You might have seen the NCSC warning about a cyber “perfect storm” that included quantum computing as one of several converging threats to UK businesses. If your reaction was something along the lines of “sounds scary, not sure what I’m supposed to do about it” — that’s fair. Quantum computing is one of those topics that generates a lot of alarming headlines and not a lot of practical guidance for anyone running a small business.

So here’s an honest take on where things actually stand, what the risk is, and what — if anything — you should be doing about it in 2026.

The Problem With Quantum and Encryption

Most of the encryption that protects data in transit today — HTTPS connections, VPNs, email encryption, secure file sharing — relies on mathematical problems that are very hard for conventional computers to solve. The most widely used approaches (RSA and elliptic curve cryptography) depend on the fact that factoring large numbers or solving certain discrete logarithm problems takes impossibly long on current hardware.

Quantum computers, once they’re powerful enough, would solve these problems relatively quickly using algorithms like Shor’s. That would undermine the encryption protecting your banking, your communications, your cloud storage, and pretty much everything else that travels over a network securely. The question isn’t whether this will happen eventually — most cryptographers think it will. The question is when, and how much time that gives us to prepare.

The current consensus is that a cryptographically relevant quantum computer — one actually capable of breaking RSA-2048 in a practical timeframe — is probably still ten to fifteen years away. Some estimates put it longer. But there’s a specific threat you should understand now, even if that timeline is accurate.

Harvest Now, Decrypt Later

Nation-state adversaries are almost certainly collecting encrypted data today with the intention of decrypting it once quantum computing is available. The strategy is called “harvest now, decrypt later,” and it’s the reason that data with a long confidentiality horizon — medical records, legal documents, intellectual property, sensitive commercial negotiations — is already at risk, even before a working quantum computer exists.

For most small businesses, the honest answer is that you’re probably not a priority target for this kind of long-term state-sponsored attack. But if your business handles data that will still be sensitive in fifteen years — patient records, sensitive legal work, proprietary research, financial data — the risk is worth taking seriously.

What’s Actually Changing: New Standards

The good news is that the cryptography community has been working on quantum-resistant algorithms for years, and the US National Institute of Standards and Technology (NIST) finalised the first set of post-quantum cryptographic (PQC) standards in 2024. The NCSC has endorsed these and published guidance on how UK organisations should plan their transition.

The three main algorithms to know about are ML-KEM (formerly Kyber), ML-DSA (formerly Dilithium), and SLH-DSA (formerly SPHINCS+). These are designed to be resistant to attacks from both classical and quantum computers. They’re already being integrated into software and protocols — the latest versions of TLS, signal-based messaging apps, and cloud security services are beginning to support them.

What Small Businesses Should Actually Do

Here’s where the practical guidance comes in — and it’s less dramatic than the threat description might suggest.

First, make a note of what software and services handle your most sensitive communications and data. Do your VPN provider, your email platform, your cloud storage service have a roadmap for post-quantum cryptography? Large providers like Microsoft (for 365), Google (for Workspace), and AWS are all actively working on PQC transitions. If you’re using services from these providers, the heavy lifting will largely be done for you as they roll out updates.

Second, if you use any custom software or self-managed infrastructure — your own server, a bespoke application handling sensitive data — flag post-quantum readiness as something to discuss with your IT support or developer. You don’t need to act immediately, but you do want to be on a roadmap rather than scrambling when PQC becomes mandatory.

Third, be sceptical of any vendor selling you a “quantum-safe” solution today as if the threat is immediate. It isn’t. Vendors with legitimate PQC products exist, but there are also plenty of overblown marketing claims attached to genuinely early-stage technology. The NCSC’s guidance is the right benchmark for what you actually need to be doing and when.

Fourth — and this is the bit that matters most for most small businesses — keep doing the basics well. Strong passwords, multi-factor authentication, patched software, encrypted backups: these remain the practical foundation of business security. Post-quantum threats are real and worth planning for, but they don’t change the calculus on the threats that are actually attacking UK small businesses today. Phishing, ransomware, and credential theft are the things most likely to cause you harm in 2026, not a quantum computer that doesn’t exist yet.

The NCSC’s post-quantum migration guide is available on their website and is worth bookmarking. It’s aimed partly at larger organisations with complex IT infrastructure, but the timeline and prioritisation sections are relevant for any business thinking through where to focus its security attention over the next few years. The message isn’t panic — it’s plan.