In this episode of Entropy, Francis Gorman speaks with Louise Davey, executive leader, transformation architect, and author of Quantum How, about why quantum readiness has to move beyond the technology function and into the boardroom.Louise argues that post-quantum cryptography is no longer just a cryptography, standards, or cybersecurity discussion. It is an enterprise governance and transformation challenge that affects digital trust, operational resilience, fiduciary duty, regulatory exposure, insurance, systemic financial risk, and long-term business viability.The conversation explores why boards and executive leaders often struggle to act on quantum risk, not because the threat is unclear, but because it is poorly communicated. Louise explains how quantum risk breaks traditional risk models: it is time-shifted, has unclear ownership, spans the entire digital infrastructure layer, and reaches far beyond any single technology team.The episode also covers the real-world consequences of unreadiness, from harvest-now-decrypt-later exposure to operational technology, financial services, elevators, pacemakers, insurance risk, liquidity impact, and corporate survival. But the conversation is not only about risk. Louise also makes the case that quantum readiness can be used as a once-in-a-generation transformation opportunity to reduce technical debt, strengthen governance, improve enterprise intelligence, and create lasting organisational value.Takeaways:1. Quantum readiness is now a boardroom issue. Louise makes the case that post-quantum security has moved beyond the technical layer. It now belongs in enterprise governance, risk management, transformation strategy, and board oversight.2. The communication gap is one of the biggest blockers. The people who understand the quantum threat are often technologists, while the people who control funding, risk appetite, and enterprise priorities are boards and executives. The challenge is translating the issue into language decision-makers can act on.3. Traditional risk models do not handle quantum risk well. Quantum risk does not fit neatly into standard operational risk taxonomies. It is time-shifted, systemic, infrastructure-level, and difficult to assign to a single owner.4. Digital trust may be the real asset at risk. The episode repeatedly comes back to trust. Cryptography underpins authentication, authorisation, privacy, financial transactions, customer confidence, and the resilience of modern digital business.5. Harvest-now-decrypt-later is already a live issue. Louise stresses that quantum risk is not purely future-facing. Sensitive data may already be exposed if adversaries are collecting encrypted information today to decrypt later.6. Boards need to understand their fiduciary exposure. If boards are made aware of the scale of the risk and still fail to act, the issue becomes one of governance failure and fiduciary responsibility.7. This is bigger than IT and cybersecurity. Quantum risk affects financial services, insurance, operational technology, manufacturing, logistics, public safety, and the physical systems connected to digital infrastructure.and many more....SoundBytes:“The people who understand the problem often are not the people who own the decision.”“Quantum risk challenges the way organisations think about ownership, accountability, and authority.”“Digital trust does not belong to one function. It belongs to the organisation as a whole.”“The board is the only place high enough to own a risk of this scale.”“This is not just about avoiding risk. Done properly, quantum readiness can create long-term enterprise value.”

Ask this episode

“What did the council decide on item 42?” — answered with the speaker and the moment.

Transcript

Related