GCC organisations are aware of the quantum threat - but most haven't done the homework yet

Quantum computing may still be years away from breaking today’s encryption standards, but according to José Lemos, product delivery manager at the Abu Dhabi based QuantumGate, the countdown has already started. And the GCC region is racing to keep up.

Speaking to Gulf News at this year’s GISEC Global 2026 Lemos, an expert in helping organisations transition to post-quantum cryptography (PQC), said the core risk is not hypothetical.

It is already happening.

“Whatever data you have right now can be harvested and decrypted later," Lemos explained. Sensitive data intercepted today, from health records to financial information, could sit dormant until a sufficiently powerful quantum computer comes online, at which point it could be decrypted retroactively," he said.

"For information that needs to stay confidential for five, ten, or more years, protection must start now, not once quantum computers arrive,” he added.

A moving deadline

The timeline for when quantum computers will be capable of breaking today’s classical cryptography has been shrinking fast. Lemos noted that industry estimates that one put the threat 15 years out are now converging around 2030. This is a shift he compared to the sudden, explosive arrival of mainstream AI.

“It is already been developed super-fast, similar to AI. When we thought, it was never going to happen, out of nowhere it started to be reality,” he said.

Regulation is driving the region

In the UAE specifically, Lemos pointed to the cybersecurity Council’s PQC migration framework as a leading example of regulation turning awareness into action. According to him, QuantumGate, is a trusted partner organisation through the framework’s first phase, which is building a full cryptographic inventory and mapping an organisation’s cryptographic posture across its infrastructure.

That regulatory push is not unique to the UAE. Lemos said similar guide are already emerging in the US and Europe, but singled out the UAE as one of the first countries to translate the trend into binding law.

The readiness gap

The urgency is borne out in QuantumGate’s newly published report on GCC post-quantum readiness, which surveyed organisation across the region. The findings point to a widening gap between awareness and action.

It shows that 64 per cent of GCC organisations now have a budgeted post-quantum initiative, which is according to Lemos is a rise. It shows that there is an awareness of quantum risk, but almost half have not yet started a formal cryptographic inventory.

For Lemos, that gap between claimed visibility and actual inventory work was the most striking in the report.

“You cannot make such a large transformation without having the data at hand,” he said. Without it, organisations risk securing only fragments of their infrastructure while believing they are fully protected.

Who needs to act first

Financial institutions and defence-sector entities, along with any organisation handling sensitive personal or business data, are the highest priority adopters, according to Lemos.

But he was careful to frame post-quantum migration as a multi-year process rather than a single fix.

“This is not going to be one piece of equipment that you change and you are ready," he said. "You need to do this in a way which you follow priorities, which you change different areas of your technology”

He also pushed back on a common misconception among clients, that PQC migration is primarily a matter of swapping out PKI systems. Vendors can support parts of the transition, Lemos said, but organisations need to own the process end-to-end and understand their own infrastructure. Otherwise, gaps will surface later.