Manual of Quantum Cybersecurity

This manual constitutes an independent work of technical and operational doctrine. It does not replace applicable legislation or binding guidelines from competent national authorities. In case of discrepancy between this text and the current normative instruments — notably Regulation (EU) 2022/2554 (DORA), Directive (EU) 2022/2555 (NIS2), Decree-Law No. 125/2025, Regulation (EU) 2024/2847 (Cyber Resilience ) Although the guidelines of the National Cyber Security Centre (CNCS) and the European Union Agency for Cyber Security (ENISA) always prevail, the existing instruments always take precedence.

Hyperlinks and documentary references were verified on May 15, 2026. Readers who find broken links should consult the Internet Archive or equivalent primary institutional websites.

The next decade will bring about a structural transformation of global cybersecurity . This will be driven by the progressive maturation of quantum computers with significant cryptanalytic capabilities—referred to in the international technical literature as Cryptographically Intelligent Design (CIDD) computers. Relevant Quantum Computing (RCQC) — will compromise, over the 2030-2040 horizon, the mathematical integrity of public-key algorithms that currently underpin the confidentiality, authenticity, and integrity of digital communications. The threat is simultaneously technical, strategic, regulatory, and civilizational. Its effective management will determine institutional trajectories whose relevance far exceeds conventional cybersecurity planning cycles .

The most recent estimates from the international scientific community, systematized by Global Risk. Institute at the sixth edition of Quantum Threat Timeline The report , directed by Michele Mosca, places the median probability of Q- Day —the moment when an operational CRQC exists against RSA-2048—between the years 2029 and 2032, with an aggregate probability of 34% until 2030 and a pessimistic tail extending to 2040. Craig 's paper Gidney , a researcher at Google Quantum AI, published a study on arXiv in May 2025 and reviewed in July of that year. He reduced the physical qubit requirements for breaking RSA-2048 by a factor of approximately twenty, lowering the previous estimate of twenty million noisy qubits to less than one million. This algorithmic reduction is particularly significant: it demonstrates that the progress of the threat does not depend exclusively on advances in quantum hardware, but may also result from unexpected theoretical optimizations that accelerate the operational window.

The quantum threat, however, is not exclusively a future threat. The paradigm known as harvest now , decrypt later — the preventive interception of encrypted traffic for future decryption — materializes it in the present. State actors with massive signal interception capacity ( Signals) Intelligence (SIGINT) – the United States, China, Russia, the United Kingdom, Israel, France, among others – collect and store, in industrial volumes, contemporary encrypted traffic. This material becomes available for future decryption when each state has adequate quantum capability. The operational consequence is radical: all information transmitted today whose sensitivity must persist beyond five to ten years is already exposed to a threat that does not yet exist operationally but whose arrival time is known with acceptable margins of error.

The international institutional response has been organized since 2016.