Post-quantum readiness by industry

Financial data carries long confidentiality obligations and high value, which makes it a prime harvest-now-decrypt-later target. The surface is also large: customer-facing TLS, interbank connections, hardware security modules, and payment cryptography. Banks are among the earliest to receive and to send quantum-readiness questionnaires, so they feel the pressure from both directions. Priorities: post-quantum key exchange on public and partner endpoints first, then an inventory that reaches the HSMs and payment systems most people forget.

Health and genetic records stay sensitive for a lifetime, which is close to the worst case for harvest-now-decrypt-later: data captured today is exposed for decades. The environment is also heterogeneous, full of long-lived medical devices and legacy systems that are slow to update. Priorities: identify where patient data crosses networks, move those connections to post-quantum key exchange, and start planning early for devices that cannot be changed quickly.

If you sell software to enterprises, your customers’ security teams will ask whether you are quantum-ready, and that question is already appearing in vendor questionnaires. Your exposure is broad but usually modern: TLS everywhere, plus internal service-to-service traffic and secrets. The advantage is that modern stacks can adopt hybrid ML-KEM quickly. Priorities: turn on post-quantum key exchange at the edge so you can answer the questionnaire with evidence, keep your cryptography agile so you can swap algorithms again, and be ready to hand a supplier a CBOM.

This sector has the clearest deadlines. In the United States, federal systems must move to post-quantum key establishment by the end of 2030, and a forthcoming procurement rule is expected to push the same requirement onto contractors. If you sell to the government, the timeline is not a projection, it is a contract term in the making. Priorities: build the cryptographic inventory the guidance expects, and treat the CBOM as a deliverable rather than an internal note.

Whatever the sector, the sequence is the same: find your cryptography, prioritize key exchange where data lives longest, and migrate in hybrid. The difference between industries is only how soon the deadline bites and how much of your crypto hides in places a public scan cannot see.