Microsoft Outlines Ambitious Post-Quantum Cryptography Plans

It was encouraging to read Microsoft’s thoughts on the transition to post-quantum cryptography—the new generation of encryption designed to resist future quantum computers. Few companies straddle as much of the quantum landscape, including hardware, error correction, algorithm design and deployment. When Microsoft sets a migration timeline, it matters.

The second element is uncertainty. Microsoft’s resource-planning tool and its research into topological qubits—a form of quantum bit designed for greater stability—suggest that attacks on current cryptography may require fewer qubits than other projections assume. Although other approaches by IonQ, Quantinuum, QuEra and PsiQuantum are also progressing, they each carry different implications. Governments and industry cannot anchor plans to one forecast.

Setbacks should be expected and actively planned for. Microsoft’s Project Natick—an experimental undersea datacentre—originally deployed an algorithm known as SIKE that was later withdrawn after vulnerabilities were identified. The lesson is that even the largest players can be overtaken by the pace of cryptanalysis. If global leaders can be caught out, governments and smaller firms need to assume the unexpected and prepare accordingly.

Another important factor is the ecosystem effect: when a company of Microsoft’s scale moves, others are pulled along. Its services underpin operating systems, identity platforms, cloud and enterprise suites. That influence is a strength if migration succeeds, but a risk if timelines slip. Microsoft is not alone: other influential players include Google, Cloudflare and AWS.

That is why transparency and accountability are as important as technical progress. Microsoft’s public blog is a good start, but customers and governments will need independent assurance, clear milestones and the ability to verify progress over time. Migration at this scale cannot rest on trust alone.

I am not alone in this assessment. The Australian Signals Directorate has just updated its guidance on planning for post-quantum cryptography. It makes the same point: migration is a journey rather than a destination, and organisations need to begin preparing now. Daniel Shiu—a former cryptographer for Britain’s intelligence, security and cyber agency—also underlined the same themes, noting the difficulty of algorithm development, the risks of delay and the importance of building flexibility into plans. When national security authorities and experienced practitioners converge with large vendors on the urgency of action, it is a signal that complacency is no longer an option.

Policymakers should not treat migration as a single program with a neat end date. It should be iterative, layered and prepared for disruption. This is why upgrading legacy systems matters. The aim is not just migration, but crypto-agility—the ability to adopt new algorithms as standards evolve and threats change. Without that adaptability, today’s upgrade risks becoming tomorrow’s vulnerability.

The prudent approach is to build flexibility into procurement, prepare for multiple generations of tools, and avoid dependence on one vendor. Governments should also maintain the ability to independently test and validate standardised implementations as they are finalised, ensuring confidence in adoption without moving ahead of established standards.

This is particularly relevant for Australia and its partners as their critical infrastructure relies on long-lived data and control systems. A harvest-now, decrypt-later attack against utilities or transport could have consequences well before 2033. Migration should be viewed as urgent, not distant. Aligning with Microsoft’s timetable is sensible but should be complemented by independent assurance frameworks and readiness to adopt standardised libraries as soon as they are approved. ASD has also recommended using standardised software libraries when upgrading bespoke systems—warning against rushing ahead of verified implementations.

Australia’s 2023–2030 Cyber Security Strategy calls for resilience in critical sectors, but cryptographic readiness has not yet received the same visibility as broader cyber hygiene. The United States and the European Union are already mandating transition plans for public agencies. To keep pace and avoid becoming a weak link, Australia needs to take similar steps.

The contribution of Microsoft’s plan is not certainty, but a benchmark. By setting 2033 as its goal, the company has given governments, regulators and customers a timeline to test readiness. The plan is not a guarantee, but it is a useful reference point.

Definitive plans are welcome, and bold timelines help galvanise action. But the real test will be how governments and companies adapt when assumptions shift. Quantum computing will not wait for schedules. The sooner we treat post-quantum cryptography as a collective resilience project, the stronger our systems will be when the future arrives.

Jason Van der Schyff is a fellow with ASPI’s Cyber, Technology and Security Program. His research focuses on sovereign industrial capability, secure hardware and the resilience of critical technology supply chains.

This article appeared originally at The Strategist (ASPI).