FS Fast 5: The quantum quandary
Key insights to move your quantum agenda forward in financial services.
A new era of quantum risk
Multiple companies now have roadmaps to error-corrected quantum computers between 2028 and 2030, machines capable of breaking the encryption standards that underpin today’s financial system. The threat is not future: adversaries are already executing “harvest now, decrypt later” attacks, capturing long-shelf-life financial data today for decryption once quantum computers arrive.
Yet quantum readiness is as much a discovery and modernization problem as a cryptography one. Financial institutions run some of the most complex technology environments in the world — legacy mainframes, deeply integrated third-party solutions, and cryptography embedded across applications, databases, and APIs with little documentation. Before you can modernize your cryptographic footprint, you have to find it.
This FS Fast Five session brings together KPMG quantum, cryptography, and cyber risk leaders to demystify the challenge and chart a practical path forward.
Quantum computing has been “five years away” for thirty years, but that era is over.
Key themes: What the discussion covered
1
The threat is now, not future
Quantum computing roadmaps now target error-corrected machines by 2028–2030, and “harvest now, decrypt later” attacks are already capturing long-shelf-life financial data. The threat is active today, not years away.
2
Crypto-agility as target state
Crypto-agility means building architecture where cryptography is separated from application logic — a plug-and-play layer so algorithms can be swapped without tearing apart dependent apps. Most organizations are nowhere near this clean, modular end state yet.
3
Discovery before modernization
For most financial institutions, the hardest part is understanding where cryptography exists today — across applications, databases, APIs, and third-party providers — since most lack a centralized inventory. You can’t migrate what you can’t find.
4
AI compresses the threat timeline
Frontier AI models discover and weaponize cryptographic weaknesses at machine speed, making every unmanaged RSA dependency and incomplete inventory more dangerous today — not in five years. PQC is a resilience capability to build now.
“Post-quantum cryptography isn’t just a get-ready-for-the-future project; it’s a cryptographic inventory, crypto-agility, and resilience capability that you need to start building right now, because AI is going to keep surfacing those weaknesses faster than your team can track them.”
Dr. Lekshmy Sankar Quantum Implementation Lead, Post-Quantum Cryptography, KPMG LLP
5
The talent and resource gap
With only an estimated 16,500 quantum researchers worldwide, the talent shortage is acute and will intensify as demand scales.1 Competing budget demands between AI and quantum readiness push the agenda further down the priority list.
6
Regulatory pressure is building
Regulators at federal and state levels are shifting from “why should we care” to “how are you preparing,” with exploratory questions that historically evolve into formal expectations. Waiting for a mandate would be a mistake.
“It would be a mistake to wait for a formal regulatory mandate before taking action. Those that start sooner will likely see lower overall costs and better outcomes, versus those forced into reactive compliance.”
Tyler Williamson Principal, Cyber and Tech Risk Practice, KPMG LLP
FS Fast 5: Insights to move your agenda forward
Five focused takeaways drawn directly from the live discussion, distilled to help financial services leaders act with greater speed, precision, and confidence.
01
Threat is immediate (“Harvest now, decrypt later”)
Long-life data is being stolen today.
02
Crypto-agility is the target state
Modular, plug-and-play crypto swaps without disruption.
03
Frontier AI accelerates the quantum security imperative
AI finds exploits at machine speed — now.
04
Non-technical barriers demand attention
Budget, talent gaps, and third-party risk block progress.
05
Immediate strategic steps are required
Inventory, pilot GenAI upgrades, govern quantum risk.
Source:
1The Quantum Insider, “Global Quantum Computing Market to Double by 2028, Reaching $3 Billion in Revenue, QED-C State of the Global Quantum Industry 2026 Report Finds” (April 14, 2026).
FS Fast 5 Replay Hub
Explore the series' episodes for strategic insights to help you stay ahead of industry change in financial services.
Subscribe to receive the latest from KPMG Forensic
Helping organizations in their efforts to achieve the highest level of integrity and to manage the cost and risk of litigation, investigations, and regulatory enforcement actions.
Explore more
Meet our team
