Organisational preparedness for post-quantum cybersecurity

Abstract

Quantum computing introduces a fundamental shift in computational capability that challenges the long-term security assumptions of current cryptographic systems. While large-scale fault-tolerant quantum computers are not yet available, their foreseeable development creates a delayed but sys-temic cybersecurity risk for organisations that rely on classical public-key encryption. This risk is am-plified by the harvest now, decrypt later model, in which encrypted data collected today may be ex-posed in the future. The purpose of this thesis is to examine how organisations should prepare for quantum-safe cyberse-curity and post-quantum cryptography from a strategic, regulatory, and organisational perspective. The study combines a structured literature review with an empirical survey conducted among cyber-security professionals in Finland, with a particular focus on regulated and critical sectors. The findings indicate that awareness of post-quantum cryptography exists but remains shallow, and that organisational preparedness is generally at an early stage. The most significant barriers identi-fied are technological uncertainty, lack of skills, limited resources, and insufficient guidance. At the same time, regulatory developments and public investment signals suggest that post-quantum pre-paredness is increasingly becoming a governance and compliance expectation rather than a purely technical option. This thesis concludes that effective preparation for quantum-safe cybersecurity requires early and structured action. Key measures include cryptographic inventory management, crypto-agile system design, hybrid cryptographic deployments, vendor readiness assessment, and documented transition planning. By integrating these measures into long-term security governance, organisations can re-duce future exposure while remaining aligned with evolving regulatory and technological expecta-tions.