From Theory to Urgency
What changed over the past year, Viswesan noted, is not the science, but the response. Regulators, financial institutions and healthcare organizations are now treating quantum risk as immediate: “Customers are coming to us and saying, ‘I don’t know what to do. How do I get ready?’”
Regulatory pressure is accelerating that urgency. For example, certificate rotation cycles — once measured in months — are expected to shrink dramatically. By the end of the decade, organizations may need to rotate cryptographic certificates every 47 days, forcing a shift toward automation and visibility.
RSAC 2026 also reflected this growing momentum. Across sessions and vendor discussions, the focus shifted from awareness to execution, particularly around crypto-agility and quantum-safe architectures.
Industry leaders at the event emphasized practical steps such as gaining visibility into cryptographic assets, implementing agile encryption frameworks and aligning with emerging post-quantum standards from the National Institute of Standards and Technology.
WATCH: Check out the cybersecurity trends to watch in 2026.
The “‘Harvest Now, Decrypt Later'” Problem
One of the most pressing concerns discussed both by IBM and across RSAC sessions is the “harvest now, decrypt later” strategy. Attackers can capture encrypted data today and decrypt it once quantum capabilities mature.
This aligns with academic research showing that widely used cryptosystems such as RSA and elliptic curve cryptography could eventually be broken by Shor’s algorithm, which enables efficient factorization on quantum machines.
While today’s quantum hardware still faces limitations — including instability and scale challenges — researchers agree that the trajectory is clear.
That reality is why organizations must act before Q-Day arrives.
DIVE DEEPER: What your cybersecurity leaders need to know about quantum readiness.
Visibility Before Protection
For Viswesan, the first step isn’t replacing algorithms — it’s understanding where cryptography exists in the first place.
“I cannot fix things that I don’t know,” she said. “Visibility is the most important thing.”
IBM’s approach focuses on mapping cryptographic assets — including certificates, secrets and application programming interface keys — across environments. Once identified, organizations can begin prioritizing risk and introducing controls such as proxy layers to “buy time” before full post-quantum upgrades are available.
This mirrors broader industry guidance. RSAC discussions repeatedly highlighted encryption visibility and governance as foundational capabilities for quantum readiness.
