It was encouraging to read Microsoft’s thoughts on the transition to post-quantum cryptography—the new generation of encryption designed to resist future quantum computers. Few companies straddle as much of the quantum landscape, including hardware, error correction, algorithm design and deployment. When Microsoft sets a migration timeline, it matters.
The first striking element is pace. Most governments have set 2035 as the deadline for completing migration to post-quantum cryptography. Microsoft has chosen 2033. The company will make such cryptography available for early adopters by 2029, giving organisations a head start. SymCrypt, Microsoft’s cryptographic library, underpins much of its infrastructure. Microsoft plans to modernise it, integrate new tools, then extend across its estate. The ambition is welcome, but the challenge remains large.
The second element is uncertainty. Microsoft’s resource-planning tool and its research into topological qubits—a form of quantum bit designed for greater stability—suggest that attacks on current cryptography may require fewer qubits than other projections assume. Although other approaches by IonQ, Quantinuum, QuEra and PsiQuantum are also progressing, they each carry different implications. Governments and industry cannot anchor plans to one forecast.
Microsoft has also highlighted its contributions to the National Institute of Standards and Technology process. Its involvement has been constructive, but the experience shows how difficult this journey can be. Several Microsoft-backed algorithms were set aside due to cryptanalysis or performance issues. They remind us that migration needs be treated as a living process.
Setbacks should be expected and actively planned for. Microsoft’s Project Natick—an experimental undersea datacentre—originally deployed an algorithm known as SIKE that was later withdrawn after vulnerabilities were identified. The lesson is that even the largest players can be overtaken by the pace of cryptanalysis. If global leaders can be caught out, governments and smaller firms need to assume the unexpected and prepare accordingly.
Another important factor is the ecosystem effect: when a company of Microsoft’s scale moves, others are pulled along. Its services underpin operating systems, identity platforms, cloud and enterprise suites. That influence is a strength if migration succeeds, but a risk if timelines slip. Microsoft is not alone: other influential players include Google, Cloudflare and AWS.
That is why transparency and accountability are as important as technical progress. Microsoft’s public blog is a good start, but customers and governments will need independent assurance, clear milestones and the ability to verify progress over time. Migration at this scale cannot rest on trust alone.
I am not alone in this assessment. The Australian Signals Directorate has just updated its guidance on planning for post-quantum cryptography. It makes the same point: migration is a journey rather than a destination, and organisations need to begin preparing now. Daniel Shiu—a former cryptographer for Britain’s intelligence, security and cyber agency—also underlined the same themes, noting the difficulty of algorithm development, the risks of delay and the importance of building flexibility into plans. When national security authorities and experienced practitioners converge with large vendors on the urgency of action, it is a signal that complacency is no longer an option.
Policymakers should not treat migration as a single program with a neat end date. It should be iterative, layered and prepared for disruption. This is why upgrading legacy systems matters. The aim is not just migration, but crypto-agility—the ability to adopt new algorithms as standards evolve and threats change. Without that adaptability, today’s upgrade risks becoming tomorrow’s vulnerability.
The prudent approach is to build flexibility into procurement, prepare for multiple generations of tools, and avoid dependence on one vendor. Governments should also maintain the ability to independently test and validate standardised implementations as they are finalised, ensuring confidence in adoption without moving ahead of established standards.
This is particularly relevant for Australia and its partners as their critical infrastructure relies on long-lived data and control systems. A harvest-now, decrypt-later attack against utilities or transport could have consequences well before 2033. Migration should be viewed as urgent, not distant. Aligning with Microsoft’s timetable is sensible but should be complemented by independent assurance frameworks and readiness to adopt standardised libraries as soon as they are approved. ASD has also recommended using standardised software libraries when upgrading bespoke systems—warning against rushing ahead of verified implementations.
Australia’s 2023–2030 Cyber Security Strategy calls for resilience in critical sectors, but cryptographic readiness has not yet received the same visibility as broader cyber hygiene. The United States and the European Union are already mandating transition plans for public agencies. To keep pace and avoid becoming a weak link, Australia needs to take similar steps.
The contribution of Microsoft’s plan is not certainty, but a benchmark. By setting 2033 as its goal, the company has given governments, regulators and customers a timeline to test readiness. The plan is not a guarantee, but it is a useful reference point.
Definitive plans are welcome, and bold timelines help galvanise action. But the real test will be how governments and companies adapt when assumptions shift. Quantum computing will not wait for schedules. The sooner we treat post-quantum cryptography as a collective resilience project, the stronger our systems will be when the future arrives.