Singapore will issue guidance for organisations beyond Critical Information Infrastructure (CII) owners to begin migrating towards quantum-safe encryption by 2035, Minister for Digital Development and Information Josephine Teo announced, alongside a new Quantum-Safe Kickstarter Grant to fund early pilots.

The Cyber Security Agency of Singapore (CSA) published an accompanying advisory the same day, asking exposed organisations to have a migration plan in place by the end of 2027. In the same speech, the Minister cited a case in which a professional transferred nearly S$5 million after a deepfake video meeting that appeared to involve Prime Minister Lawrence Wong.

Security experts say the quantum threat is already active

Takanori Nishiyama, Senior Vice President for APAC and Japan Country Manager at Keeper Security, said Singapore’s quantum-resistant encryption push is a critical step, but warned organisations against waiting for quantum computers to mature before acting.

“Cybercriminals are already executing ‘harvest now, decrypt later’ cyber attacks, intercepting and archiving encrypted enterprise data with the intention of unlocking it once quantum computing matures. Waiting for these machines to arrive before upgrading security precautions is a high-risk gamble,” Nishiyama said.

Crypto-agility and identity security seen as the starting point

Nishiyama said organisations should prioritise crypto-agility — the ability to update cryptographic standards without disrupting business operations — and adopt a hybrid security model that layers quantum-resistant algorithms alongside classical encryption as post-quantum standards continue to evolve.

He added that businesses should begin by inventorying their cryptographic footprints, assessing vendors’ post-quantum roadmaps and securing high-value access points. Deploying a zero-knowledge, zero-trust identity and access management (IAM) platform with quantum-resistant encryption, alongside a quantum-resistant privileged access management (PAM) platform to limit lateral movement after a breach, would help organisations protect current operations while preparing for the shift, he said.