Microsoft Is Preparing for a Cyberthreat That Hasn't Happened Yet

One of the hardest parts of running a business is deciding which future risks deserve attention today. You can’t prepare for everything. But every so often something comes along that needs planning long before it becomes a real problem.

Microsoft has decided quantum computing is one of those things.

What’s been announced

Microsoft’s Quantum Safe Program is working to move its products and services to quantum-resistant encryption by 2029, a goal it brought forward in June 2026 because the risk timeline is shifting (Microsoft Security blog). That means updating the technology that protects everything from cloud services and software updates to digital certificates.

Those certificates are the digital credentials your devices use to confirm they’re talking to the genuine Microsoft 365, your real bank or your actual accounting software rather than an imposter. Replacing the mathematics behind them is a very big job, which is why Microsoft is giving itself years.

Why quantum computing matters for encryption

Today’s encryption keeps your data safe because an ordinary computer would need an unrealistic amount of time to crack it. Quantum computers are a new type of machine, still being developed, that are expected to solve certain mathematical problems far faster. If they mature, some of the encryption protecting data across the internet may no longer be strong enough.

Nobody knows exactly when that day arrives. It could still be years away. Microsoft isn’t waiting to find out.

“Harvest now, decrypt later”

One reason to act early is a tactic security researchers call “harvest now, decrypt later”. Someone steals a large batch of encrypted data today. They can’t read it, so it looks worthless. If quantum computers become powerful enough in a few years, that same data could be decrypted long after the theft.

Firms that hold sensitive information for a long time, such as law firms, accountants and financial advisors, are exactly the kind of target that tactic is designed for.

What this means for your business today

In practical terms, not much yet. You won’t be choosing quantum-resistant encryption this year, and there’s no reason to rip anything out. Microsoft, your bank and your software vendors will carry most of that load.

But it highlights something that has always been true: good cybersecurity is about thinking ahead, not reacting afterwards. The firm still running an unsupported server, an old firewall or a Windows 10 machine “because it works” is the one that will struggle when the next threat lands, quantum or otherwise.

Start here:

• List any software or hardware that is out of support, or will be within 12 months.

• Confirm updates are applied automatically and someone checks they succeeded.

• Test a backup restore rather than assuming the backups are running.

• Ask your IT provider what their plan is for the next two years, not just the next ticket.

Whether the next big cyberthreat arrives in two years or ten, the businesses with solid foundations will be the ones in a good position to deal with it.

Got an IT question like this one? Talk to the team that wrote the article — no ticket number required. Book a free consultation.