Quantum security is on everyone's lips – but between the hype and horror stories, there are many misunderstandings lurking. Thomas Lebeth dispels five myths and explains why he believes hybrid approaches and a cool head are the best security strategy.
As we all know, the IT world is changing rapidly. I have been involved in it for a long time—long enough to see trends come and go just as quickly. But when it comes to quantum computing, I have felt for years that this is more than just a passing fad. These new computing giants open up fascinating possibilities—and at the same time challenge us to rethink data security. But we won't overcome this challenge with alarmism, but with a cool head, curiosity, and a clear strategy. It is crucial to closely follow technological developments without being driven by them – and to choose paths that are bold, feasible, and effective at the same time.
Myth 1: Quantum computers will crack all encryption tomorrow
My assessment: Awareness and strategic planning must take place across the entire company – not just in the server room. Why? Quantum security is not just cryptography – it is risk and reputation protection. “Store now, decrypt later” attacks make today's data vulnerable tomorrow – and that applies to HR data as well as confidential contract documents or research projects. If this information falls into the wrong hands, the consequences are not only technical, but business-critical. That's why quantum security belongs on the agenda of senior management and in every department that works with sensitive data. Quantum security is not an IT problem. It is a business risk – and a management task.
Myth 2: Post-quantum cryptography (PQC) is the panacea
Clarification: PQC is a crucial component, but it is by no means the entire solution. The new quantum-resistant methods replace classic algorithms – but these too must be tested, standardized, and implemented. NIST has published the first PQC standards, including ML-KEM (FIPS 203) and ML-DSA (FIPS 204). This is an important milestone, but it does not yet guarantee seamless practical readiness. https://nvlpubs.nist.gov/nistpubs/fips/nist.fips.203.pdf
My assessment: New cryptography must prove itself in tough everyday use under high loads, in complex architectures, in legacy environments, and in interaction with hardware. This is precisely why experts are currently relying on hybrid methods that combine PQC with proven, classic methods. This dual strategy creates robustness, even if vulnerabilities should still appear in individual new methods.
Myth 3: The top solution, “quantum key distribution,” is out of reach for most people
Clarification: Quantum key distribution (QKD) uses the laws of quantum physics to transmit key material in a physically tap-proof manner—typically via photons in fiber optics. This makes QKD technically sophisticated, but by no means “magical.” In addition to Europe-wide programs such as EuroQCI, which are driving the development of a quantum-secure communications infrastructure, the first pilot projects are now underway with public authorities, critical infrastructures, and large enterprise customers. These tests show that QKD can already be evaluated in a practical setting, technically integrated, and operated in real networks. The technology is thus clearly moving from research to application. https://digital-strategy.ec.europa.eu/de/policies/european-quantum-communication-infrastructure-euroqci
My assessment: QKD is not an exclusive toy of the future – rather, alongside PQC, it is another building block in modern, hybrid security architectures. I currently see the use of QKD explicitly for optical data connections on Layer 1 as a door opener for new security architectures, especially in critical infrastructures and backbone connections. With increasing availability and falling costs, QKD is also becoming feasible for medium-sized scenarios. Managed services are the real game changers: they deliver the benefits of QKD without high investment, complex operation, or maintenance costs—security as a service instead of a hardware project.
Myth 4: Companies must change everything immediately
My assessment: The key lies in a structured roadmap with clear priorities and transition strategies. A sensible starting point is to secure core networks with high data throughput—here, Layer 1 encryption and PQC can be used to create a robust foundation without immediately affecting the entire IT architecture. Additional layers can then follow step by step. This keeps the transition manageable without risking security gaps. Those who plan crypto-agile can react flexibly and are well prepared when new standards or technologies are introduced.
Myth 5: Quantum security only affects the IT department
Clarification: Quantum security is not purely a technical issue, but rather a strategic corporate task. It affects management, compliance, data protection, and every department that works with confidential data.
My assessment: Awareness and strategic planning must take place across the entire company – not just in the server room. Why? Quantum security is not just cryptography – it is risk and reputation protection. “Store now, decrypt later” attacks make today's data vulnerable tomorrow – and that applies to HR data as well as confidential contract documents or research projects. If this information falls into the wrong hands, the consequences are not only technical, but business-critical. That's why quantum security belongs on the agenda of senior management and in every department that works with sensitive data. Quantum security is not an IT problem. It is a business risk – and a management task.
Conclusion
Quantum security is no reason to panic – but it's also not something to be put off until “sometime in ten years.” Those who wait until the 2030s will be giving attackers a head start of several years. By then, hackers will definitely have made good use of their time.
The good news is that those who act strategically, step by step, and crypto-agilely now will have less stress later – especially if things turn out to be more serious than expected. Hybrid solutions, roadmaps, and strategic partnerships are the way to a secure future.
Dr. Thomas Lebeth, Vice President Advanced Technologies & Innovation, dacoso
Thomas is an electrical engineer with a PhD in the history of technology and has been firmly rooted in the world of optical networks and encryption solutions for decades. He has found a new domain in quantum security—and set us on the path to future-proof security architectures at an early stage.
At many events hosted by our research and technology partners, he explains complex quantum technology with technical depth, a keen sense of what is feasible, and his unmistakable Viennese charm.
