Putting a price on the quantum threat

Most boards have now heard that a quantum computer could one day break the cryptography that protects their data. Far fewer have been told what that means for them, in money, on a timeline they can plan against. That gap is why quantum risk so often stalls between the security team and the executive table: it sounds both urgent and abstract.

At BT, I worked on closing that gap. I built a risk scenario for a cryptographically relevant quantum computer, looking 15 years ahead, and expressed the exposure in financial terms so it could feed into emerging-risk reporting for the Executive Committee. Here's the approach, and what I learned using it.

1. Start with the scenario, not the physics

Leaders don't need to understand qubits. They need a plausible story about loss. Mine was simple: a well-resourced nation-state adversary collects encrypted traffic today, stores it, and decrypts it once a cryptographically relevant quantum computer exists.

That's "harvest now, decrypt later", and it reframes the question. The risk isn't that a quantum computer arrives in some future year. It's that data you protect today may still need to be secret when it does.

2. Find the data with a long shelf life

Michele Mosca's well-known inequality is the most useful tool here. If the number of years your data must stay confidential, plus the years it will take you to migrate, is greater than the years until a capable quantum computer exists, you already have a problem.

So the first practical step is an inventory: which systems rely on public-key cryptography, what they protect, and how long that information has to stay secret. Long-lived secrets such as intellectual property, customer data with long retention periods and infrastructure credentials come first.

3. Break the risk into parts you can estimate

I used FAIR (Factor Analysis of Information Risk), because it forces you to separate two questions that usually get blurred together:

• How often could a loss event happen? That depends on how often a capable adversary would act, and how likely their attempt is to succeed against your current controls.
• How much would it cost when it does? That covers primary losses, such as response, replacement and lost productivity, and secondary losses, such as regulatory, contractual and reputational impact.

Nobody knows these numbers precisely, and FAIR doesn't pretend to. Each input is a range, with a minimum, a most likely value and a maximum, agreed with the subject-matter experts who know the systems.

4. Let the simulation carry the uncertainty

With ranges in place, a Monte Carlo simulation runs the scenario thousands of times. The result is a distribution of possible annual losses, the annualised loss expectancy, rather than a single number.

A board can work with "there's a realistic chance this costs us more than X a year once the threat matures". It can't work with "quantum is high risk".

5. Turn the number into a decision

A risk figure is only useful if it changes what someone does. The quantified scenario let us talk about:

• Cost versus reduction: what a cryptographic inventory and migration programme costs, against the reduction in expected loss.
• Timing: waiting has a price, because harvested data can't be un-harvested.
• Crypto-agility: systems that can swap algorithms without being rebuilt make every future migration cheaper.

The external landscape now supports this conversation. NIST finalised its first post-quantum cryptography standards in August 2024: FIPS 203, 204 and 205. The UK's National Cyber Security Centre has published indicative migration milestones: discovery and an initial plan by 2028, high-priority migration between 2028 and 2031, and full migration by 2035. Those dates turn "someday" into a planning horizon.

What I learned

Ranges build trust. Experts who would never commit to a single figure were comfortable giving a range. That made the workshops faster and the result more credible.

Lead with time, not technology. The conversation changed once we talked about how long our data needed to stay secret, rather than when quantum computers would arrive.

Quantification is a translation exercise. The model mattered less than the fact that it let security and business leaders argue about the same thing in the same units.

Quantum risk isn't a future problem with a future budget. For any organisation holding long-lived secrets, part of the exposure exists today. Putting a price on it is how you get it onto the agenda before the timeline makes the decision for you.