Invalid Date

Quantum Security for Small Business: What the Threat Actually Is and What to Do About It

The quantum migration for most SMB data sits with cloud vendors, not with you. This guide explains the real threat, who is responsible, and the four areas where an SMB genuinely has agency.

Quantum Security for Small Business: What the Threat Actually Is and What to Do About It

If you run a small or medium-sized business and you have been reading about quantum computing threats to encryption, you may be wondering whether this is something you need to act on urgently. The short answer is: probably not much, and probably not right now. That is not complacency. It is an accurate assessment of where the threat sits, who is responsible for the migration, and what an SMB actually needs to do.

A cryptographically relevant quantum computer does not exist today. The Global Risk Institute's 2024 survey of quantum computing experts puts the probability of one becoming operational within ten years at 14 to 34 per cent. That range reflects genuine scientific uncertainty. The threat is real, but the timeline is not a single fixed date, and the work of protecting most business communications and data does not fall primarily on small businesses. It falls on the cloud platforms, software vendors, and infrastructure providers those businesses use.

This article explains the actual threat, who is responsible for the migration for most SMB operations, the narrow areas where an SMB does have something to check, and what organisations most definitely do not need to spend money on. It is written for business owners, IT managers, and anyone who has been handed a quantum security headline and asked to work out what it means for a business with ten to five hundred employees.

What the Actual Threat Is and the Timeline

The specific risk that quantum computing poses to current cryptography is the potential for a large enough quantum computer to run Shor's algorithm, a mathematical procedure that can break the asymmetric encryption used in RSA and ECC key exchange. These algorithms protect the TLS connections your browser makes to websites, the VPN connections remote workers use, and the digital signatures on software updates. A cryptographically relevant quantum computer (CRQC) capable of breaking RSA-2048 in a meaningful timeframe does not yet exist. Current quantum computers are far too small and error-prone to run Shor's algorithm at that scale.

There is a threat that is already active, though. It is called harvest now, decrypt later (HNDL). Nation-state adversaries with significant resources are believed to be collecting encrypted communications today, storing them, and planning to decrypt them once a CRQC is available. The question for any organisation is: do you hold data today whose confidentiality still matters in 2033 or 2035? For a small accounting firm, the answer is probably no. For a GP practice holding long-term patient records, or a law firm with sensitive client correspondence, the answer may be different.

For most SMBs, an honest HNDL risk assessment looks like this. Your business data travels encrypted over your cloud provider's infrastructure. Your emails sit in Microsoft 365 or Google Workspace. Your files are in SharePoint or Google Drive. Your customer data is in a SaaS CRM. None of that is a credible HNDL target for a nation-state adversary. HNDL attacks require the resources to collect and store large volumes of encrypted traffic, maintain it for potentially a decade, and then operate a CRQC. That investment profile describes intelligence services targeting high-value communications, not a 50-person logistics company's invoicing data.

Why Most of the Migration Is Not Your Job

Cloud Providers Are Migrating for You

If your business runs on Microsoft 365, Google Workspace, or AWS, the post-quantum migration for the cryptographic operations those platforms handle is the vendor's responsibility, not yours. These are not small businesses. They have dedicated quantum security teams and they have already started.

Microsoft has publicly committed to integrating post-quantum cryptography across its cloud services and announced hybrid PQC in Azure networking services through 2023 and 2024. Google began deploying hybrid ML-KEM in Chrome 131 and has integrated PQC into Google Cloud TLS connections. AWS has announced AWS KMS support for post-quantum key exchange and has integrated hybrid TLS in its network connections. For the encrypted connections your business makes to and through these platforms, the PQC migration is underway at the vendor level. Your job is to stay on supported service tiers. That is it.

NIST finalised three post-quantum cryptography standards in August 2024: ML-KEM (FIPS 203) for key exchange, ML-DSA (FIPS 204) for digital signatures, and SLH-DSA (FIPS 205) for hash-based signatures. These are the algorithms that cloud vendors are deploying. You do not need to implement them directly. You need to be on a vendor version that has already done so. For a technical explanation of what these standards mean in practice, see our post-quantum cryptography guide for security architects.

SaaS Applications Work the Same Way

The vast majority of SaaS tools an SMB uses, covering accounting software, CRM platforms, e-commerce systems, and HR tools, transport data over TLS. As TLS libraries and cloud infrastructure are updated with PQC-enabled cipher suites, that migration flows downstream to the SaaS layer, and from there to your business, automatically. You do not need to configure anything. You benefit from vendor infrastructure investment that you are already paying for in your subscription.

The one question worth asking about your most business-critical SaaS tools is whether the vendor has a post-quantum roadmap. This is not a technical question. It is a supply chain question: does this vendor have a plan? If they cannot answer it at all, that is a useful data point about how seriously they take security infrastructure. It does not mean you need to switch vendors immediately, but it is worth noting in your annual IT review.

What SMBs Actually Need to Check

Four areas where an SMB has genuine agency over its own quantum security posture. None of them require a consultant or a specialist product purchase.

First: on-premises VPN appliances. If your business uses a hardware VPN from Cisco, Palo Alto, Fortinet, SonicWall, or a similar vendor, check whether the vendor has released a firmware update that includes PQC support. The relevant standard is RFC 9370, which defines how VPN key exchange (IKEv2) is updated to include hybrid post-quantum key exchange. Most major VPN vendors have announced or released PQC-enabled firmware. When an update is available, apply it as part of your normal patch cycle.

Second: in-house encrypted storage with self-managed keys. If your business holds sensitive data encrypted with keys it manages directly, rather than through a cloud key management service, those keys use RSA or ECC today. When your key management software provides an update supporting PQC-based key wrapping, plan a key rotation as part of your standard security maintenance. This is a future task, not an urgent one. Most SMBs do not manage their own encryption keys directly; their cloud provider does it for them.

Third: SSL and TLS certificates on self-hosted websites or services. RSA-2048 and ECC P-256 certificates remain the current standard and do not need to be replaced now. Certificate authorities including DigiCert and Let's Encrypt are developing post-quantum certificate roadmaps. SMBs running self-hosted services should be aware that certificate lifecycle management will involve algorithm transitions during the 2026 to 2030 period, so factor that into your IT planning rather than treating it as a surprise.

Fourth: custom-developed applications. If your business has internally built software that handles its own cryptographic operations (uncommon at SMB scale, but present in some technology businesses), ensure the developers are using standard TLS libraries that will receive PQC updates. If your application is rolling its own cryptographic code, that is a security problem that predates quantum computing and should be addressed regardless.

What SMBs Do Not Need to Do

A significant part of the value of a clear-eyed quantum risk assessment is working out what is not your problem. The following items appear frequently in vendor marketing directed at SMBs. None of them are necessary for most businesses at this scale.

Do not buy QKD equipment. Quantum key distribution is a specialised technology for specific government and financial infrastructure scenarios. It costs approximately $100,000 per node, requires dedicated fibre infrastructure, and is designed for threat models involving nation-state adversaries targeting classified communications or regulated payment rails. A vendor selling QKD to an SMB is selling a solution to a problem the SMB does not have. For a detailed breakdown of QKD costs and where it is actually justified, see our article on the economics of QKD deployment.

Do not implement post-quantum algorithms yourself. PQC migration for your infrastructure means updating to PQC-enabled versions of standard libraries and platforms as vendors ship them. It does not mean writing your own lattice-based key encapsulation mechanism. For organisations that need to understand what hybrid post-quantum cryptography actually involves at a technical level, that article covers the design clearly without requiring a cryptography background. Any product or service requiring an SMB to implement cryptographic primitives directly is introducing unnecessary complexity. The strength of PQC standards is precisely that they are implemented by expert cryptographers in widely audited libraries, not by individual teams starting from scratch.

Do not engage an expensive quantum security consultancy for an SMB-scale migration programme. The SMB quantum security migration is: check vendor roadmaps, apply firmware updates when vendors release them, review once a year. This is a half-day task, not a six-month project. Consultancies that scope large migration programmes for SMBs are providing a service calibrated to enterprise complexity and enterprise budgets.

Do not assume your password database is immediately at risk. Symmetric encryption such as AES-256-GCM is not broken by quantum computers in practical timeframes. Password hashing algorithms such as bcrypt and Argon2 are not a primary quantum risk. The vulnerability is in asymmetric cryptography (RSA, ECC) used for key exchange and digital signatures. If you have good password hygiene and your staff use strong passwords, that aspect of your security posture is not a quantum problem.

UK Cyber Essentials Plus and Quantum

Cyber Essentials Plus, the UK government-backed certification scheme managed by the NCSC, covers five technical controls: firewalls, secure configuration, user access control, malware protection, and patch management. It does not currently address post-quantum cryptography explicitly, per the January 2024 technical specification.

Two of those five controls are directly relevant to quantum migration, though. Patch management and secure configuration are exactly the mechanisms through which an SMB will receive PQC updates from its vendors. Keeping TLS libraries, VPN firmware, operating systems, and cloud software updated to current vendor-supported versions is the primary action that moves a business towards quantum-safe infrastructure. An SMB with Cyber Essentials Plus certification and disciplined patch management is in a better position to absorb quantum-safe updates than one without. The certification is not quantum-specific, but it builds the operational habits that matter most.

The NCSC's guidance for SMBs on post-quantum security is consistent with this: organisations do not need to wait for a specific directive on each individual technology change. Keeping software updated and using vendors with active security programmes covers the majority of the migration for standard business operations.

A One-Page Quantum Security Plan for SMBs

The quantum security action plan for most small and medium-sized businesses fits on a single page. It is not complex and it does not require specialist expertise.

This quarter: identify the three cloud platforms your business relies on most for data storage, communication, and authentication. Search “[vendor name] post-quantum cryptography roadmap” for each and note whether they have published a plan and when it was last updated. Check whether your VPN appliance vendor has released a PQC firmware update and apply it if one is available.

This year: add quantum security as one item in your annual IT vendor review. The question is simply: does this vendor have a published post-quantum roadmap or timeline? If you hold sensitive data with long-lived confidentiality requirements, such as healthcare records, legal documents, or financial history, stored under self-managed encryption keys, note the key type and plan to rotate to AES-256-GCM or ML-KEM-based key wrapping when your key management tool provides that capability.

You do not need to: build a PQC migration programme, hire a quantum security specialist, buy QKD or quantum-specific hardware, or achieve any compliance certification specifically for quantum. For most SMBs, that list covers everything that would be a waste of time and money.

When an SMB Has a Higher-Risk Profile

There are three categories of SMB where the default “you're probably fine” assessment should be reviewed more carefully.

Healthcare SMBs, including GP practices, dental practices, private clinics, and pharmacies, hold patient data with long-lived sensitivity requirements. Medical records have a confidentiality expectation that extends decades. UK GDPR Article 32 requires a “state of the art” standard for technical security measures, and that standard evolves. NHS supply chain suppliers also face NHS Data Security and Protection Toolkit requirements that may be updated to include post-quantum controls as NHS England publishes quantum security guidance. Healthcare SMBs should treat their patient data encryption as a higher-priority item on the vendor roadmap checklist.

Legal SMBs, including small law firms and barristers' chambers, hold privileged communications with long-lived confidentiality requirements. The Solicitors Regulation Authority and Bar Standards Board both require firms to maintain appropriate information security. A small firm holding sensitive client matter files under self-managed encryption should include that in its HNDL risk consideration, even at SMB scale. The key question is the same: is this data held in a form where confidentiality must be maintained for more than five to ten years?

Technology SMBs holding valuable proprietary intellectual property, including unpublished source code, biotech research data, or engineering designs, may represent a credible HNDL target if the IP has value measured in years. A software company with a genuinely novel technology asset is in a different risk category from a retail or logistics business. These businesses should assess their specific situation rather than applying the default conclusion. For guidance on that assessment, the HNDL risk assessment framework provides a structured approach to identifying which data matters most.

About the Author

Steven Vaile is a quantum security and post-quantum cryptography consultant and the founder of Quantum Security Defence. He advises enterprises and government bodies on PQC migration strategy, cryptographic governance, and quantum risk assessment. He has spoken at international security conferences on the intersection of quantum computing and critical infrastructure protection.