Quantum Computing Fundamentals: A Practical Guide for Business and Security Professionals

Not a physics course. Not a research paper. Here is what business and security professionals need to understand about quantum computing before it changes their work.

The goal is not to make security professionals into quantum physicists. It is to give the conceptual models that make sense of the decisions ahead: which cryptographic systems are at risk and why, what the hardware gap actually is, and what genuine progress toward a cryptographically relevant machine looks like when distinguished from a vendor announcement. Quantum computing for business is about understanding which decisions quantum mechanics affects, not understanding quantum mechanics itself.

From bits to qubits: what actually changes

A classical computer processes information as bits. Each bit holds either zero or one. Every calculation is a sequence of operations on those discrete values. The architecture running your email, your database, and your encryption keys operates on this principle. Deterministic. Fast. Bounded by the computational hardness of specific mathematical problems.

Quantum computers use qubits (quantum bits). A qubit's state before measurement is a superposition: a probabilistic combination of basis states |0⟩ and |1⟩, described by complex probability amplitudes. Measurement collapses that state to a definite value. The computational advantage comes from manipulating those amplitudes across many qubits simultaneously, structuring interference patterns so the correct answer becomes the most probable outcome when the computation completes.

This is not parallel processing in the classical sense. A classical parallel computer computes N paths and returns N answers. A quantum computation manipulates interference between N paths and returns one answer. The answer that constructive interference amplified. The computation is structurally different, not simply faster.

The problems that benefit from quantum algorithms are specific. Factoring large integers via Shor's algorithm. Searching unstructured databases via Grover's algorithm. Simulating quantum chemical systems. Most database queries, web serving, and machine learning training on large datasets carry no known quantum speedup. Precision on this point determines the correct organisational response to a quantum threat.

This topic is covered in depth in Session 2 of the QSECDEF Summer Bootcamp. Register to attend live or access the recording.

Superposition, entanglement, and decoherence

Superposition is the qubit's pre-measurement state. A qubit's state is a vector in a two-dimensional complex space, not an averaged-out value sitting between zero and one. Quantum algorithms manipulate amplitude structures across many qubits simultaneously, exploring an exponentially large solution space by reinforcing correct answers through constructive interference and suppressing incorrect ones through destructive interference. The computational advantage is in the structure of that interference, not in the qubit being "both values at once" as the simplified version has it.

Entanglement links qubits in correlated quantum states. When qubits are entangled, the measurement outcome of one defines the correlated state of another regardless of physical separation. Entanglement is not faster-than-light communication; the correlation cannot transmit information. What it provides is a resource for multi-qubit operations that classical parallel computation cannot replicate without exponentially more resources. Both Shor's algorithm and Grover's algorithm use quantum interference to amplify the probability of the correct answer. Shor's exponential advantage (the reason RSA and ECC have no key-length defence against a CRQC) comes from multi-qubit interference across entangled registers. Grover's speedup is quadratic: it halves the effective key length of symmetric ciphers, which is why AES-256 retains adequate margin but AES-128 does not.

Decoherence is the dominant engineering obstacle. A qubit's quantum state collapses when it interacts with its surrounding environment. Heat, electromagnetic interference, and vibration all cause it. Superconducting quantum computers currently operate at approximately 15 millikelvin to suppress thermal decoherence. Colder than deep space. Coherence time, specifically how long the quantum state persists before noise overwhelms it, limits circuit depth: the number of operations that complete before the computation is lost to noise. This is why current machines cannot run Shor's algorithm on RSA-2048. The decoherence limit is reached long before the computation completes, regardless of physical qubit count.

The hardware reality: where things actually are

The distinction between physical qubits and logical qubits is the figure that matters for cryptographic relevance, and it is routinely absent from hardware announcements.

A physical qubit is the actual hardware component in a quantum device, subject to noise and decoherence. A logical qubit is an error-corrected, fault-tolerant qubit constructed from many physical qubits using quantum error correction codes. Current surface code error correction requires approximately 1,000 to 10,000 physical qubits per logical qubit (Fowler et al., Physical Review A, 2012). Running Shor's algorithm on RSA-2048 requires approximately 317 million physical qubits under these overhead assumptions (Webber et al., AVS Quantum Science, 2022). Current machines have hundreds to low thousands of physical qubits. The hardware gap is three orders of magnitude.

When a vendor announces a "1,000 qubit" processor, they are describing physical qubits. The relevant question is gate fidelity: how often each qubit operation produces the correct result, and what error-correction overhead that fidelity requires for fault-tolerant computation. Gate fidelity, not qubit count, determines whether announced hardware reduces the actual distance to a cryptographically relevant quantum computer (a CRQC, meaning a fault-tolerant machine capable of running Shor's algorithm at the key sizes used in current deployments).

Google's Willow processor demonstrated in 2024 that adding physical qubits to the error-correction system reduced the overall error rate rather than amplifying it (Acharya et al., Nature, 2024). This is the below-threshold condition required for fault-tolerant scaling, and it is a genuine engineering milestone. It does not shorten the Q-Day timeline materially. The benchmark performed, random circuit sampling, has no cryptographic relevance. We are in what John Preskill defined in 2018 as the Noisy Intermediate-Scale Quantum (NISQ) era: devices with 50 to 1,000 physical qubits, operating without error correction, with noise that limits circuit depth. NISQ devices demonstrate quantum behaviour. They cannot run the algorithms that threaten RSA.

Mapping these concepts to your security and business decisions

Superposition and entanglement explain why RSA, ECC, and Diffie-Hellman are vulnerable to Shor's algorithm. Those algorithm families derive their security from integer factorisation and the discrete logarithm problem: mathematically hard for classical computers, solvable in polynomial time on a CRQC. The migration response is post-quantum cryptography.

In August 2024, NIST published three finalised post-quantum cryptography standards: FIPS 203 (ML-KEM, Module-Lattice-Based Key Encapsulation Mechanism), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA). A fourth standard, FIPS 206 covering FN-DSA (a lattice-based digital signature scheme derived from the FALCON algorithm), is in final approval review as of July 2026, with publication expected late 2026 or early 2027, and was not part of the August 2024 release. These algorithms rely on mathematical problems that current quantum algorithms do not solve efficiently. NIST IR 8547, published November 2024, sets out a deprecation and retirement schedule for the classical algorithms they replace, with RSA and ECC targeted for retirement by 2030 in new US federal systems. Executive Order 14412, signed by President Trump on 22 June 2026, gives that 2030 deadline executive mandate force for US federal agencies.

Decoherence and the hardware gap explain the timeline uncertainty. Every headline about a quantum computing breakthrough is worth evaluating against two questions: does this milestone involve logical qubits or physical qubits, and does the benchmark have cryptographic relevance? If neither answer is yes, the headline is an engineering update, not a security planning revision. The path from current NISQ hardware to a CRQC requires overcoming the 1,000:1 physical-to-logical qubit overhead at a scale that no current roadmap has delivered.

The Harvest Now, Decrypt Later (HNDL) risk does not wait for a CRQC. Adversaries collecting encrypted data now for decryption when fault-tolerant hardware arrives are acting on a rational assessment of the trajectory. For organisations holding data with a secrecy horizon longer than ten years, whether financial records, health data, or critical infrastructure communications, the relevant migration deadline is not a future decision point. QSECDEF's Q-Day timeline risk calculator lets security teams model this risk window against their organisation's specific data classifications. For the threat framing rather than the technical mechanics, the quantum computing and cybersecurity overview covers the security practitioner perspective directly.

Four signals distinguish genuine progress toward CRQC-level capability from NISQ hardware advances. Watch for fault-tolerant logical qubit demonstrations at increasing scale. Watch for improvement in the physical-to-logical qubit overhead ratio from the current 1,000:1 baseline. Watch for vendor product roadmaps that specify NIST FIPS 203/204/205 compliance timelines rather than raw qubit counts. Watch for algorithm benchmarks that name the specific problem size and classical performance baseline being surpassed. These are the signals that connect quantum computing progress to your security programme's planning assumptions.

Session 2 of the QSECDEF Summer Bootcamp covers this material in full. Register for the bootcamp →