Policy Brief

Quantum Computing and Cyber Security: Preparing G20 Economies for the Next Technological Shift

Introduction

Quantum computing is emerging as one of the most consequential frontier technologies of the 21^st century. Using quantum-mechanical principles, quantum computers are primed to solve specific classes of computational problems exponentially faster than classical machines. For G20 economies, accounting for the bulk of global GDP and home to the world's most advanced digital infrastructure, financial systems, critical data flows, and defence networks, this represents both a transformational opportunity and a systemic cybersecurity risk.

While quantum computing promises breakthroughs in materials science, pharmaceuticals, logistics, and artificial intelligence, it also threatens to render widely used cryptographic systems obsolete. This "quantum threat horizon" is accelerating global efforts toward post-quantum cryptography, quantum-safe infrastructure, and new cybersecurity governance frameworks.

A Turning Point for Digital Security

The central dilemma lies in the risks posed by quantum computing to existing encryption systems. Every bank transfer, encrypted email, or government login, presently relies on cryptographic systems that are secure only because classical computers cannot feasibly solve the underlying mathematical problems. Quantum computing fundamentally alters this.

Quantum machines, once they become sufficiently mature, could break widely used encryption schemes by solving mathematical problems used in such encryption, at dramatically accelerated speeds. The result would be a structural breakdown of current digital security architectures. As global digital systems deepen their reliance on cryptography, the emergence of cryptographically relevant quantum computers (CRQCs) would reshape the foundations of digital trust.

The Quantum Threat Horizon: How close is Q-Day?

The term "Q-Day" refers to the moment a quantum computer becomes powerful enough to break today's encryption at scale. Until recently, most experts placed it comfortably beyond 2035, but that consensus is rapidly being revised.

The Global Risk Institute's 2025 Quantum Threat Timeline Report¹ found that the timeline for a quantum computer capable of breaking today's encryption has accelerated compared to previous estimates. Earlier assessments by the Global Risk Institute suggested a 17 to 34 per cent probability of such a machine emerging by 2034.²

However, in December 2024 the unveiling of Google's Willow quantum chip demonstrated a significant leap in error correction.³ Error correction has been one of the main engineering obstacles to building a useful quantum computer in the past. Following this breakthrough, subsequent research has revised calculations shortening the expected timeline of the arrival of Q-Day, making a breakthrough in the 2030-2032 timeframe a credible planning horizon.⁴ Experts have also reduced estimates of how many quantum building blocks, known as qubits, would be needed to break the most widely used encryption standards.⁵ Future quantum computers are assessed to be capable of breaking the cryptography protecting digital systems with far fewer qubits than previously thought.

The White House has set 2035 as the target year for full adoption of quantum-resistant encryption.⁶ However, the convergence of faster hardware, smarter algorithms, and better error correction means that businesses and governments planning for Q-Day after 2035 may be dangerously complacent. A 2030-2032 horizon is now a scenario that prudent organisations must plan for. For G20 governments, this arithmetic points to one conclusion: preparation must begin immediately.

The 'Harvest Now, Decrypt Later' Problem

There is a particularly unsettling dimension to the quantum cybersecurity challenge that is not widely understood. A sufficiently powerful quantum computer does not yet exist. However, the risk is already extant since the 'harvest now, decrypt later' threat means that adversaries are already collecting and storing encrypted data today with the explicit intention of decrypting it once quantum capability becomes available.

This means the quantum threat is not purely prospective. It is cumulative and retrospective. Data being transmitted today across G20 networks, like diplomatic cables, corporate trade secrets, intellectual property, healthcare records, and long-term financial contracts, may already be compromised.

This changes the nature of the problem. Encryption no longer becomes only about protecting real-time communications, but about ensuring long-term confidentiality over decades. For infrastructure with long lifecycles such as power grids, transportation systems, and healthcare networks, it means that systems deployed today must already be made quantum resilient. For the G20, whose economies collectively underpin the world's critical digital infrastructure, this has important implications.

The Global Policy Response

New Standards

The international response to new and emerging threats is accelerating. A major milestone came in August 2024 when the United States National Institute of Standards and Technology (NIST) published the first internationally recognised set of post-quantum cryptography (PQC) standards.⁷ These algorithms are designed to resist quantum attacks and are now forming the backbone of global migration strategies.

NIST's roadmap calls for current quantum-vulnerable encryption to be phased out after 2030 and prohibited entirely after 2035, with widely used systems such as RSA-2048 explicitly targeted for replacement. This has become the de facto global benchmark. In the US, the Quantum Computing Cybersecurity Preparedness Act additionally requires all federal agencies to audit their vulnerable systems and report on migration progress every year — a model of government accountability that other G20 members would do well to adopt.

National Commitments

Investment in quantum technology across G20 economies has also accelerated dramatically.

• The United States has reauthorized over USD 1.8 billion under its National Quantum Initiative (2025–2029).⁸
• The United Kingdom has committed £2.5 billion (appx. USD 3 million) over a decade, with additional funding announced in 2026.⁹
• Global government investment in quantum technologies crossed USD 55 billion in 2025, with Asia-Pacific, driven principally by China, South Korea, and India's appx. USD 730 million National Quantum Mission (2023-31), together accounting for nearly half of all public quantum spending worldwide.¹⁰
• The European Union's Quantum Flagship programme, Germany's push to develop a scalable quantum computer by 2026, and Australia's National Quantum Strategy, further round out a picture of broad G20 commitment.

However, the distribution of investment in quantum technologies across G20 countries is uneven. The United States leads in private quantum investment, commanding 44 per cent of global funding, followed by the United Kingdom, Canada, and Australia collectively at around 20 per cent, and China at 17 per cent, with Europe and other countries trailing.¹¹ This skewed distribution leads to asymmetry in risk across G20 countries.

Critical Infrastructure: Sectors That Cannot Wait

Certain sectors face a more acute migration urgency to quantum-resilient systems, as compared to others, mostly due to long asset lifecycles and high systemic dependency on encryption. Some of these sectors which cannot afford to take a wait-and-see approach are as follows:

• Banking and financial services are the most immediately exposed: payment systems, securities settlement, and central bank digital currency infrastructure all rely on encryption that a post-quantum computer could break.
• Energy utilities face a different challenge given that power grid infrastructure and industrial control systems have multi-decade replacement cycles, meaning equipment being commissioned today could still be running when Q-Day arrives.
• Healthcare systems hold patient records and diagnostics that will remain sensitive far into the future.
• Telecommunications networks are the backbone infrastructure carrying cross-sector digital traffic.

The B20 Action Agenda: What Business Must Do

Cryptography is so deeply embedded in modern organisations that many businesses are often not fully sure about where exactly encryption is embedded across all their systems. This could range from database connections to authentication processes, background software jobs, among other. Before any migration can begin, organisations first need to know what it is that they need to be protecting.

The following priorities stand out for the B20 community:

• Cryptographic inventory and audit: Organisations must map all encryption dependencies across systems, applications, and third-party integrations. Without this baseline, migration is impossible.
• Crypto-agility and transition planning: Beyond identifying vulnerabilities, firms must build "crypto-agility" or the ability to rapidly switch between cryptographic algorithms without major system disruption. This requires embedding flexibility into IT architecture today, along with clear, time-bound migration roadmaps aligned with emerging global standards.
• Regulatory harmonisation of PQC standards: The B20 should champion regulatory harmonisation of post-quantum migration standards across G20 jurisdictions, to reduce fragmentation and compliance complexity. Inconsistent national approaches will create issues for multinational businesses and, more dangerously, create gaps in cross-border digital infrastructure.
• Supply chain and third-party risk integration: Quantum risk is not confined to internal systems. Vendors, cloud providers, and digital partners must also transition to quantum-safe standards. Businesses should integrate post-quantum requirements into procurement frameworks and vendor risk assessments to avoid systemic weak points.
• Cross-G20 capacity building: B20 must push advanced G20 economies to invest in quantum cybersecurity capacity-building for their emerging market counterparts. The OECD's December 2025 review of quantum strategies identifies international collaboration and knowledge transfer as critical for developing a robust global ecosystem (OECD, 2025). This is not merely cooperative; rather, it is strategic self-interest, as the resilience of any G20 economy depends on the weakest link in interconnected digital systems.

Conclusion

The quantum computing transition is not a distant technological scenario; it is an unfolding systemic shift in digital security architecture. The G20 now faces a binary choice. They can coordinate by aligning on common post-quantum standards, migrating critical infrastructure in parallel, and building shared capacity across all G20 members — arriving at Q-Day with a resilient global digital architecture intact. Or they can allow migration to proceed unevenly, along existing geopolitical and economic fault lines, leaving gaps that can be exploited.

The B20 community has a distinctive role in making the first outcome more likely: through advocacy for common standards, private sector leadership on risk assessment, and a genuine commitment to building quantum resilience across the full G20 membership. Decisions taken between now and 2030 will determine whether the global digital system transitions smoothly into the post-quantum era or experiences a destabilizing rupture in its foundational trust layer.

References