Microsoft Is Preparing for the Next Generation of Cyber Threats. Is Your Business Ready?

Cybersecurity threats are constantly changing. Just when businesses feel confident about their security measures, new technologies emerge that could change how information is protected.

One of the biggest changes on the horizon involves quantum computing.

You may have heard the term before. Quantum computers are often discussed as powerful new machines that could solve complicated problems much faster than the computers we use today.

But there is another side to this technology that deserves attention.

Quantum computing could eventually make some of today’s most widely used encryption methods ineffective.

That means information we currently consider secure could become vulnerable in the future.

Microsoft is already preparing for this possibility by accelerating its work on something called post-quantum cryptography.

While the threat may still be years away, Microsoft’s preparations highlight an important lesson for businesses of all sizes: Effective cybersecurity requires planning for tomorrow’s risks, not just responding to today’s problems.

For small and medium-sized businesses, understanding what is changing and how it might affect their technology is an important part of maintaining long-term security.

Understanding How Encryption Protects Your Business

Before exploring quantum computing, it helps to understand how encryption works and why it matters.

Encryption is one of the most important technologies used to protect digital information.

Every day, businesses rely on encryption without necessarily realizing it.

When employees connect to secure websites, access cloud applications, send confidential information, or connect remotely to company networks, encryption often plays a role in protecting those activities.

The basic concept is relatively simple.

Encryption takes readable information and transforms it into something that appears meaningless to anyone who does not have the correct method or key to unlock it.

Imagine sending a confidential business document through the internet.

Without encryption, someone who intercepts that information might be able to read its contents.

With properly implemented encryption, the intercepted information would be extremely difficult to understand without the necessary decryption key.

Modern encryption uses mathematical problems that are extraordinarily difficult for conventional computers to solve.

Some methods protect stored information, while others help establish secure connections or verify digital identities.

For example, public-key encryption and related security technologies help protect information exchanged between systems.

Many of these technologies rely on mathematical problems that today’s computers cannot solve within a practical amount of time.

This mathematical difficulty is part of what makes modern encryption effective.

However, the arrival of sufficiently powerful quantum computers could change that situation.

What Makes Quantum Computers Different?

Traditional computers process information using bits.

A bit represents one of two possible values: zero or one.

Every computer application, document, website, and digital service ultimately depends on operations involving these bits.

Quantum computers work differently.

They use something called quantum bits, or qubits.

Unlike traditional bits, qubits can exist in combinations of states through a property known as superposition.

Quantum computers also use other quantum properties, including entanglement, to perform certain types of calculations.

This does not mean quantum computers will automatically be faster at everything.

For everyday activities such as writing emails, creating spreadsheets, or browsing websites, traditional computers will continue to be highly effective.

Quantum computing offers potential advantages for specific kinds of mathematical and scientific problems.

These include certain calculations used in chemistry, materials research, and cryptography.

Unfortunately, some of the mathematical problems underlying today’s public-key encryption systems fall into this category.

A sufficiently powerful quantum computer could potentially break certain encryption methods that currently protect sensitive information.

That possibility is why technology companies and cybersecurity researchers are already preparing.

Why Quantum Computing Could Become a Cybersecurity Problem

Many modern security systems depend on encryption methods that are considered extremely difficult for conventional computers to defeat.

For example, RSA encryption relies on mathematical problems involving very large numbers.

Other widely used public-key systems rely on mathematical challenges associated with elliptic curves.

With today’s conventional computing technology, breaking properly configured versions of these systems through direct mathematical attacks is generally impractical.

However, researchers have known for decades that a sufficiently capable quantum computer could solve some of these problems much more efficiently.

A quantum algorithm known as Shor’s algorithm demonstrated the theoretical possibility of breaking certain public-key cryptographic systems.

The important distinction is that today’s quantum computers are not yet capable of carrying out these attacks against the strong encryption systems widely used in business.

Building a quantum computer capable of doing so remains an enormous technical challenge.

Quantum systems are sensitive to errors, and researchers are still working to develop machines that can perform large, reliable calculations.

Nobody knows exactly when a quantum computer capable of breaking widely deployed public-key cryptography will become available.

It could take many years.

Nevertheless, governments, security researchers, and technology companies are taking the possibility seriously.

The reason is simple: Replacing major security technologies takes time.

Waiting until quantum computers become an immediate threat could leave organizations without enough time to make the necessary changes.

Microsoft’s Plan to Prepare for Quantum Threats

Microsoft is among the major technology companies working to prepare its products and services for future quantum computing risks.

Its approach involves adopting security technologies designed to remain effective against attacks from both conventional and quantum computers.

This field is known as post-quantum cryptography, sometimes called quantum-resistant cryptography.

The goal is to introduce new mathematical methods that do not depend on the same problems vulnerable to known quantum attacks.

Microsoft has indicated that it wants its major services prepared for this transition before the end of the decade.

That is an ambitious objective because encryption is deeply integrated into modern technology.

It is not simply a matter of installing a new security application.

Encryption affects how systems communicate, how software is verified, how users authenticate, and how information is protected.

Making these changes involves updating security protocols, operating systems, cloud platforms, applications, and other technologies.

It also requires careful testing.

New cryptographic methods must work reliably across different devices and services.

They must maintain appropriate security while avoiding unnecessary performance problems.

Most importantly, the changes must be introduced without disrupting the systems businesses depend on.

Microsoft’s work reflects a broader effort across the technology industry to prepare for a future where existing security methods may no longer provide sufficient protection.

What Is Post-Quantum Cryptography?

Post-quantum cryptography involves developing and using encryption and digital signature methods designed to resist attacks from quantum computers.

It is important to understand that these methods do not require quantum computers to operate.

They run on the conventional computers, servers, and devices businesses already use.

The difference is in the mathematics.

Instead of relying on problems that could be solved efficiently by certain quantum algorithms, post-quantum systems use alternative mathematical approaches.

Researchers believe these approaches will be much harder for both conventional and quantum computers to defeat.

One important development occurred in August 2024.

The United States National Institute of Standards and Technology (NIST) published its first three finalized post-quantum cryptography standards.

These standards provide an important foundation for organizations developing the next generation of secure systems.

They include:

• ML-KEM: A method used to establish shared encryption keys securely between systems.
• ML-DSA: A digital signature method designed to help verify authenticity and protect information from unauthorized changes.
• SLH-DSA: Another digital signature method that uses a different mathematical approach.

These technologies are intended to replace or supplement security methods that may become vulnerable to quantum attacks.

However, adopting new cryptography is a gradual process.

Organizations need to understand where existing encryption is used, determine which systems need changes, and verify that new technologies work correctly.

It is also worth noting that quantum-resistant does not mean permanently unbreakable.

New cryptographic methods will continue to undergo testing and analysis as researchers learn more about their strengths and weaknesses.

The Hidden Risk: Harvest Now, Decrypt Later

One of the most concerning possibilities associated with quantum computing is a strategy known as harvest now, decrypt later.

This concept is particularly important because it means future quantum threats could create risks for information being transmitted today.

Consider a business that sends sensitive information through an encrypted internet connection.

The encryption may be strong enough that an attacker cannot read the information using current technology.

However, the attacker might still capture and store encrypted communications.

At the moment, those recordings could be useless because the attacker cannot decrypt them.

But what happens if quantum computing eventually becomes powerful enough to break the encryption used to protect that information?

The attacker could potentially return to the stored data and decrypt it years later.

This creates a problem for information that must remain confidential for extended periods.

Examples could include employee records, sensitive financial information, legal documents, intellectual property, and confidential business agreements.

Not every type of encrypted information is equally vulnerable.

The risk depends on the encryption methods used, how the connection was established, and whether the attacker captured enough information to attempt decryption later.

Nevertheless, the possibility is significant.

Information that is secure against today’s attacks may not necessarily remain secure against tomorrow’s technology.

This is one reason security experts are encouraging organizations to begin evaluating their long-term cryptographic risks.

Why Digital Certificates Matter

Another important part of the transition involves digital certificates.

Most people encounter digital certificates every day without knowing it.

When you visit a website that uses HTTPS, your browser normally checks a digital certificate as part of establishing a secure connection.

That certificate helps establish that the website is associated with the expected domain and is presenting appropriate cryptographic credentials.

Digital certificates also play important roles in software signing, identity verification, and secure communications between systems.

They help establish trust.

For example, digitally signed software allows a device to verify that a software package was signed by the expected publisher and has not been altered since signing.

Many certificate systems depend on cryptographic algorithms that could eventually become vulnerable to quantum attacks.

That means preparing for quantum computing involves more than protecting information from unauthorized access.

It also involves ensuring that systems can continue verifying identities, authenticating software, and establishing trustworthy connections.

For businesses, these technologies are mostly invisible.

They operate in the background of operating systems, applications, cloud services, and network connections.

However, they are essential to keeping modern digital environments secure.

Does Your Business Need to Worry About Quantum Computing Today?

For most small and medium-sized businesses, quantum computing does not represent an immediate threat requiring emergency technology replacements.

There is no reason to assume that existing security systems have suddenly become ineffective.

Strong encryption remains an essential part of modern cybersecurity.

The important point is that businesses should begin understanding how their technology may need to change over time.

Organizations that manage highly sensitive information requiring decades of confidentiality may have more immediate reasons to evaluate quantum-related risks.

For a typical business with 5 to 200 employees, the most useful starting point is understanding its current security environment.

That includes knowing which systems are being used, whether those systems are supported, and how the business manages security updates.

Businesses should also understand which third-party providers are responsible for protecting sensitive information.

For example, a company may use Microsoft 365, cloud-based accounting software, customer relationship management applications, and external backup services.

Each service has its own security architecture and responsibilities.

As post-quantum technologies become more widely available, many changes will likely arrive through updates from established technology providers.

Businesses will still need to ensure that their devices, applications, and network infrastructure support these improvements.

That process will be easier for organizations that already maintain their technology properly.

Five Practical Steps Businesses Can Take Now

Although quantum computing may not be an urgent threat, it provides an opportunity to review cybersecurity practices that already matter today.

The following steps can help businesses improve their current security while preparing for future changes.

1. Keep Operating Systems and Applications Updated

Security updates do more than fix visible software problems.

They frequently address vulnerabilities that attackers could exploit to access systems, steal information, or interrupt business operations.

Regular updates also introduce compatibility improvements and new security technologies.

As quantum-resistant cryptography becomes more common, software updates will likely play an important role in delivering these improvements.

Businesses that consistently update their systems will generally be better positioned to adopt new security standards.

This includes computers, servers, mobile devices, network equipment, and business applications.

A reliable update process should also include checking whether updates have been installed successfully.

Simply enabling automatic updates does not guarantee that every device is fully protected.

2. Identify and Replace Unsupported Technology

Older technology can create serious security problems.

When a manufacturer stops supporting an operating system, application, or network device, security vulnerabilities may remain unpatched.

Attackers can take advantage of those weaknesses.

Unsupported systems can also become difficult to integrate with newer security technologies.

For example, an older network appliance may not support modern encryption protocols or updated authentication methods.

Businesses should maintain an inventory of their technology and understand when important systems will reach the end of their supported lifespan.

This allows replacement projects to be planned rather than rushed.

Replacing technology before it becomes a major risk is usually less disruptive than responding to an unexpected security incident.

3. Review How Sensitive Information Is Protected

Not all business information requires the same level of protection.

A public marketing brochure does not carry the same risk as employee payroll records or confidential customer information.

Businesses should identify the types of sensitive information they collect, store, and transmit.

They should also understand where that information is located.

Is it stored on local servers?

Does it reside in cloud applications?

Is it shared with external service providers?

How long does the business need to retain it?

These questions help determine the appropriate security controls.

They also become increasingly important when considering information that must remain confidential for many years.

For Canadian businesses, privacy obligations may also apply under federal or provincial legislation.

Organizations in British Columbia, for example, may have responsibilities under the province’s Personal Information Protection Act (PIPA), depending on their activities.

Understanding these obligations helps businesses make informed decisions about data protection and retention.

4. Maintain Reliable Backups and Recovery Plans

Backups remain one of the most important parts of a cybersecurity strategy.

They help businesses recover from hardware failures, accidental deletions, ransomware attacks, and other incidents that could result in data loss.

A good backup strategy should consider more than whether copies of files exist.

Businesses should understand where backups are stored, who can access them, how frequently they run, and how quickly information can be restored.

Backups should also be protected against unauthorized changes and deletion.

For example, keeping appropriately secured backups separate from production systems can reduce the risk that a single attack affects both the original information and its copies.

Regular recovery testing is equally important.

A backup system provides limited value if nobody knows whether it can successfully restore the information the business needs.

Quantum computing does not change these basic principles.

Instead, it reinforces the importance of building security systems that can adapt to future risks.

5. Work With Technology Providers Who Plan Ahead

Most small and medium-sized businesses do not have dedicated cybersecurity research teams.

They depend on technology providers, software vendors, and managed IT service providers to help them understand changing security requirements.

That makes long-term technology planning especially important.

Businesses should ask their technology providers how they manage security updates, monitor emerging risks, and evaluate new technologies.

As post-quantum standards become more widely adopted, organizations should also understand how their providers intend to support the transition.

This does not mean every business needs a detailed quantum computing migration plan immediately.

However, businesses should be confident that their technology environment is being maintained with future compatibility and security requirements in mind.

Building a Cybersecurity Strategy That Can Adapt

One of the most important lessons from Microsoft’s preparations is that cybersecurity cannot remain static.

Technology changes.

New vulnerabilities are discovered.

Attackers develop different techniques.

Regulatory requirements evolve.

And technologies that were once considered secure may eventually require replacement.

A strong cybersecurity strategy needs to account for these changes.

This involves regularly reviewing security policies, assessing technology risks, and updating systems before weaknesses become serious problems.

It also means understanding that security is an ongoing process rather than a one-time purchase.

A business may invest in excellent security technology today, but that investment will gradually become less effective if systems are not maintained.

The same principle applies to employee training, access controls, authentication methods, and data protection practices.

For example, multi-factor authentication continues to be an important defence against unauthorized account access.

Access permissions should also be reviewed regularly so employees only have access to the systems and information necessary for their responsibilities.

Security monitoring can help identify suspicious activity before it develops into a larger incident.

Together, these practices create layers of protection.

This layered approach is important because no single security technology can eliminate every potential threat.

Businesses are generally better protected when several security controls work together and are reviewed regularly.

That remains true whether the threat involves ransomware, phishing, stolen credentials, or future advances in quantum computing.

Why Planning Ahead Is More Important Than Predicting the Future

It would be useful to know exactly when quantum computers will become powerful enough to threaten current encryption systems.

Unfortunately, technology rarely develops according to a perfectly predictable schedule.

Researchers may achieve unexpected breakthroughs.

Technical challenges may take longer to overcome than anticipated.

New security methods may also emerge as the field continues to develop.

For business owners, attempting to predict these developments is not particularly useful.

A better approach is to focus on maintaining a flexible technology environment.

That means avoiding unnecessary dependence on outdated systems, keeping software supported, and ensuring technology investments can evolve as requirements change.

It also involves maintaining appropriate documentation.

Businesses should know what technology they use, which services are critical to daily operations, and who is responsible for managing them.

This information becomes valuable whenever a major change is required.

For example, replacing an encryption technology is considerably more difficult when an organization does not know which systems depend on it.

The ability to identify, update, and replace technology efficiently is sometimes referred to as cryptographic agility when discussing encryption systems.

The broader principle applies to almost every part of business technology.

Organizations that understand their systems and maintain them properly are generally better prepared to respond to new developments.

What Should Canadian Businesses Expect Next?

Over the coming years, post-quantum cryptography is expected to become a more common part of enterprise technology.

Major software companies, cloud providers, and cybersecurity vendors are already evaluating and implementing quantum-resistant security methods.

As standards mature and products are updated, businesses may begin seeing these improvements appear in services they already use.

Some changes may happen almost entirely behind the scenes.

Others could require updates to older applications, network devices, or systems that depend on particular cryptographic standards.

The pace of adoption will vary.

Large organizations responsible for protecting sensitive government, financial, or research information may move more quickly because of the long-term confidentiality requirements associated with their data.

Smaller businesses will often depend on the adoption schedules of their software and infrastructure providers.

For Canadian organizations, monitoring guidance from the Canadian Centre for Cyber Security can be a useful way to stay informed about evolving security risks and recommended practices.

Businesses should also pay attention to announcements from their major technology vendors.

The key is to stay informed without making unnecessary or premature investments.

Quantum computing is an important development, but it should be considered alongside the cybersecurity risks businesses already face.

Phishing, ransomware, compromised passwords, unsupported software, and poor backup practices remain immediate concerns.

Preparing for future encryption changes should not distract organizations from addressing those existing weaknesses.

Final Thoughts: Tomorrow’s Cybersecurity Starts With Today’s Decisions

Microsoft’s efforts to prepare for quantum computing demonstrate how far ahead major technology providers sometimes need to plan.

The potential threat to encryption has not yet become a widespread practical reality.

Nevertheless, the possible consequences are significant enough that the technology industry is already working on solutions.

For small and medium-sized businesses, the message is not that quantum computing should suddenly become the highest cybersecurity priority.

Instead, it highlights the importance of maintaining secure, supported, and adaptable technology.

Businesses that understand their systems, apply security updates, protect sensitive information, and maintain reliable recovery plans are better positioned to respond when new threats emerge.

Those same practices reduce exposure to many of today’s most common cybersecurity risks.

The most effective way to prepare for tomorrow’s threats is to build strong cybersecurity foundations today.

Quantum computing may eventually change how digital information is protected, but the need for careful planning, regular maintenance, and informed technology decisions will remain the same.

How Robertson Technology Group Can Help Your Business

At Robertson Technology Group, we understand that small and medium-sized businesses need reliable technology and effective cybersecurity without the complexity of managing everything internally. Based in Victoria, British Columbia, we provide personalized managed IT services, cybersecurity solutions, and ongoing technology support to businesses across Canada. Our approach focuses on understanding each organization’s unique needs and developing practical solutions that support both security and daily operations.

As cybersecurity threats and technologies continue to evolve, we help businesses maintain supported systems, manage security updates, review potential vulnerabilities, and plan for future technology requirements. Whether your organization has five employees or 200, our team works alongside you to help reduce technology risks, improve reliability, and make informed decisions about your IT environment. With proactive support and strategic technology planning, Robertson Technology Group helps businesses establish a stronger foundation for long-term security and growth.