The quantum cyber threat is already here, and most businesses are not ready

Moona Ederveen-Schneider is a cybersecurity strategist, post-quantum specialist and founder of Resilia Connect. Across more than 20 years, she has held senior roles at Deutsche Bank, JPMorgan Chase, UBS, Nomura and ABN Amro, leading cyber security and risk programmes across EMEA.

She later served as Executive Director EMEA at FS-ISAC, working with central banks, governments and law enforcement across 75 countries. Moona is also the author of the Practical Post-Quantum Transition Framework, founder of the Quantum Security Connection practitioner network, and a Faculty and Curriculum Reviewer at Cambridge PACE.

In this interview with the Cyber Security Speakers Agency, Moona explains why “harvest now, decrypt later” is already a live threat, where organisations go wrong with post-quantum migration, how crypto-agility strengthens present-day resilience, and why quantum readiness is becoming a commercial differentiator.

Question 1. Why does the “harvest now, decrypt later” threat make quantum computing an immediate cybersecurity concern for businesses?

Moona Ederveen-Schneider: “This is already happening. Adversaries are harvesting encrypted data today, waiting to decrypt it once quantum computers are powerful enough.

“Most organisations have not started their transition.

“I developed the Practical Post-Quantum Transition Framework to explain the process in clear terms, cut through market hype and vendor noise, and make the transition manageable without overwhelming teams.

“I also run tabletop exercises that teach organisations how to become crypto-agile. During Quantum Security Connection sessions, I poll participants at the beginning and end. The shift in the room is remarkable.

“People arrive feeling that the problem is unmanageable and leave knowing exactly what to do next.”

Question 2. Given the NCSC’s migration timetable and Google’s earlier internal deadline, how urgently should organisations begin preparing for the quantum threat?

Moona Ederveen-Schneider: “The UK National Cyber Security Centre says organisations should complete detailed planning by 2028 and fully migrate by 2035.

“Google has set its own internal full-migration deadline of 2029, citing faster-than-expected advances in quantum computing. That reflects the sentiment I see across strong government guidance globally.

“Google is one of the organisations building these machines, so its decision deserves serious attention.

“Large organisations typically need at least five years to complete a full cryptographic overhaul, and some need twice that. The 2035 deadline is by no means generous. We have to act now.

“My Practical Post-Quantum Transition Framework is designed to deliver security improvements from day one. It explains where to start and how to complete the transition without overloading teams or budgets.

“The work also creates a more resilient architecture today, protecting against current threats such as ransomware, AI-enabled attacks and supply chain compromise.”

Question 3. Where do organisations commonly go wrong when beginning a post-quantum cryptography migration, and what should they prioritise instead?

Moona Ederveen-Schneider: “The first common mistake is treating post-quantum cryptography migration as a technology project and handing it to the security team.

“It is a whole-organisation transformation.

“The data that needs protecting sits in HR, legal and finance, as well as in what DORA calls critical business processes.

“The second common mistake is starting with the cryptographic inventory.

“Contrary to the mantra that everyone repeats, I advise organisations to enhance their data security posture first. They must answer the business questions: what are we protecting, and how long does it need to remain secret?

“My Practical Post-Quantum Transition Framework starts there and is designed to deliver security improvements from day one. It can be adapted for organisations and teams of any size.”

Question 4. How do the Quantum Security Connection and Quantum Security Intelligence Report help organisations navigate an evolving post-quantum security landscape?

Moona Ederveen-Schneider: “In my industry conversations, I kept seeing the same pattern. Organisations wanted to move forward with post-quantum cryptography, but they felt isolated.

“They did not know where to start, what their peers were doing or how to assess the vendor landscape. They also struggled to stay current as regulations and standards evolved.

“That is why the Quantum Security Connection brings together cross-sector practitioners from public and private organisations, including critical national infrastructure.

“I run structured quantum-preparedness tabletop exercises. People arrive feeling that the problem is unmanageable. Afterwards, they have a clear plan and a peer network they can rely on.

“I also published the Quantum Security Intelligence Report because the community needs a shared, trusted source explaining what is happening. It helps organisations cut through the hype and separate signal from noise.”

Question 5. How can early preparation for quantum and AI-driven security risks create a measurable competitive advantage?

Moona Ederveen-Schneider: “The organisations that get this right will be safer and ahead of their competitors.

“Early adopters in financial services and pharmaceuticals are already extracting value from quantum computing while preparing for the risks. Understanding the technology positions organisations to benefit from it.

“That is why I am working on a white paper called Practical Quantum Mechanics.

“As with any complex transformation, beginning a structured migration on time means less last-minute scrambling, lower overall costs and readiness when regulation arrives. Delaying creates a reactive and expensive catch-up.

“The cost of doing nothing can be quantified, which I also discuss in my Cambridge University programme.

“My Practical Post-Quantum Transition Framework is designed to help organisations secure this competitive advantage.

“The commercial consequences of delaying are already here. Insurers are beginning to price in quantum risk, procurement teams require evidence of readiness, and clients are asking questions that organisations without a plan cannot answer.

“Quantum readiness is a differentiator now, not in 2035.”

This exclusive interview with Moona Ederveen-Schneider was conducted by Tabish Ali of the Motivational Speakers Agency.