Gigamon warns firms to prepare for quantum cyber risks

Gigamon has warned organisations to prepare now for quantum-related cyber risks, arguing that encrypted traffic and post-quantum readiness are becoming immediate security issues.

The warning comes as security teams already contend with AI-assisted attacks and rising concern over the security of encrypted data. Gigamon cited findings from its forthcoming 2026 Hybrid Cloud Security Survey of 1,000 security leaders, which found that 35% of organisations globally see encrypted traffic as their biggest breach risk, while 87% are concerned about the rise of so-called harvest now, decrypt later attacks.

That attack model involves collecting encrypted information today in the expectation that more advanced quantum systems could later break current encryption methods. Gigamon argues the issue is no longer hypothetical and that the next year will be a critical period for preparation.

The company also pointed to a gap between awareness and action. Survey data showed that 76% of organisations still believe their encrypted data is inherently secure, despite growing industry discussion about the effect quantum computing could have on existing cryptographic standards.

Readiness Gap

Chaim Mazal, Chief AI and Security Officer at Gigamon, said post-quantum planning should now sit alongside broader cyber defence work. Organisations that focus on audits, asset inventory, security architecture updates and zero trust approaches will be in a stronger position to manage the shift, he said.

Gigamon also highlighted the operational challenge for businesses in Australia and elsewhere as they review systems that depend on legacy cryptography. That includes applications, identities, transactions and digital signatures that could be exposed if private keys are compromised.

Ian Farquhar, Security CTO at Gigamon, outlined the company's view of the urgency facing security teams.

"This Quantum Day should be a wake-up call for many organizations. There is little time left to transition, and quantum could be here in as little as four years' time in some parts of the world.

Even if there's ongoing debate about how quickly quantum computing will scale, the risk is significant enough and the timelines short enough that organizations can no longer afford to wait. What's often overlooked is that this isn't just about 'harvest now, decrypt later,' but 'harvest now, forge later.' If private keys are compromised, the integrity of identities, transactions, and digital signatures comes into question, derailing longstanding trust and risk calculations that form the backbone of the modern era. This will impact organizations across every industry, impacting consumers and businesses alike.

If we think back to 1999 when Y2K was approaching, the event itself was a forcing function that led to massive technology infrastructure upgrades and tech stack modernization. In that case there was very little impact from the two-digit data representation, and some people characterized it as wasted effort. It was not, as we benefited as an industry from the tech stack modernization which it delivered. But like Y2K, today's quantum challenge isn't just the potential event itself, it's the scale of the remediation effort required across systems, applications, and embedded technologies, which makes early action critical.

The real upside, though, is that this moment is forcing a long-overdue modernization: most organizations rely on a narrow set of aging cryptographic algorithms that have gone largely untouched because they're difficult to change. To prepare, organizations should create a dedicated team internally, much like a cryptographic center of excellence. From there, this team can inventory where cryptography exists across their environments, prioritizing what matters most, and building the internal muscle, often through dedicated teams, to manage and execute these upgrades. Once done, we then need to monitor our environments to ensure that vulnerable non-PQC crypto has not been missed or sneaks back in. If that effort results in true cryptographic agility, where policies and algorithms can be swapped out quickly in response to future threats, then the investment will have been worth it regardless of how the quantum threat ultimately evolves."

Modernisation Push

The comparison with Y2K reflects a wider industry view that even if the timeline for practical quantum disruption remains uncertain, the transition work will be extensive. Cryptographic tools are often embedded deep within corporate infrastructure, from older internal applications to connected devices and third-party software, making replacement or upgrading a long-term exercise rather than a single procurement decision.

Security specialists have increasingly focused on cryptographic agility as a way to reduce that risk. In practice, that means identifying where encryption is used, understanding which algorithms are in place, and designing systems so standards can be changed without large-scale operational disruption.

For large organisations, that process can extend well beyond the security function. Legal, compliance, infrastructure and software teams may all need to be involved where encryption underpins customer data, financial transactions, identity systems or regulated records. Businesses with hybrid cloud estates may face added complexity because cryptographic controls are spread across on-premises systems, cloud platforms and external providers.

Gigamon's comments also link quantum risk to current debates over visibility into encrypted traffic. As more enterprise traffic is encrypted, security teams have less direct insight into content moving across networks, raising questions about how to detect threats while preserving privacy and performance.

The survey figures suggest many executives now see that issue as central to breach prevention, even before quantum computing reaches wider practical use. At the same time, continued confidence in existing encrypted data suggests many organisations have yet to translate concern into formal migration plans, asset inventories or governance structures for a post-quantum transition.

Farquhar said organisations should create a dedicated internal team to oversee that work and prevent vulnerable cryptography from remaining in place or being reintroduced. "If that effort results in true cryptographic agility, where policies and algorithms can be swapped out quickly in response to future threats, then the investment will have been worth it regardless of how the quantum threat ultimately evolves."