Post-Quantum Cryptography: Getting Your Organization Ready

Post-quantum cryptography is a new generation of encryption designed to stay safe once quantum computers become powerful enough. A Forescout report covered on October 8, 2026 shows how uneven preparation still is: only 6% of medical devices have SSH software able to support it. For your organization, the first job is simple. Find out what you actually encrypt.

Why data encrypted today could be a problem later

Almost all of today’s encryption relies on math problems that ordinary computers cannot solve in a reasonable time. A sufficiently powerful quantum computer, if one arrives, is expected to solve some of those problems far faster. Nobody knows exactly when.

What makes the topic urgent is not the arrival date but a tactic known as harvest now, decrypt later. Someone with bad intentions copies encrypted data today, stores it, and opens it once the tools exist. For data that goes stale within a week, that hardly matters. For medical histories, civil records, or contracts that must stay confidential for ten years, it matters a lot.

That is why several large vendors have set their own deadlines.

What Microsoft and Google Cloud are doing

In early July 2026, The Hacker News reported that Microsoft is speeding up its Quantum Safe Program, aiming to move critical products and services to post-quantum cryptography by 2029. Azure CTO Mark Russinovich said, “We believe cryptographically relevant quantum computers could arrive sooner than previously expected.” The same report notes that Google and Cloudflare have committed to the same year.

Google Cloud has its own roadmap. SecurityWeek noted on August 14, 2026 that Google Cloud targets full readiness by 2029, with some work continuing into the next decade. The milestones are fairly concrete:

• End of 2027: the “store now, decrypt later” risk is mitigated across customer workloads, admin and developer tooling, and data transfer services.
• End of 2028: digital signature and identity protections are finished, including quantum-resistant certificates and hardened Cloud IAM, along with foundational key management.

For customers, Google suggests three things: inventory your cryptographic assets such as keys and certificates, update tooling to libraries that support the new algorithms, and test applications against the quantum-safe APIs that already exist.

Notice the pattern. Cloud providers are targeting their side of the stack. The parts you own, meaning your own systems, field devices, and in-house applications, will not be upgraded for you.

Older devices are the weakest link

This is where the Forescout report matters. As Help Net Security reported on October 8, 2026, Forescout analyzed more than 2.5 million devices across more than 50 healthcare delivery networks. The share of SSH software able to support post-quantum cryptography was very uneven:

• Connected medical devices: 6%
• Operational technology (OT) devices: 16%
• Ordinary IT devices: 50%

Two notes so the numbers are not misread. First, this measures capability, not use. Software that can support it may not have it switched on. Second, the data comes from hospital networks in several countries, so it is not a snapshot of Indonesia. We did not find a comparable study focused on Indonesian healthcare facilities.

Still, the pattern is easy to understand. Infusion pumps, ventilators, patient monitors, and building controls can run for years without major updates. The report also found more than 5,500 medical information systems exposed to the internet, 46% of them electronic medical record platforms and 40% imaging archive systems (PACS). On average, only 31% of those exposed systems supported TLS 1.3, the newer protocol for encrypting connections.

The threat context is not abstract either. Forescout counted 461 public ransomware claims and 300 hacktivist attack claims against healthcare providers worldwide between January and August 2026.

What this means for your organization

You do not need to replace every system now. In our view, the sensible move is to draw the map first. Here are four steps you can start this year.

1. Take inventory

Note where data is encrypted: website certificates, VPNs, SSH access to servers, document signatures, database encryption, and backups. Many organizations discover that certain certificates or keys are “baked into” devices nobody has records for. A few simple questions help: who manages it, when does it expire, and which algorithm does it use? Schools with local exam servers, agencies running older vendor-built applications, and hospitals with single-vendor equipment all have blind spots like this.

2. Prioritize long-lived data

Not all data is equal. Information that must stay confidential for more than five to ten years, such as medical records, civil records, student transcripts, and long-term contracts, deserves attention first. This also fits your duty to protect personal data under Law Number 27 of 2022 on Personal Data Protection (Undang-Undang Pelindungan Data Pribadi).

3. Pilot in a non-production setting

Try the new technology in a test environment before touching systems used every day. Focus on being able to swap algorithms easily, known as crypto-agility. In the same report, Microsoft advises removing hard-coded algorithm assumptions and treating algorithm upgrades as routine engineering work rather than emergency rewrites.

4. Ask vendors for timelines

Ask device and software suppliers when post-quantum support will arrive, whether it needs new hardware, and which version you must run. Devices that cannot be updated should be isolated on a separate network segment and covered by other controls such as access restrictions and monitoring, as Forescout also recommends. For new purchases, make post-quantum support one of the requirements.

One honest note: we did not find a specific post-quantum migration obligation in the Indonesian regulations we read. So the steps above are better described as good practice than compliance. Even so, security work started early is almost always cheaper than work done in a hurry, especially for data that must last decades.

The logic resembles recycled data leaks that resurface: data stolen today can be used long afterward. The difference is that with quantum, even stolen data may stay unreadable until the tools exist.

Frequently asked questions

Can quantum computers break today’s encryption already?

Based on the sources we read, there is no claim that this has happened. Preparation is underway because vendors believe sufficiently powerful machines could arrive sooner than first expected, and because data can be copied now and opened later.

Should schools or small businesses worry?

There is no need to panic. Start small: know what you encrypt, use cloud services and software whose updates are kept current, and choose vendors with a clear plan. For most organizations, much of the work will arrive through vendor updates.

Do we have to replace our devices now?

Usually not. First map which devices can be updated through software, which need replacing, and which hold long-lived data. Replacements can be scheduled alongside hardware refresh cycles you already plan.

Start with the map

The core message: post-quantum cryptography is not a one-night project, but it is not something to postpone without a plan either. Begin with a list of keys, certificates, and long-lived systems. From there, the order of work tends to become clear on its own.

If you would like company while building an inventory or assessing system readiness, our team can help through our cybersecurity services, cloud services, or healthcare solutions. If you would rather talk first, feel free to contact us.

Sources

• Help Net Security, “Medical devices patients rely on most are least prepared for quantum attacks” (October 8, 2026)
• SecurityWeek, “Google Cloud Sets Out Post-Quantum Roadmap With 2029 Readiness Goal” (August 14, 2026)
• The Hacker News, “Microsoft Accelerates Post-Quantum Cryptography Shift to 2029” (July 1, 2026)