The security industry is once again grappling with the looming threat of quantum computing. Seven years ago, the concern was about Shor's algorithm and its potential to decimate classical encryption. Today, the alarm bells ring louder, but the quantum apocalypse remains a distant prospect. NIST standardized post-quantum algorithms in 2024, and governments are issuing migration roadmaps.

The G7 is pushing for coordinated efforts in financial systems, with various agencies aiming for 'quantum readiness' by 2035. Companies are rolling out quantum-safe VPNs and other tools, yet no machine has demonstrated the capability to run Shor's algorithm against real-world key sizes. The migration to post-quantum cryptography is an immense task.

It affects everything from TLS certificates to embedded devices. Organizations must inventory decades of data and decide what requires long-term confidentiality. The process is costly and error-prone, offering no immediate benefit beyond compliance.

Despite the urgency, the threat of quantum attack remains theoretical, and current passwords are more vulnerable to credential stuffing than to quantum decryption. The author, who wrote a thesis on the topic seven years ago, warns against distraction from hype cycles. While preparing for the quantum threat is necessary, the industry should focus on the incremental work of hardening systems rather than being swayed by annual panic announcements.

The quantum crackers, fashionably late for decades, are not expected to arrive anytime soon.