Post-quantum cryptography attracts a specific kind of misunderstanding: enough truth in each myth to make it plausible, and enough gap to leave an organisation genuinely exposed if it’s acted on. Five are worth addressing directly.

Myth 1: “We Have Years, So There’s No Rush”

This conflates two different timelines: when quantum computers capable of breaking current cryptography arrive, and when the risk to your data actually starts. Because of “harvest now, decrypt later,” any long-lived sensitive data encrypted with a vulnerable algorithm today is already exposed to that future risk — the exposure clock started at the moment of encryption, not at some future “quantum arrival” date.

Myth 2: “This Is Purely an IT Problem”

Cryptographic migration touches procurement (vendor cryptographic support), legal and compliance (data-longevity obligations), and governance (board-level risk reporting) just as much as engineering. Treating it as a purely technical project, owned entirely within IT, is a common reason these programmes lose organisational visibility and funding partway through.

Myth 3: “We’ll Just Wait for Our Vendors to Handle It”

Vendor support for post-quantum algorithms is genuinely improving, but vendor readiness and organisational readiness are not the same thing. Even with fully quantum-safe vendor products, an organisation still needs to know where those products are deployed, how they’re configured, and whether legacy integrations depend on classical-only configurations. Waiting passively doesn’t produce that visibility.

Myth 4: “One Big Migration Project Will Solve This”

Cryptography isn’t centralised enough in most organisations for a single project to touch all of it, and treating this as a project with an end date — rather than a continuous discipline — tends to produce a migration that’s declared complete while meaningful exposure remains undiscovered.

Myth 5: “Post-Quantum Algorithms Are Still Experimental”

NIST’s FIPS 203, 204 and 205 completed a multi-year, open, international standardisation process involving sustained cryptanalysis from researchers worldwide. These are not experimental proposals — they are published federal standards, already being incorporated into major protocols and libraries. The open question for most organisations isn’t whether the standards are ready; it’s whether their own environment is ready to adopt them.

Each of these myths shares a common thread: they all provide a reason to delay discovery. None of them survive contact with an actual cryptographic inventory.