How Companies Address the Threat of Cryptographically Relevant Quantum Computers and Migrate to Post-Quantum Cryptography

How companies prepare for the migration to post-quantum cryptography (PQC) remains an open and important question, despite growing awareness of the threat posed by cryptographically relevant quantum computers (CRQCs). While PQC standards released by the U.S. National Institute of Standards and Technology (NIST) in 2024 aim to resist both quantum and classical attacks, migrating to these standards presents significant technical and organizational challenges. Existing research has focused on algorithm design and migration frameworks, but little is known about how companies approach this migration in practice. Through semi-structured interviews, we explore how four companies address the CRQC threat and PQC migration. We have found that companies perceive the timing and threat of CRQC differently, which implies that these perceptions influence PQC migration.