Post-quantum Cryptography (PQC): The Next Cybersecurity Shift for Saudi Enterprises

By Hemant Pandya · August 26, 2026

The quiet disruption in cybersecurity

Cybersecurity has always evolved in response to new threats, but few shifts are as fundamental as the rise of quantum computing. The encryption methods that secure today’s digital world banking systems, VPNs, and cloud workloads are built on mathematical problems that classical computers struggle to solve. That paradigm is now being challenged. With advances in quantum computing, some algorithms (for example, Shor’s Algorithm) could eventually break widely used encryption such as RSA and elliptic curve cryptography (ECC). This is where post-quantum cryptography (PQC) comes in, designed to secure data even in a quantum-enabled future.

What is PQC and why it matters now

PQC refers to cryptographic algorithms that are resistant to both classical and quantum attacks. Unlike traditional encryption, PQC is built on mathematical problems that quantum computers are not expected to solve efficiently.

The urgency isn’t theoretical. Attackers can already harvest encrypted data today and decrypt it later once quantum capabilities mature. For organizations managing sensitive, long-life data, this is a real and present risk.

Why PQC is critical for Saudi Arabia

Saudi Arabia is positioning itself as a global quantum leader under its Vision 2030 roadmap, with initiatives spanning government, energy, telecom, and finance. This makes PQC not just a cybersecurity upgrade, but a national strategic priority. This certainly creates urgency for Saudi enterprises to begin transitioning toward quantum-resistant security.

In the energy sector, PQC plays a critical role due to the long lifecycle of operational technology (OT) systems and the strategic sensitivity of energy data. Industrial control systems (ICS), remote operations, and exploration data must remain confidential for decades, making them highly vulnerable to “harvest now, decrypt later” threats. PQC enables these systems to maintain secure communications and data protection even in a future where quantum computing becomes practical, thereby safeguarding national economic and geopolitical interests.

The financial sector, regulated by Saudi Central Bank (SAMA), is equally impacted, as it relies heavily on encryption for secure transactions, digital banking, and payment systems. Financial records often need to be retained for long periods, which makes them susceptible to future decryption if protected by current cryptographic standards. PQC will help ensure that transaction integrity, customer data, and digital signatures remain secure, while also preparing institutions for likely regulatory requirements around quantum-safe cryptography in the near future.

Telecommunications and 5G infrastructure form the backbone of Saudi Arabia’s digital economy, enabling everything from mobile connectivity to smart city ecosystems. In this sector, PQC is essential for securing large-scale data transmission, protecting network infrastructure, and ensuring the integrity of device identities. As telecom networks evolve to support next-generation services, integrating quantum-resistant encryption into protocols and architectures will be key to maintaining trust and resilience across national communication systems.

Government and national security entities, guided by frameworks from the National Cybersecurity Authority (NCA), face perhaps the most critical need for PQC adoption. Sensitive government data, intelligence communications, and national digital identity systems must remain secure for decades, often far beyond the expected timeline for quantum computing maturity. By adopting PQC early, government institutions can ensure long-term confidentiality, strengthen cyber resilience, and align with national objectives around data sovereignty and security.

Personal Data Protection Law (PDPL) in Saudi Arabia requires organizations to protect personal data using appropriate security controls, and today that relies on algorithms like RSA and ECC. However, with quantum advancements and threats enabled by Shor’s Algorithm, these protections may not remain secure in the future. PQC helps mitigate this by providing quantum-resistant encryption, ensuring long-term confidentiality of sensitive data such as personal data, financial, healthcare, and identity information.

Cloud computing and the broader digital economy also stand to be significantly impacted. As enterprises increasingly store sensitive data in cloud environments and rely on APIs for integration, the need for long-term data protection becomes more pronounced. PQC enables quantum-safe encryption for both data at rest and in transit, helping organizations maintain confidentiality and compliance as cloud adoption continues to grow across the Kingdom.

Saudi Arabia’s ambitious Smart City projects, such as those envisioned under Vision 2030, further amplify the importance of PQC. These environments rely on interconnected systems, IoT devices, cloud platforms, and real-time data exchange. Without quantum-resistant encryption, the massive volumes of data generated and transmitted in such ecosystems could be exposed in the future. PQC allows these digital-first cities to embed security at the design stage, ensuring that infrastructure remains resilient and trustworthy over its entire lifecycle.

In sectors such as manufacturing, healthcare, and defense, the implications are similarly profound. Manufacturing systems integrating Industry 4.0 technologies require secure machine-to-machine communication and protection of intellectual property (IP), while healthcare organizations must safeguard patient data that may remain sensitive for a lifetime. Defense and aerospace systems, with their long operational lifespans and critical security requirements, must ensure that communications and stored intelligence remain protected against future threats. In all these cases, PQC provides a pathway to maintain trust and security over extended time horizons.

Ultimately, the impact of PQC across Saudi Arabia is not confined to any single industry; it represents a cross-sector transformation in how trust is established and maintained in a digital world. As the Kingdom continues to invest in advanced technologies and build a knowledge-driven economy, adopting quantum-resistant cryptography will be essential to protecting data, ensuring regulatory compliance, and sustaining long-term national security. Organizations that begin preparing today by embracing crypto-agility, assessing their cryptographic exposure, and aligning with global standards such as those from the U.S.National Institute of Standards and Technology (NIST) will be best positioned to navigate the transition and lead in the quantum era.

How to get started with PQC

A practical roadmap for enterprises adopting PQC begins with building strong foundational awareness and visibility.

Start now: Organizations should start by conducting a comprehensive inventory of cryptographic assets across their entire environment, including VPNs, TLS implementations, APIs, public key infrastructure (PKI) systems, cloud services, applications, and even embedded encryption in IoT or OT systems. This step is critical because many organizations do not have full visibility into where and how cryptography is used, which makes risk assessment difficult. 

Alongside this, enterprises must identify long-term sensitive data such as financial records, personal data, intellectual property, healthcare data, and government information that needs to remain confidential for years or even decades. This is particularly important in the context of future quantum threats, where data intercepted today could be decrypted later. 

At this early stage, organizations should also actively engage with vendors to understand their PQC readiness. This includes evaluating whether vendors support quantum-resistant algorithms, hybrid cryptographic models, and crypto-agility, as well as ensuring that future product roadmaps align with evolving security requirements. In this stage of PQC adoption, focus on:

• Inventorying cryptographic assets
• Identifying long-term sensitive data
• Engaging vendors on PQC readiness

Prepare for transition: As organizations move into the preparation phase, the focus shifts from visibility to controlled implementation. A key step here is adopting hybrid cryptography, where traditional algorithms like RSA and elliptic curve cryptography are used in combination with quantum-resistant algorithms. This approach allows organizations to maintain compatibility with existing systems while gradually introducing PQC capabilities. 

At the same time, enterprises need to upgrade their PKI and certificate management processes to support new cryptographic standards. PQC algorithms often involve larger key sizes and different performance characteristics, which can impact certificate issuance, validation, and lifecycle management. This may require updates to certificate authorities, hardware security modules, and automated certificate workflows. 

Another critical component of this phase is testing PQC in controlled environments. Organizations should establish pilot programs or sandbox environments where they can evaluate performance, interoperability, and integration challenges. These tests help identify potential bottlenecks, compatibility issues with existing tools, and operational impacts before broader deployment. In this phase of PQC adoption, focus on:

• Adopting hybrid cryptography (classical & PQC)
• Upgrading PKI and certificate management
• Testing PQC in controlled environments

Move toward full adoption: The final stage involves moving toward full adoption by aligning with global standards and embedding long-term resilience into the organization’s security architecture. Standards developed and published by NIST in August 2024 such as FIPS 203 (ML-KEM, a secure way to exchange keys), FIPS 204 (ML-DSA, a secure way to prove identity and sign data), and FIPS 205 (SLH-DSA) are shaping the global direction of PQC, and enterprises should align with these to ensure interoperability, compliance, and future readiness. 

However, full adoption is not just about replacing algorithms; it is also about achieving crypto-agility, where systems are designed to quickly adapt to new cryptographic methods as threats evolve. This requires modernizing architectures, automating key and certificate management, and ensuring that applications and infrastructure can support seamless transitions without major disruption. Ultimately, organizations that invest in crypto-agility will not only be prepared for quantum threats but will also be better equipped to respond to any future shifts in the cybersecurity landscape.

To learn more about building a secure, quantum-resistant future, read the ebook, Navigating the Shift to Post-Quantum Cryptography, and contact your Trellix account team.