Why operators need to act now, the technology choices on the table, what the industry is already doing, and how to build a migration roadmap.

Quantum safety is becoming urgent

Quantum computing is a fundamentally different model of computing that uses quantum effects such as superposition and entanglement to process information in ways classical computers cannot efficiently replicate. Its most important cybersecurity implication is that a sufficiently powerful, fault-tolerant quantum computer could run algorithms that solve the mathematical problems behind today’s public-key cryptography – the technology that secures almost all digital communication, from web browsing and banking to the networks telecoms operators run. The point at which such a computer exists is generally referred to as Q-Day.

The threat is not that useful quantum computers exist everywhere today. It is that quantum capability is progressing while the cryptographic systems protecting long-lived data are already deployed across networks and infrastructure with asset lifetimes measured in decades.

Why now?

An important concept for understanding the urgency of quantum-safe migration is HNDL, also known as store now, decrypt later (SNDL). A bad actor does not need a working quantum computer today to benefit from quantum computing tomorrow – it only needs to intercept and store encrypted traffic now, then wait for cryptographically relevant quantum hardware to decrypt it retroactively.

But HNDL attacks are not the only factor making action on this issue urgent for telcos. The second is a seemingly more mundane execution risk: migrating a telecoms network’s cryptography is a slow, multi-year undertaking, so operators need to start long before Q-Day comes, almost regardless of the precise date it turns up. This being said, a reasonable synthesis of expert opinion on the likely date of Q-Day now spans roughly 2029 to 2035.

If you are not a subscriber, enter your details below to download an extract of this report.

Regulators, governments and customers solidify the pressure

What was, until recently, general good practice has hardened into specific compliance deadlines that cascade through supply chains well beyond telecoms.

Hard PQC deadlines start in 2027, while EU, UK and customer pressure keeps building

Source: STL Partners

Taken together, the combination of a compressing technical timeline and hardening regulatory deadlines means this requires action now: not because Q-Day is imminent, but because the lead time to be ready for it, across an estate as large and interconnected as a national or global telecom network, is itself measured in years.

This report sets out in detail why this is a particularly hard problem for telecoms specifically, what technology options exist to address it, what the industry is already doing about it, and what STL Partners recommend operators do next.

Table of contents

• Executive summary
• Introduction
  • Cryptographic techniques at a glance
  • Why now?
  • Regulators, governments and enterprises solidify the pressure
• The challenge: Why acting now is hard
  • Unique challenges for the telecom industry
  • The engineering challenge: PQC performance impacts
• Implementing the new technology: The immediate way forward
  • Hybrid PQC: The practical first step
  • QKD: A complementary, physics-based layer
  • Crypto-agility: Modernising PKI, HSMs and key management
• What is the industry actually doing?
  • PQC vs QKD: Three strategic camps
  • From early revenue to network-wide quantum safety
  • Operator activity at a glance
  • Case studies
• Advice for telcos and vendors
• Conclusions

Related research

• Q-Beat: Telco quantum deployment tracker
• Quantum: What does it mean for telecoms?
• Quantum technologies: Strategic paths for telcos

---