-Quantum Security Push

TL;DR: Microsoft has brought forward its plan to make its products and services resistant to attacks from quantum computers, and it now aims to finish by 2029. Quantum computers able to break today's encryption haven't been built yet, and your business doesn't need to do anything about quantum-safe encryption today. The useful part for you is how Microsoft is planning. Keep your systems supported and up to date, and deal with the weak spots now, so the next big shift in cyber security doesn't catch you out.

Picking which future risks to worry about

Every business owner has a list of things that might go wrong one day. Most of them never get past the list, and that's sensible. Your time and budget are limited, and nobody can plan for every possibility.

Now and again, though, a risk is worth preparing for years before it becomes real. Microsoft thinks it has found one.

What Microsoft has announced

At the end of June 2026, Microsoft said it was speeding up its Quantum Safe Program. It now aims to move its critical products and services to post-quantum cryptography by 2029. Azure CTO Mark Russinovich has said that covers Microsoft's entire portfolio of products and services.

Post-quantum cryptography sounds like something out of a research lab, but the idea behind it is simple. The encryption that protects your emails and cloud files works because the maths behind it would take an ordinary computer an impractical amount of time to crack. Even the most powerful machines in use today can't get through it in any useful timeframe.

Why quantum computers change the maths

Quantum computers work in a very different way from the laptops and servers your business runs on. They're still in development. Once they mature, they're expected to solve certain kinds of mathematical problem far faster than any current machine, and some of those problems are the ones today's encryption depends on.

Nobody can say for certain when a quantum computer powerful enough to break that encryption will exist. Microsoft's own reason for moving its timeline is a belief that these machines could arrive sooner than it previously expected. Even so, that could still be years away.

What Microsoft is changing

The work goes deep into Microsoft's technology. Microsoft is updating the encryption that protects data as it moves across networks, and it's modernising the systems behind digital certificates and code signing.

Certificates are the digital credentials your devices check to confirm they're talking to a genuine website or service and not an imposter. Code signing does a similar job for software updates. It proves that an update really came from Microsoft and hasn't been tampered with along the way.

Microsoft is also building in what it calls crypto-agility. In plain terms, this means designing systems so the encryption inside them can be swapped out later without rebuilding everything around it.

Harvest now, decrypt later

One reason for starting so early has a name in security circles: "harvest now, decrypt later".

Picture a criminal stealing a batch of encrypted data today. They can't read it, so at first glance it looks worthless. But if they store it and wait, a quantum computer could one day unlock it. For data that stays sensitive for a long time, such as financial records, legal files or health information, that's a real concern.

Microsoft isn't the only one taking this seriously. The UK's National Cyber Security Centre has published post-quantum migration timelines for UK organisations, with 2035 as the target date for finishing the move.

What this means for your business today

For most small and medium-sized businesses, very little changes right now. You won't be choosing quantum-resistant encryption algorithms any time soon, and there's no reason to start replacing systems in a panic. Much of this work will happen inside the products you already use, such as Microsoft 365 and Windows, as Microsoft rolls out updates.

That only helps if your systems are in a state to receive those updates, though. This is where Microsoft's approach is worth copying.

Getting the foundations right

Good cyber security has always been about planning ahead. The businesses that cope best when a new threat appears tend to have the same habits:

- Software and operating systems are updated regularly, not whenever someone gets round to it
- Ageing hardware and software are replaced before they lose support
- Security policies are reviewed and kept current
- Backups are checked and tested, so they work when they're needed

None of this is glamorous, but it gives your IT the flexibility to adapt when something changes. A business still running unsupported software, or putting off an overdue upgrade, has far less room to respond.

Microsoft is giving itself years for this work because large technology changes take time to do properly. The same principle applies at a smaller scale. A server replacement planned twelve months ahead is a manageable project. The same replacement forced on you by a security incident costs far more and causes far more disruption.

You don't need a quantum computing strategy. You do need to know your business isn't relying on outdated systems or security settings that belong to a different era. Whether the next major threat arrives in two years or ten, a business with sound foundations will be in a much better position to deal with it.

If you'd like a second opinion on whether your IT is ready for what's coming, as well as what you're dealing with today, our team supports businesses across Chester, North Wales, the Wirral and Wrexham and is happy to talk it through.