Your Company May Never Use Quantum and Still Be Exposed to It

Middle-market leadership teams have spent the last three years building AI fluency; sometimes reluctantly, sometimes enthusiastically, but building it nonetheless. Boards ask about AI governance. Management teams pilot AI tools in operations and finance. That work is gaining momentum and needs to continue.

Most middle-market companies do not need a quantum computing strategy today. They do need to understand where quantum could reach them, because their first exposure may arrive through their data, vendors, customers, or investors long before they ever run a quantum workload.

But a second technology shift is now underway that most middle-market companies are either filing in the same mental folder as AI, or thinking of it as off in the future, and both are mistakes worth correcting before it costs something. For boards, this is an oversight and visibility question. For management, it is an ownership and dependency question.

Commercial Activity is Growing – But Unevenly

Quantum technology moved onto the management agenda in 2026. McKinsey partner Henning Soller stated: this is the year quantum computing turns from a technological promise into a strategic management question that is no longer primarily about whether the technology works, but about which companies are building the skills and partnerships to capture advantage from it. Investment in quantum technology start-ups reached $12.6 billion in 2025, more than six times the prior year's total, and more than 300 organizations, including Airbus, JPMorgan Chase, Boehringer Ingelheim, and Liberty Mutual, are now actively working with quantum vendors, moving from pilots into embedded workflows.

Notice who's not on that list - middle-market companies. Roughly a third of the companies McKinsey studied allocate more than $10 million annually to quantum initiatives; that is large-enterprise territory, for now. The gap isn't a problem; most middle-market companies have no near-term case for owning quantum infrastructure. The problem is what the gap is doing to attention: because quantum looks technically remote, it's treated as strategically irrelevant. That is the risk.

Why Quantum Isn't "More AI"

AI, in the form most companies are adopting, uses classical computing to learn patterns, generate outputs, and support decisions, often producing results that would be difficult to achieve through explicit, rules-based programming. The underlying computation is still “classical”, as it is an extension of what computers already do, applied more powerfully than before.

Quantum computing changes the underlying computational method itself. For a specific and growing class of problems, ones whose complexity grows faster than any classical machine can search through, it may eventually make certain calculations feasible that remain impractical for even the most powerful systems today. That potential is still transitioning from research into early commercial pilots. Broad, proven quantum advantage on everyday business problems hasn't arrived – yet. Which is exactly why treating this as an urgent today-problem OR treating it as a someday-irrelevant problem are both mistakes.

Two Different Questions, Not One

Once you separate AI from quantum, it helps to split quantum itself into two different management questions as they apply to very different companies on very different timelines.

The first is selective: could quantum eventually change what your company can model, optimize, or discover, such as in scheduling, materials, logistics, or complex risk modeling? This depends largely on your industry, and for most middle-market companies, it's a "watch" item, not an active one.

The second is nearly universal: how long does your company's sensitive information need to stay confidential, and is the technology protecting it prepared for a future where today's encryption can be broken? This applies to everyone, regardless of industry, and it's the track most middle-market companies are missing entirely, because they've filed all of "quantum" under the first question, decided it doesn't apply to them, and stopped there.

A company with no plausible quantum optimization use case can still have real quantum exposure. That distinction is critical to understand before deciding this doesn't apply to you.

What This Actually Opens Up

On the opportunity track, none of this requires a middle-market company to build or buy quantum infrastructure. Quantum is emerging the way AI did: as a cloud service, not a capital purchase. Companies in optimization-heavy industries are already running early hybrid classical-quantum pilots through cloud providers, with no infrastructure investment required.

The nearer-term advantage may not come from adopting quantum first. It may come from being able to distinguish a material exposure from a speculative one—and answer a customer, investor, or acquirer with evidence rather than general assurances.

And on the security track, the migration ahead is an opportunity rather than only a cost: preparing for it means inventorying where and how encryption is used across the business. A useful process that routinely surfaces other security gaps companies didn't know they had.  

The Clock Is Ticking

This is where the security track gets concrete. The clearest near-term signal isn't a proven date for a quantum breakthrough; it's that major infrastructure providers are accelerating their own migration plans. Google recently moved up its internal target for post-quantum readiness to 2029, well ahead of NIST's broader transition path, which anticipates phasing out quantum-vulnerable algorithms between 2030 and 2035. Google describes 2029 as the point at which its own readiness efforts converge, not a universal deadline every company now faces, but Brian LaMacchia, who led Microsoft's post-quantum transition for years, called the acceleration significant, ahead even of what the U.S. government has asked for. When a company that size moves its own target up, that is a useful signal, whatever your timeline ends up being.

Here's why this matters now, not in 2029: think of today's encryption as a locked box. Nobody has a key that opens it yet. The concern isn't that someone opens it today — it's that an adversary can copy the locked box today, put it on a shelf, and wait for a key to exist. Security researchers call this "store now, decrypt later," and it's why Google's own security team treats this as an active concern now, not a 2029 concern.

The practical implication is narrower than "everything is already at risk." It depends on whether information is transmitted or stored in a form that could be captured today, whether it relies on the kind of public-key encryption quantum computing threatens, and how long it needs to stay confidential. The longer something needs to remain secret such as long-term contracts, IP, M&A materials, regulated customer data- the more this applies, because the exposure window opens the moment the data is captured, not the moment a quantum computer capable of decrypting it exists. You may have read about companies reporting cyberattacks with massive data exposure; the concern is that an adversary could capture encrypted data now and retain it until decryption becomes feasible.

It's Probably Not Your Job to Fix This Alone

Most middle-market companies will not perform the cryptographic migration alone, because they don't run their own cryptographic infrastructure; that’s their cloud provider, SaaS vendors, payment processors, identity providers, and certificate management systems do. That means the first move usually isn't a technical project. It's a vendor conversation: asking the companies already sitting inside your infrastructure what their post-quantum roadmap is, and when. But relying on vendors changes the management task; it does not eliminate it.

That's a manageable first step that is closer to the vendor due diligence most middle-market companies already know how to do, and points at a question they haven't asked yet.

When This Moves Up Your Agenda

Not every middle-market company needs to treat this as urgent, but it needs to be on your radar. It matters more, sooner, if: your information needs to stay confidential for7+ years; you handle regulated, healthcare, financial, or sensitive customer data; you depend heavily on a handful of cloud or infrastructure vendors; or you're heading into a sale, financing, or diligence process where a buyer might test for this. If none of those apply yet, this is a "keep watching" item, not a "start a program" item.

Questions Worth Asking Now

This is groundwork, not a full governance framework — that's a conversation for its own post.

For the board (oversight):

• Which committee currently oversees emerging-technology risk — and does that mandate include quantum, or does "emerging technology" quietly mean AI only?

• How would this reach the full board if it became strategically material — through a customer requirement, a vendor announcement, or a diligence process?

Has quantum exposure been explicitly considered within cybersecurity or emerging-technology risk, or does the board assume it is covered without having tested that assumption?

For the CEO (ownership):

• Who owns the assessment, and has an executive been asked to look at this, even informally?

• Does the company know whether a cryptographic inventory exists, or whether one would need to be built from scratch?

• If a customer, lender, or acquirer raised post-quantum readiness in a diligence conversation tomorrow, who would answer, and what would they say?

None of this requires a quantum program or a new executive hire. It requires a named owner, an initial look at where the company’s exposure sits, and enough visibility to know whether more work is warranted. For most middle-market companies, that first step hasn't happened.

The next question is what proportionate readiness looks like for a company that does not need, and should not build, a full quantum strategy.