Cybersecurity

Microsoft Pulls the Quantum Deadline to 2029

Microsoft has pulled its quantum-safe deadline forward four years to 2029. The reason is not future quantum computers. It is the data being stolen today.

CybersecurityBy Servola Tech Desk2026-07-052 min read

AI-assisted, edited by humans. | Editor-in-Chief: Leon Soliman | Editorial standards

Microsoft Pulls the Quantum Deadline to 2029

What Microsoft actually announced

On 30 June 2026, Azure chief technology officer Mark Russinovich said Microsoft is accelerating its Quantum Safe Program to migrate all products and services to post-quantum cryptography by 2029, pulling the target forward by roughly four years. His framing was blunt: the quantum capabilities are accelerating, and the time to respond is now.

The programme is deliberately wide. Microsoft named network cryptography through TLS 1.3, code signing and certificate issuance, the trust chains behind updates, and encryption for data at rest. The company also stressed crypto-agility - designing systems so an algorithm can be swapped with minimal application change - and folding these requirements into its Secure Future Initiative.

Why the date moved, and why it matters now

The threat is not that a quantum computer will break your traffic in 2029. It is that an attacker can copy your encrypted data today and store it until the hardware exists to open it. Long-lived secrets - patient records, contracts, source-signing keys, state archives - are exposed the day they are captured, not the day quantum arrives. Microsoft cited recent United States and French government guidance recommending quantum-safe adoption in high-risk systems by 2030 as part of the reason it moved.

Here is the non-obvious part. When the vendor that runs your identity, your cloud and your update pipeline sets 2029 for itself, that becomes your effective ceiling too. Your certificates, your signed code and your key management inherit Microsoft's clock whether or not you have a plan of your own.

What a European owner should do first

Start with a cryptographic inventory, not a product purchase. You cannot migrate algorithms you have not located, and most organisations do not know where their long-lived keys and certificates actually live. Map what is signed, what is encrypted for years, and what depends on a supplier's cryptography you do not control. That map is the deliverable that makes every later step cheaper.

Then treat crypto-agility as the real goal. NIS2 and DORA already expect firms to manage this class of risk, and the United Kingdom's NCSC has published its own migration timeline. The winners will not be the firms that rushed to a single algorithm in 2026. They will be the ones that built systems able to change cryptography again in 2032 without a rebuild.

Frequently asked questions

Do I need a quantum computer to be at risk?

No. The immediate risk is harvest-now-decrypt-later: an attacker copies your encrypted data today and decrypts it once a capable quantum computer exists. Anything you need to stay secret for years is already exposed.

Is 2029 a legal deadline for my business?

It is Microsoft's internal target, not a law. But because Microsoft runs identity, cloud and code-signing for much of Europe, its 2029 clock effectively sets the pace for anyone built on that stack.

What is the single most useful first step?

A cryptographic inventory. Map every place you use encryption, signing and long-lived keys, including supplier-controlled ones. You cannot plan a migration for assets you have not found.

The quantum threat does not begin when the hardware ships. It begins the day your long-lived data is copied. The organisations that inventory and build crypto-agility this year are the ones that will not be reissuing every certificate under pressure later.

CybersecurityPost-QuantumMicrosoftEncryptionAzureCrypto-Agility

Your Supplier Is Europe's Ransomware Door

Black Kite's 2026 report shows one supplier breach drove over half of Europe's third-party ransomware victims. Under NIS2 and DORA, the liability is yours.

2 min read

Cybersecurity

Jailbreak Risk Now Has a Severity Score

Anthropic's Cyber Jailbreak Severity scale turns AI safety into a procurement and audit criterion, the way CVSS did for software bugs. What owners should demand.

5 min read

Digital Sovereignty

Your Confidential Messages Can Be Scanned Again

The EU Council revived the lapsed rule that lets providers scan private messages with AI. For owners, confidential communication is now a governance choice.

2 min read14 views

← All articles