ISACA Survey: 51% See Cyber Risk Hike; 46% Expect Regulatory, Compliance Challenges

95% of Organizations Lack a Quantum Computing Strategy

By Brian Pereira (creed_digital)     

Quantum technology holds advanced potential – such as helping find cures for terminal diseases – but it also poses serious security risks for organizations. Information Systems Audit and Control Association’s 2025 Quantum Computing Pulse Poll – a global study of 2,685 professionals, including 229 from India – reveals that 95 per cent of global organizations, including 93 per cent in India, lack a quantum road map or strategy.

According to the survey, 62 per cent organizations are concerned that quantum computing could break today’s internet encryption, 40 per cent are unaware of their organization’s quantum computing plans, only 7 per cent understand NIST’s post-quantum standards, and 57 per cent believe quantum computing will introduce new business risks.

While 53 per cent of India-based technology and cybersecurity experts believe quantum computing could soon compromise today’s encryption standards, only 7 per cent of Indian organizations have a clear strategy in place and just 9 per cent consider it a high business priority.

Quantum Computing to Arrive Sooner

The age of mainstream quantum computing was once decades away, but now experts predict it could be within five to 10 years. In February 2025, Microsoft and Amazon announced new quantum computing chips, accelerating the timeline for mainstream adoption of quantum computing to just a few years. Many quantum startups are also in advanced funding stages or have already gone public.

“The recent advances in quantum computing [including the Microsoft announcement] are making the post-quantum future more of a near-term concern,” said Joseph Blankenship, vice president and research director at Forrester. “That means organizations with high-value, sensitive data need to start planning now and preparing in the next couple of years, so they are protected once quantum computers capable of breaking current encryption algorithms are in the hands of threat actors.”

In an earlier blog post, Forrester analysts said that while mainstream quantum computers capable of breaking encryption are still years away, state-sponsored and nation-state actors are likely to gain access sooner. Many of these actors already possess encrypted datasets and await the ability to break that encryption.

Governments worldwide and a few big tech companies such as IBM and Google are investing heavily in quantum computing research.

“In India, government laboratories, academic institutions, the Department of Science and Technology, MeitY, and various state governments have taken the lead in advancing quantum computing,” said lead of IBM Quantum India L Venkata Subramaniam. “The National Quantum Mission, with an allocated budget of ₹6,000 crore, aims to elevate India’s capabilities to a level where it can lead in select quantum technologies. With major industry players like TCS and L&T now participating in the Quantum Valley Tech Park in Amaravati and a growing number of startups engaging in research and development, India is well-positioned not only to harness the potential of quantum technologies but also to address the critical cybersecurity challenges they present.”

While quantum computing is in early research stages, organizations must not be complacent or wait for the technology to fully emerge. Adversaries are already harvesting enterprise data for future post-quantum decryption, as the technology, once available, could break traditional asymmetric encryption in minutes.

With adversaries executing “harvest now, decrypt later” attacks, the immediate threat highlights the need for enterprises to act now and transition to post-quantum cryptography, or PQC, algorithms to protect their data and maintain security. According to ISACA findings, 56 per cent are concerned about harvest now, decrypt later attacks.

In a video interview with ISMG, vice president analyst at Gartner, Bart Willemsen said, “Harvest now, decrypt later means if it’s currently encrypted, they just store it. They see quantum come the same way we do, but they are probably a little bit more serious, so that by the time they can decrypt this, there’s a third wave, and this is going to hurt. You may be too late to prevent what is coming, so complacency [to adopting PQC algorithms] cannot be an excuse.”

Quantum Preparedness Still Low

Despite quantum computing’s transformative potential, the ISACA survey shows many organizations are still slow to act.

Almost 19 per cent of respondents in India admitted they have no awareness of their company’s planned or current use of quantum computing;

A striking 33 per cent confirmed their companies have not discussed quantum computing yet;

Nearly 40 per cent of organizations in India believe the transformative potential of quantum computing will be realized within the next five years, underscoring the urgency of action.

“Many organizations underestimate the rapid advancement of quantum computing and its potential to break existing encryption,” ISACA Board Director Jamie Norton said. “They need to start examining whether they have the expertise to implement post-quantum cryptography solutions now to ensure they are able to effectively mitigate its impacts.”

When it comes to formal strategic planning, the gap is even more evident:

• Only 9% of organizations in India consider quantum computing a high-priority area for near-term planning;
• 25% have placed it on their long-term road map;
• 33% report that the topic hasn’t been discussed at all within their organizations.

What Should Organizations Do?

Although the timeline for realizing the transformative power of quantum computing is uncertain, organizations must shift their focus toward proactive readiness and workforce upskilling to secure digital assets and confidently embrace this technological shift. They should assess regulatory and compliance requirements as well as invest in quantum-safe cryptographic solutions.

For organizations beginning to move toward quantum readiness, ISACA’s recommended focus areas highlight the complexities of this emerging technology:

*38% are assessing regulatory and compliance implications;

*36% are exploring quantum-safe cryptographic solutions;

*36% are collaborating with quantum hardware and software providers or consortia;

*32% are providing staff training and upskilling in quantum computing;

*28% are investing in research, development and proof-of-concept projects.

This data underscores the urgent need for proactive planning and puts a greater emphasis on upskilling, especially as the global race for quantum resilience gains momentum. Fifty-two per cent of respondents said quantum computing will change the skills businesses require.

“It’s concerning that 38 per cent of organizations have not even begun to take steps to prepare for quantum computing, and even more telling that only 43 per cent of Indian IT and cybersecurity professionals have a clear understanding of quantum computing’s capabilities. This highlights an urgent need for awareness and skill-building across India’s tech ecosystem,” said director and co-founder of Versatilist Consulting India and ISACA India Ambassador R.V. Raghu.

Chief security officer at Keyfactor, Chris Hickman advises organizations to focus on three key areas when planning a post-quantum algorithm migration: First, develop policies that reflect what algorithms should be used to protect organizational data as well as to develop a cryptographic inventory. “The organization should be aware of where their cryptographic assets lie and how they can potentially be transitioned at a point in time in the future. Then begin testing and looking at the impacts of using post-quantum cryptography in the organization, as it relates to things like key size and bandwidth constraints. Also, get familiar with some of those new nuances that could impact the organization,” Hickman said.

In a LinkedIn post, lead professional services consultant at Thales, Aadil Nabi outlined six steps to help organizations begin their preparation for PQC.

Nabi summed it up well: “PQC isn’t about panicking – it’s about preparing. The decisions you make today will determine whether your data remains secure in 10, 15 or 20 years. Organizations that wait for quantum computing to ‘go mainstream’ may find themselves scrambling to catch up. Those who plan ahead? They’ll be the ones setting the standards.”