Article in a snapshot:

• Why quantum is barely in the conversation
• The companies thinking about quantum risk
• What “attack path agnostic” actually means
• When the theft and the loss are years apart
• Why the insurance conversation moves faster than the regulatory one
• What to raise with clients now

Brit team members featured in this article

In the first article in this series, we looked at how the quantum timeline has tightened and why attackers are already stealing encrypted data on the assumption they might be able to decrypt it later. This second article turns to what the insurance market is doing about it.

If you were to ask a cyber underwriter what has dominated their client meetings over the past year, quantum will not be the answer.

Connor Corcoran, our Senior Underwriter for Global Cyber, Privacy and Technology, is candid about where quantum currently sits; “We are having  conversations about quantum at the moment, predominantly with our larger regulated client base However, the AI revolution continues to dominate the discussion, and sap oxygen from other topics, such as quantum. 

Why quantum is barely in the conversation

Cyber risk moves in cycles of attention. A new technology or attack path arrives, the industry talks about little else, and then something replaces it. By Connor’s reckoning, artificial intelligence has held that position for around twelve months, understandably so, but it has left less room for everything else. 

Connor is clear that expectations on clients need to reflect where the technology actually is; “It is not currently feasible to expect our clients to have significantly invested directly into quantum readiness. This is in part due to competing investment priorities surrounding cyber risk, to deal with more immediate threats.“

A client without a post-quantum programme is not necessarily behind. The tooling is not widely available, the standards are still bedding in, and no underwriter is currently expecting to see one.
Claims data makes the same point differently. Connor notes that emerging technology has changed the pace of attacks rather than their nature. Claims are accelerated by AI, but follow familiar paths: social engineering, credential theft, standard data breaches. 

The 2025 attacks on the UK retail sector are a case in point. Marks & Spencer, Co-op and Harrods were all affected. At the time, NCSC warned that attackers were impersonating IT help desks to have staff credentials reset, urging organisations to review their password reset processes. M&S later confirmed to a parliamentary committee that the intrusion came through a sophisticated social engineering attack involving a third party. Basic social engineering obtained basic credentials, and the data was extracted once the attacker was ready. confirmed to a parliamentary committee that the intrusion came through a sophisticated social engineering attack involving a third party. Basic social engineering obtained basic credentials, and the data was extracted once the attacker was ready. 

Social engineering will always be a continued point of exploitation for threat actors, even while the supporting technology within the attack path evolves.

The companies thinking about quantum risk

While most of what we’ve covered so far in this series has been centred on the theoretical element of quantum risk, rather than real-world examples, large, sophisticated tech firms are among those taking steps to prepare. Dan Brown is our Senior Underwriter for Technology. He specialises in Tech E&O and believes that there are two sides to the story in terms of quantum readiness. 

Dan notes; "The businesses thinking hardest about this are the ones with the most sensitive information to protect. That might be defence organisations, payment companies, or those providing or protecting critical infrastructure”

“They're protecting information that has enormous long-term value, so naturally they're among the first to think about what a post-quantum world looks like." Unsurprisingly, companies with a forward-thinking tech sensibility are already working towards post-quantum cryptography (PQC)”.

Dan continues; “Alongside the effort to build quantum computers, there's another race taking place to develop post-quantum cryptography. There are already businesses building software and security systems designed specifically to operate in a world where quantum computing exists.”

For many organisations, preparation is about understanding what needs to change before the arrival of quantum. 

What “attack path agnostic” actually means

Hackers do not usually begin with a fixed view of how they want to get in. They look for what is open to them. That might be a weak password, a stolen credential, a compromised supplier, a phishing email, a manipulated help desk process, an exposed system or, in time, data made readable by quantum capability. The method matters less than the opportunity.

That is what attack path agnostic means. Intrusions can be facilitated by artificial intelligence, by quantum decryption or by more traditional social engineering techniques. The supporting technology may change, but the underlying pattern is often familiar: someone gains access, moves through an environment, extracts data or disrupts systems, and uses that position to cause harm.

Both Connor and Tim Hodgkins, our Cyber Underwriting Consultant, are clear that attackers will use whatever route gives them the best chance of success. To some degree, clients need to think in the same way. Not because the method does not matter, but because focusing too narrowly on the technology making headlines can obscure the more practical question: where is the organisation most exposed?
Quantum may change what becomes possible once data has been taken, but it does not make today’s controls irrelevant. Even a future quantum-enabled scenario is still likely to depend on access being gained somewhere first.

The practical point for clients is not to wait for a perfectly defined quantum event, but to keep strengthening the routes attackers are most likely to exploit now.

The question brokers raise most often is what clients can do about their quantum risk now and in the future.

When the theft and the loss are years apart

The first article in this series set out harvest now, decrypt later. From an risk perspective it raises an unusual question, because the intrusion and the harm it causes may sit years apart.
 Connor points out that data taken six years ago, held in hope that decryption eventually arrives, may have lost much of its relevance by the time it becomes readable. Data taken this year is a different proposition, because the wait is far shorter and far more predictable. Also, the nature of the data stolen is very pertinent. 

The industry, like its clients, is still learning what this risk looks like in practice. What Connor is clear about is the response, and it is the same one that applies to any data risk: readiness and data hygiene, making sure the data a business holds is still relevant, that it is protected and segregated, and that highly sensitive material is categorised as such.

Why the insurance conversation moves faster than the regulatory one

An outside view is useful here. J. Foster Davis is Co-Founder and COO of BreachBits, a Brit partner whose teams hack client organisations with their permission, to find and secure vulnerabilities before genuine attackers reach them. His view of where security standards come from is not the one most people expect; “Insurance is superior to regulation, because regulation is so slow and by the time regulation comes out it is outdated and actually irrelevant. And hackers thrive in that.”

His observation is that many organisations adopt good security practice because their insurer requires it, not because a regulator asked. Requirements attached to cover move at the speed of the threat rather than the speed of legislation. Which means a business that has already matured its security processes under insurer scrutiny is not starting from scratch with quantum. It can adapt from what it has already built.

What to raise with clients now

Three conversations are available to have with your clients immediately around the quantum risk;

Connor is explicit that insurers would rather be approached early, and that the industry collectively holds relationships with some of the world’s strongest security vendors. Alignment with the standards offered by these vendors offers your clients a defensible baseline while the quantum picture develops.

Have a quantum conversation with the cyber team today

Nobody has the full answer yet, and Connor is comfortable saying so. What he is less comfortable with is the assumption by many businesses that it’s an issue for the future; “There is certainly a lack of a conversation currently, and it is closer than ever. Encourage them to start thinking about it, encourage readiness programmes, encourage alignment with some of the major frameworks.”

Cyber insurance is one area where real collaboration between brokers, insurers, clients and vendors already happens exceptionally well. That habit is what will carry the market through a risk nobody can yet size precisely.

As Connor puts it; “the ambition is to build an industry that is proactive rather than reactive. That starts with brokers raising quantum before a client asks about it.” Dan adds his perspective on the comparison to AI; “Years ago, machine learning was seen as a niche subject. Then businesses started applying it to specific problems. Then came frontier AI labs developing large language models and advanced systems. Now AI is being adopted at scale across enterprise organisations.
When you look at that journey, what stands out is how quickly a technology can move from being theoretical to being embedded across business.”

Dan doesn’t necessarily believe that quantum follows the same path, but it shows how quickly technology can move once momentum builds. “In fact, the leap in computer power which is powering AI when used in combination with a reliable quantum computer will be what really turns the dial in terms of pace of change.  And if AI had taught us anything it’s that when the big leap in technology happens, it will happen fast.” That's why quantum isn't something that's easily dismissed as science fiction anymore.

In the final article in this series, we look at the practical steps clients can take now, and why the same physics that threaten today’s encryption also promises a stronger replacement.

To talk through quantum readiness with your clients, explore our cyber risk management services or speak to the Cyber team today