Post quantum migration is the thing nobody in SMB is talking about... and timelines make that a problem

NIST finalized three post-quantum cryptography standards (FIPS 203, 204, 205) in August 2024 to replace RSA and ECC algorithms for key exchange and digital signatures. Most enterprise security teams are tracking PQC migration, but SMBs and small SaaS companies are largely unprepared. Migration timelines for SMBs can take 3–4 years for discovery and planning, extending to 8–10 years for full completion. This delay poses a risk of 'harvest now, decrypt later' attacks, where adversaries collect encrypted data today to decrypt once quantum computers become capable. This is particularly concerning for organizations handling sensitive data subject to regulations such as HIPAA. Recommended initial steps include performing a cryptographic inventory to identify all asymmetric encryption usage, including in third-party libraries and cloud provider defaults, and reviewing vendor PQC roadmaps. AWS, GCP, Azure, and OpenSSL have published PQC migration plans, with OpenSSL 3.x supporting hybrid PQC in experimental mode. Much of the TLS layer migration can be achieved through configuration changes without code updates.

Organizations that do not begin migrating to post-quantum cryptographic algorithms risk having encrypted data collected now decrypted in the future once quantum computing capabilities mature. This can lead to exposure of sensitive long-lived data, regulatory violations (e.g., HIPAA), and associated legal and reputational damage. SMBs and small SaaS companies are particularly at risk due to lack of awareness and long migration timelines. Enterprises tracking PQC migration are better positioned to mitigate this risk.

Start with a cryptographic inventory to identify all uses of asymmetric encryption in your environment, including libraries and cloud provider defaults. Review vendor PQC migration roadmaps from cloud providers such as AWS, GCP, and Azure. Leverage OpenSSL 3.x experimental hybrid PQC support where applicable. Plan for migration timelines of several years and prioritize sensitive data and regulatory compliance. Many TLS layer migrations can be handled via configuration changes without code modifications. No immediate patch is required, but proactive planning and inventory are critical.