APAC’s security capacity currently ‘insufficient’ to cut against quantum threats, says report

Governments in the Asia-Pacific region need to act faster in securing themselves against quantum threats, observed the Coalition for Cybersecurity in Asia-Pacific (CCAPAC) in their 2026 report. 

Sufficiently powerful quantum computers could undermine the security of traditional encryption methods that secure existing systems, but Asia Pacific is still underprepared for adopting the solution to this problem — post-quantum cryptography (PQC). 

PQCs are algorithms that can be used as new encryption methods. They are believed to be secure against both classical and quantum computers, unlike current methods which quantum computers can break. 

The report assessed seven countries' readiness for PQC adoption and concluded "steady but uneven progress, significant potential, and urgent need for acceleration." 

Today's data, tomorrow's exposure 

Quantum technologies are not a future problem, stressed the CCAPAC. The report outlined two dangers of quantum technologies that are immediate. 

Firstly, adversaries can save encrypted data today and decrypt it once quantum capabilities mature, a threat known commonly as "Harvest Now, Decrypt Later". 

Secondly, certain quantum computers could also break the cryptography behind many of today’s digital signatures, allowing attackers to forge them, an approach dubbed "Trust Now, Forge Later". 

Encryption underpins systems ranging from national identity platforms to critical infrastructure, making its potential failure a serious threat to governments, the report warned. 

"A breakdown in encryption does not merely expose information; it can undermine public trust in digital services, destabilise financial systems, and create vulnerabilities in national defence." 

"The quantum threat isn't a future problem. Data harvested today will be decrypted tomorrow, and the standards to protect it already exist. What the region needs now is urgency," said Lim May-Ann, Executive Director for the CCAPAC. 

An uneven regional response 

Singapore and Japan demonstrated "advanced readiness" with strong research foundations, operational quantum-secure deployments and regulatory engagement, stated the report. 

Singapore has set a 2031 migration target for its Critical Information Infrastructure (CII) systems. 

In an advisory issued on October 14, the Cyber Security Agency of Singapore (CSA) also encouraged other organisations exposed to quantum risks to have migration plans in place by the end of 2027 and complete their transition by 2035. 

South Korea is “advancing rapidly” through government mandates and industrial capability, the report said. 

In Australia, the July 2026 Protective Security Policy Framework requires covered government entities to develop, implement and maintain PQC transition plans.  

Newly procured cryptographic equipment and software must also support approved post-quantum algorithms. 

India will face a challenge in scaling PQC given its 1.4 billion-strong population, the report stated. 

Additionally, while China is pursuing a strategy with extensive infrastructure deployment, it lacks a mandatory PQC adoption timeline. 

However, across all markets, cryptographic inventories appeared to be incomplete or missing. 

What's holding back quantum-safe migration 

PQC adoption today is challenged by the need to physically replace the hardware that has hard-coded cryptography, and in overhauling existing legacy systems that rely on old encryption methods, said the report. 

The divergent standards across governments also complicate implementation for multinational organisations, it added. 

For example, differences between China’s approach to post-quantum cryptography and standards developed by the US government’s National Institute of Standards and Technology (NIST) could make it harder for systems to work together, said a participant at a roundtable discussing the report. 

Geopolitical mistrust could also contribute to these divergent standards, and quantum capabilities could become another arena for competition, said sources at the event. 

To reduce fragmentation, CCAPAC proposes a regional framework for testing whether quantum-safe products from different jurisdictions can work together, potentially coordinated through ASEAN or APEC. 

One participant added that PQC lacked prominence in the broader international cybersecurity agenda, with another suggesting better public communication around the issue. 

The report warns that regulatory mandates alone are unlikely to drive migration fast enough, citing low awareness among small and medium enterprises and a shortage of skilled talent. 

It recommends that governments require critical infrastructure operators to report migration progress and offer incentives to help smaller businesses prepare.