Quantum Computing Is Arriving Faster Than Expected

Hi there, Basestone subscriber! 👋

Today we're talking about why the timeline for practical quantum computers keeps getting shorter, and what's already starting to happen here in Korea to get ready for it 🔐

📌 Today's post, at a glance

• Harvard Quantum Initiative (HQI): large-scale quantum computers are now expected 5 to 10 years earlier than previously projected
• Stanford researchers published a room-temperature quantum entanglement device in Nature Communications, no extreme cooling required
• Three commercial quantum computing startups (QuEra, LightSynQ, CavilinQ) have already shipped systems, moving the field into commercialization
• Korea's own Quantum Technology Industry Act cleared a Cabinet meeting on May 12, putting mandatory quantum security systems for public agencies on the calendar

Over the course of May, the quantum computing field produced a string of results that push the timeline for practical use forward. One is a shift in when it will arrive; the other is a drop in the technical barrier around how to build it. Put the two together, and security teams have less room to keep delaying PQC (post-quantum cryptography) migration.

The real question is not exactly when a quantum computer will appear. It is deciding, right now, how many years the data you are encrypting today actually needs to stay safe. Without an answer to that question, PQC migration stays a vague task with no clear priority.

🔍 What happened

A breakthrough in fault tolerance, from Harvard

A team at the Harvard Quantum Initiative, led by Professor Mikhail Lukin, reported a breakthrough in fault-tolerance technology. Lukin said the technology is now "likely to be realized in some form by the end of this decade," and the team now expects large-scale quantum computers to arrive 5 to 10 years sooner than earlier estimates. The report explicitly named codebreaking and national security among the technology's applications.

A room-temperature quantum device, from Stanford

On May 30, a Stanford team published a nanoscale optical device in Nature Communications that combines a molybdenum diselenide (MoSe₂) film with a nanopatterned silicon substrate. The device uses "twisted light" to create quantum entanglement between photons and electrons, and unlike earlier quantum computers, which only worked near absolute zero (around minus 459°F), it works at room temperature. Lead author Feng Pan explained that the nanostructures spin photons into a helical path that affects electron spin. Lower cooling costs and simpler hardware could accelerate how fast quantum technology spreads.

🇰🇷 Korea is moving too

This isn't only happening in overseas labs. On May 12, an amendment to Korea's Act on the Promotion of Quantum Science, Technology and Industry (informally, the Quantum Technology Industry Act) cleared a Cabinet meeting. It mandates that the central government, local governments, and public institutions build out quantum security systems, and requires the defense, telecom, and finance sectors to complete a pre-check before the rules apply to them. The law takes effect six months after promulgation, and its stated background cites both recently prominent AI-driven hacking threats (such as the Mythos family) and explicit concern that quantum computing could render existing cryptographic systems obsolete.

There's a number behind the readiness gap, too. Only two Korean vendors currently hold KCMVP certification for post-quantum cryptography: Hancom WITH (January 2025) and XGate (April 2026). The law's mandate covers central agencies, local governments, and public institutions numbering in the hundreds, which means certified product supply is only just getting started. If the overseas research is pulling forward the "when" of quantum computing's arrival, Korea's own situation illustrates the "how fast can we actually get ready" supply bottleneck sitting right behind it.

🧭 Why it matters now

The Harvest Now, Decrypt Later threat

Both results push quantum computing's arrival forward on two fronts at once: when it happens and how it gets built. For security teams, the part that deserves the most attention is the Harvest Now, Decrypt Later threat: an attacker steals encrypted data today and simply waits, decrypting it later once a sufficiently powerful quantum computer exists. The earlier that moment arrives, the longer your sensitive data in long-term storage today (contracts, medical records, intellectual property) stays exposed.

"There's no standard yet" is no longer an excuse

One common reason teams delay PQC migration is that "the standards aren't finalized yet." That's no longer true. NIST formally approved three post-quantum cryptography standards on August 13, 2024: ML-KEM (FIPS 203) for key exchange, ML-DSA (FIPS 204) for digital signatures, and SLH-DSA (FIPS 205), a hash-based signature scheme. With standards to replace RSA and ECC already in hand, the remaining question isn't "when will a standard exist," it's "when do we apply it to our systems."

There are already hard deadlines on the calendar

The US National Security Agency's CNSA 2.0 guidance sets concrete migration deadlines for National Security Systems. Software and firmware signing, along with traditional networking gear like VPNs and routers, must move to PQC exclusively by 2030; web browsers, servers, cloud services, and operating systems have until 2033. Korea's mandate for public-sector quantum security systems runs in the same direction as this broader international push. The answer to "by when" already exists in multiple places.

Today's public-key cryptography, RSA and ECC included, can be broken by a sufficiently powerful quantum computer, and starting migration now is a far safer strategy than trying to predict the exact date that happens.

✅ Five things to check before starting PQC migration

• Have you listed the storage locations and retention periods for sensitive data you must keep for 10+ years (contracts, medical records, IP) — harvest-now-decrypt-later attacks get riskier in direct proportion to how long that list is
• Have you tabulated, algorithm by algorithm, which of those data sets are protected by quantum-vulnerable algorithms like RSA or ECC
• Does your migration roadmap toward NIST-standardized PQC algorithms (ML-KEM, ML-DSA, SLH-DSA) include a concrete target completion year, or is it still stuck at "under review"
• Have you pre-mapped the scope of systems affected (APIs, internal network, partner integrations) when you swap out cryptographic libraries and certificates
• If you're a Korean government body, local government, public institution, or in defense, telecom, or finance, have you counted backward from the Quantum Technology Industry Act's effective date (six months after promulgation) to build a response timeline

⚠️ What teams commonly miss

Assuming there is still time is itself the risk

Under the Harvest Now, Decrypt Later threat, waiting for quantum computers to arrive is not a strategy at all. If the data you are encrypting today needs to stay safe for 5 or 10 years, migration has to finish within that window.

The temptation to skip hybrid migration

Swapping legacy algorithms for PQC all at once creates compatibility problems fast. Running legacy and PQC algorithms in parallel through a hybrid approach, and migrating in stages, keeps operational risk much lower.

"The moment your PQC migration finishes should never come later than the moment a quantum computer can actually break your encryption." — Basestone Quantum Security Lab

🚀 How to start small

Pick just one category of data that needs the longest retention, and check which algorithm protects it and how long it needs to stay safe. Getting that single point right already makes your migration priorities far clearer.

If you would also like to look at this month's other security incidents, read the May 2026 security incident roundup next.