Annual Cyber Threat Report 2025-26

Cryptographically relevant quantum computers (CRQCs) are being accelerated as recent research and development becomes reality, requiring Australia to prepare for Q-day, the point where a CRQC is able to break standard public-key cryptography.

The creation of CRQCs presents new cyber security risks as adversaries may use CRQC capabilities to threaten the security of current systems that rely on traditional asymmetric cryptographic algorithms.

PQC provides a solution by using quantum-resistant algorithms designed to remain secure against future quantum computing threats. Organisations should address the threat of CRQCs and prepare to protect their IT environment now. Some service providers and vendors have begun transitioning to PQC, with some offering PQC-only solutions and products, highlighting the need for organisations to start planning their PQC transition sooner rather than later.

ASD’s ACSC recommends ceasing the use of traditional asymmetric cryptography and transitioning to PQC by the end of 2030, or sooner, which will ensure organisations are at lower risk should AI speed up developments in quantum computing. Organisations will need to consider multiple factors when planning their PQC transition, as successful transition across different organisations may vary. Factors could include the scale of IT environments, the nature of the cyber threats faced, the availability of resources, or any need to maintain interoperability with legacy systems used by business partners and customers.

ASD’s ACSC encourages organisations to consider the LATICE framework, when undertaking their PQC transition: locate, assess, triage, implement, communicate and educate.

For more information, visit ASD’s ACSC quantum-related publications on cyber.gov.au/quantum.

Image

• Locate and inventory the use of traditional asymmetric cryptography.
• Assess the value and sensitivity of systems and data protected by traditional asymmetric cryptography.
• Triage systems using traditional asymmetric cryptography and prioritise individual systems for transition.
• Implement post-quantum cryptographic algorithms throughout systems.
• Communicate with vendors and stakeholders, and educate and train relevant stakeholders on the PQC transition.

Small and medium-sized organisations – including those operating bespoke, regulated, on-premises or critical systems – cannot easily transition to PQC across complex IT environments. However, they do not need a massive budget or a large security team to begin addressing quantum risk. Where possible, organisations should look to adopt PQC by implementing solutions that are post-quantum ready, doing it in-house, or through new or existing service providers who can provide vendor-managed updates to websites, cloud services and software.