Awareness of quantum risk among security leaders has grown substantially — conference talks, vendor marketing, and industry reporting have made sure of that. Actual organisational readiness has grown much more slowly. That gap between knowing and doing is worth examining directly, because closing it is mostly about removing specific, identifiable blockers rather than raising awareness further.

Awareness Doesn’t Require a Decision. Readiness Does.

It’s possible to be fully aware of quantum risk — to be able to explain “harvest now, decrypt later” fluently in a meeting — without ever having made the organisational decisions that turn awareness into action: who owns this, what budget it gets, what the first concrete deliverable is. Awareness is a knowledge state. Readiness requires resourcing and sequencing decisions that awareness alone doesn’t force.

The “Where Do We Even Start” Problem

A common reason awareness stalls before becoming readiness is that the full scope — discover everything, assess everything, migrate everything — looks too large to start. The organisations that move past this treat discovery as a bounded, achievable first step (weeks, not years) rather than trying to plan the entire multi-year migration before taking any action at all.

The Ownership Problem

Quantum readiness doesn’t map cleanly onto an existing team’s job description. It touches security, infrastructure, application engineering, procurement and governance simultaneously, which means it’s genuinely easy for it to end up owned by nobody in particular — everyone’s aware, nobody’s accountable for the next concrete step.

Closing the Gap

The organisations that convert awareness into readiness fastest share a pattern: a named owner, a bounded first deliverable (usually discovery and an initial CBOM), and a reporting cadence that keeps the work visible to leadership. None of that requires quantum computing expertise. It requires treating this like any other governance-relevant risk programme — because that’s what it actually is.