Two quantum programmes, not one
When "quantum" appears on a bank's agenda, it can mean two very different things. One is defending the bank against future quantum attacks by moving to post-quantum cryptography. The other is exploring whether quantum computers could one day help the business, through pilots and partnerships. Both are legitimate. The trouble starts when they're run as one programme, under one budget line, with one owner and one progress report. This short piece sets out why they belong apart, and what each needs.
Why they get mixed up
The same word covers both, the same vendors sometimes sell both, and the same headlines prompt questions about both. A board that hears "we're doing quantum" may assume the defensive work is covered when only an innovation pilot exists, or the reverse. The two also move at different speeds. Defensive migration is slow, cross-cutting and driven by external dates. Exploration is fast, contained and optional.
Side by side
| Defend: post-quantum migration | Explore: quantum computing pilots | |
|---|---|---|
| Purpose | Protect data, transactions and trust from future quantum attacks | Learn whether quantum computing could create value |
| Is it optional? | Not in practice: governments and standards bodies have set timelines, and regulators such as OSFI have published what preparation looks like | Yes: a business choice |
| What drives the timing | Data lifetimes, migration length, and external dates such as NIST's proposed 2030 and 2035 milestones | Business priorities and the maturity of the hardware |
| Natural owner | The CISO or cryptography function, with technology and risk | Innovation, quantitative or data science teams |
| Scope | Every system that uses public-key cryptography, plus suppliers | A small number of contained experiments |
| How progress is measured | Inventory coverage, systems migrated, supplier readiness | Learning objectives met, honest results against a classical baseline |
| Cost of stopping | Rising exposure, and a harder catch-up later | Lost learning; can be restarted later |
What separation looks like in practice
- Separate owners and budgets. Funding for defence shouldn't compete with, or be counted as, spending on exploration.
- Separate reporting. A steering committee can oversee both, but each needs its own status and risks. "Quantum: green" on a dashboard should never hide which programme it refers to.
- Separate risk treatment. Migration is tracked as a risk being reduced, with indicators and review triggers. Pilots are tracked as investments, with success criteria and exit points, and handled as supplier arrangements; How to evaluate a quantum computing pilot covers the questions.
- Shared knowledge. The people who understand quantum computing well enough to run a pilot are also useful when the migration team is judging the threat. Separation is about accountability, not silos.
A quick test for a board paper
If a paper about quantum doesn't make clear which programme it's about, who owns it, and whether the activity is required or optional, it's worth asking before approving it.
- Defending against quantum attacks and exploring quantum computing are different programmes.
- Migration is expected and date-driven; pilots are optional and should be judged as investments.
- Give each its own owner, budget and reporting, while sharing expertise.
Sources and further reading
Tags show what kind of source each one is. A standard or government guidance is an official document; a peer-reviewed paper has been checked by other experts; a preprint has not been peer-reviewed yet; an experiment reports a real-world demonstration; a company announcement is the company's own account; vendor documentation is a supplier's own technical guide; expert commentary is a specialist's published analysis or opinion; a news report is a journalist's account. Dates and figures were checked against these sources on 17 October 2026. Spotted an error? Email hello@plainquantum.com and it will be corrected, with a note.
- Government guidanceNIST IR 8547 (Initial Public Draft): Transition to Post-Quantum Cryptography StandardsNIST, 2024
- Government guidanceTechnology Risk Bulletin: Quantum Readiness Phases and TimelinesOffice of the Superintendent of Financial Institutions (OSFI), 2026
- Government guidanceRoadmap for the migration to post-quantum cryptography for the Government of Canada (ITSM.40.001)Canadian Centre for Cyber Security, 2025
- Government guidanceGuideline B-10: Third-Party Risk ManagementOffice of the Superintendent of Financial Institutions (OSFI), 2023