Quantum Computing represents a weapon in terms of computation capacity. There are 3 major areas of study here: the math, the software and the hardware.
The math is there, it’s well known. The software is being implemented and tested on classical computers (CPUs and GPUs), and the hardware is the component that is emerging and expected to happen in the next years.
When I mention “hardware” I refer about the goal of the companies trying to obtain a fault tolerant quantum computers, combining many noisy physical Qubits to build a perfect logical Qubit.
Post Quantum Computing (PQC)
There’s also the concept of Post Quantum Computing (PQC), the moment where Quantum Computers will be available. A fair question to ask yourself here is: When does this event will happen?
Depending on your risk appetite you can assume it will happen in 2 – 3 years; or assume PQC is already here.
You already has a risk management plan or a risk management playbook that defines how to foresee risks and how to start identifying risks of new nature.
When this happens, there’s a complete revision of the capabilities the organization has, and early decisions about the ones that are going to be affected by the new risk (here the Quantum Computing capability as weapon against our existing security).
Here the next question is: do we want to protect us against this risk? Or do we want to take advantage of this risk?
If you are more on the first question, then analysis of the capabilities you have done bring you to the situation where you have to decide if you have to build or buy a capability to mitigate the QC risk.
To build a capability is typically done through a laboratory, an innovation hub…
To buy a capability also requires knowledge and understanding of what you need, and what the market offers. This is not easy nor straightforward, you have to learn how to buy things in this new space to avoid to buy things you do not need or at an excessive price.
A visual support (a Wardley Map) to put my comments in context

Look at the right place
As usual, we should be looking into the right place.
Once Quantum Computing starts to be a trend, then it’s late or you have short period of time to react.
In this case, it’s a better choice to look at:
- Evolution of new components: how the major QC players in West and China are playing the game.
- Analyze your value chain and understand your weak points.
- Partner with others to increase your knowledge on the field.

What will do the first organization with access to scalable Quantum Computing capacity?
I’m 99% sure they will not advertise it. They will do two main things:
- Exploit the capacity trying to not be discovered.
- Protect their systems against that same capacity.
What would you do?