Quantum Algorithms and Real-World Applications: What Security Professionals Need to Watch

What makes quantum algorithms different from classical ones

Classical algorithms enumerate possibilities. A brute-force search through a database with N entries requires N operations. A factoring algorithm works through candidate divisors until it finds one that works. The computation space is traversed sequentially, and the time taken scales predictably with the problem size. This predictability is the basis for cryptographic security: RSA-2048 is secure because factoring numbers of that size would take classical hardware longer than the age of the universe.

Quantum algorithms exploit superposition, entanglement, and interference to manipulate probability amplitudes across many computational paths simultaneously. The interference step is where the advantage materialises: quantum algorithms are designed so that incorrect paths cancel out and correct answers reinforce. The practical consequence is that certain problem classes which are computationally intractable classically become tractable on quantum hardware. Quantum speedup is not general. It applies to specific problem structures, and the three algorithm classes relevant to enterprise security each map to a distinct organisational response. The hardware context for this is in our quantum computing fundamentals guide.

Security professionals do not need to understand the mathematics of quantum interference. They need to understand which algorithms threaten which systems and what the response to each looks like. That is what this article covers.

Shor's Algorithm: the asymmetric cryptography problem

Peter Shor published his algorithm in 1994 (IEEE FOCS, doi:10.1109/SFCS.1994.365700). It solves integer factorisation and the discrete logarithm problem in polynomial time, specifically O((log N)³), compared to the sub-exponential time of the best known classical algorithm, the General Number Field Sieve. On a fault-tolerant quantum computer with sufficient physical qubit count, RSA-2048 could be broken in hours. ECC-256, which relies on the difficulty of the discrete logarithm problem over elliptic curves, is equally vulnerable. Diffie-Hellman key exchange is in scope for the same reason. That is Shor's reach: asymmetric cryptography built on integer factorisation or discrete logarithms.

What Shor does not touch is equally important to state clearly. AES, SHA-2, SHA-3, and the three algorithms NIST standardised in August 2024 are not vulnerable to Shor's algorithm. Those NIST standards were designed specifically to resist attack from a CRQC (Cryptographically Relevant Quantum Computer, meaning a fault-tolerant system with sufficient qubit count to run Shor at cryptographic scale). ML-KEM (FIPS 203) and ML-DSA (FIPS 204) rest on lattice problems; SLH-DSA (FIPS 205) rests on hash function security. No known quantum algorithm solves any of these efficiently.

The SIKE episode from 2022 illustrates a structural point about post-quantum security assumptions. Supersingular Isogeny Key Encapsulation, a fourth NIST candidate algorithm family, was broken by Castryck and Decru using a classical polynomial-time attack running in a few hours on a single laptop (EUROCRYPT 2023, doi:10.1007/978-3-031-30589-4_15). Not a quantum attack. A classical one. The lesson is that mathematical security assumptions underlying post-quantum candidates can fail in directions that are not quantum at all. The multi-year NIST evaluation process that caught SIKE before standardisation is precisely what makes confidence in the finalised families justified. ML-KEM, ML-DSA, and SLH-DSA have not been similarly broken after years of open public cryptanalysis. The process worked.

On timelines: NSA's Commercial National Security Algorithm Suite 2.0 (CNSA 2.0, September 2022, updated 2025) sets phased migration deadlines for national security systems. Software and firmware signing reaches exclusive CNSA 2.0 use by January 2027. Networking equipment exclusive use is required by 2030. Operating systems and cloud services by 2033. HNDL risk (Harvest Now, Decrypt Later, meaning adversaries exfiltrate encrypted data today for decryption when capable hardware arrives) means the migration window is active now, not at Q-Day. The threat timeline is covered in detail in our quantum computing and cybersecurity guide. In every PQC migration project I have worked on, cryptographic inventory alone takes six to twelve months before a single algorithm is changed. That timeline is the argument for starting now.

Grover's Algorithm: a bounded threat with a specific response

Lov Grover's 1996 algorithm provides a quadratic speedup for unstructured database search: O(√N) queries versus O(N) classically (ACM STOC, 1996, doi:10.1145/237814.237866). The security implication is that symmetric key lengths need to double to maintain equivalent security against a Grover-enabled adversary. AES-128, with a 128-bit key, drops to approximately 64-bit equivalent security under Grover. That is inadequate. AES-256 drops to approximately 128-bit equivalent. That remains adequate by current NIST guidance (NIST IR 8547, Initial Public Draft, November 2024).

The common claim that Grover breaks symmetric encryption is wrong. Grover halves the effective key length. This has a precise, bounded implication: move AES-128 deployments to AES-256, and prefer SHA-384 or SHA-512 over SHA-256 for long-lived data. Grover's speedup is also provably optimal. Bennett, Bernstein, Brassard, and Vazirani established that no quantum algorithm can search an unstructured space faster than O(√N). This bound matters for planning because it means the Grover risk is fully characterised. There is no hidden additional quantum speedup waiting to emerge from further hardware progress. The response is low-cost and near-term.

Near-term algorithms and the NISQ era

Most quantum algorithms running on real hardware today sit in what Preskill (2018, Quantum 2:79, doi:10.22331/q-2018-08-06-79) termed the NISQ era: Noisy Intermediate-Scale Quantum. NISQ devices have tens to thousands of physical qubits without full error correction. Errors accumulate and circuit depth is limited. The two near-term algorithms discussed most in business contexts are QAOA (Quantum Approximate Optimisation Algorithm, Farhi, Goldstone and Gutmann, arXiv:1411.4028, 2014) for combinatorial optimisation problems, and VQE (Variational Quantum Eigensolver, Peruzzo et al., Nature Communications, 2014, doi:10.1038/ncomms5213) for molecular energy estimation.

Logistics and supply chain (QAOA for routing and scheduling), pharmaceuticals and materials science (VQE for molecular simulation), and financial services (QAOA for portfolio optimisation) have attracted the most NISQ research attention. Genuine results exist: VQE has produced molecular energy estimates on small proof-of-concept systems, including hydrogen and lithium hydride, validating the approach on current quantum hardware. These molecules are tractable classically; scaling to the chemically relevant molecular sizes where quantum computation would genuinely outperform classical simulation requires fault-tolerant hardware that is not yet available. QAOA has produced valid results on small benchmark instances. The gap is scale. Business-level routing problems involve thousands to millions of variables. Classical solvers, including Gurobi, Google OR-Tools, and IBM CPLEX, operate at that scale routinely. Published benchmarks, including Guerreschi and Matsuura (2019), showed QAOA underperforming classical solvers on tested problem instances at current hardware noise levels. That picture will change as hardware matures; the timeline is not yet clear from the peer-reviewed literature.

The 2019 Google quantum supremacy demonstration (Arute et al., Nature 574, 2019, doi:10.1038/s41586-019-1666-5) is frequently cited as evidence of quantum advantage for business applications. It is worth being precise about what that result was. Google's system completed a specific random circuit sampling task in 200 seconds. IBM contested the classical time estimate. The task had no cryptographic or direct business application. Quantum supremacy on a narrow benchmark is not quantum advantage on a practically useful problem. Security professionals do not need to respond to quantum supremacy announcements. They need to respond to the specific algorithm classes that threaten specific cryptographic systems.

This topic is covered in depth in Session 3 of the QSECDEF Summer Bootcamp. Register to attend live or access the recording. Summer Bootcamp registration →

Mapping algorithm maturity to your security programme

Three maturity tiers each carry a distinct organisational action.

Tier 1. Threat-immediate. Shor's Algorithm on RSA, ECC, and Diffie-Hellman. The hardware capable of running Shor at cryptographic scale does not yet exist. The migration programme to replace affected systems takes 18 to 36 months for most organisations. NIST FIPS 203/204/205 (ML-KEM, ML-DSA, and SLH-DSA) provide the technical standards. The starting action is cryptographic inventory, then vendor assessment for PQC roadmap alignment, then hybrid deployment planning. The technical depth on each algorithm, key sizes, and implementation approaches is in our post-quantum cryptography algorithms guide.

Tier 2. Advantage-uncertain. QAOA, VQE, and quantum machine learning. Running on real NISQ hardware today, producing genuine research results at laboratory scale, not yet competitive with classical solvers at business scale. If your organisation operates in logistics, pharmaceuticals, or financial services, include quantum computing as an R&D monitoring item. Do not budget for near-term operational deployment. The competitive picture is genuine; the timeline is uncertain.

Tier 3. Classical-adequate with specific action. Grover's Algorithm on symmetric encryption. The threat is bounded and the response is specific: audit AES-128 deployments and migrate to AES-256, and prefer SHA-384 or SHA-512 for data with a long secrecy horizon. This is achievable in a short programme without waiting for further quantum hardware development.

The diagram below positions these three algorithm families against the axes of security relevance and algorithm maturity.

Session 3 of the QSECDEF Summer Bootcamp covers this material in full. Register for the bootcamp →