Quantum threat timeline raises cyber insurance questions for NZ brokers

A global cybersecurity firm has warned New Zealand organisations to prepare for quantum computing threats that could render current encryption obsolete by 2030, raising questions whether cyber insurance policies are equipped for the fallout.

Senior executives from Fortinet, which sells cybersecurity products including tools designed for post-quantum encryption, visited New Zealand last week to brief organisations across health, finance, energy and utilities on the combined risks of AI and quantum computing, as reported by Radio New Zealand (RNZ) .

For brokers, the compressed timeline puts a new category of long-tail exposure on the agenda.

How harvest now, decrypt later creates coverage uncertainty

The core concern is a strategy known as Harvest Now, Decrypt Later (HNDL). Cyber criminals are collecting encrypted data now with the intention of decrypting it once quantum computing reaches sufficient capability.

Filippo Cassini, senior vice president and global chief technical officer at Fortinet, told RNZ that bad actors were already preparing for what the industry calls Q-Day.

Wei Ling Neo, vice president of product management at Fortinet, said investment had shortened the quantum timeline. “(It) has been shortened by a lot of investments into quantum computing, which has brought the timeline much closer to [20]29 and 2030, for when we will have a viable quantum computer that will be able to decrypt the current algorithms that we use,” Neo said.

That creates a timing problem for cyber insurance. Data harvested in 2026 could become a fully realised breach in 2030 or later.

Most cyber policies are written on a claims-made basis, responding to claims made or incidents discovered during the policy period, rather than to when the underlying event occurred. In principle, that means a breach discovered in 2030 would fall to the policy in force in 2030. In practice, two features of the policy matter. The first is the retroactive date: many policies exclude incidents that began before a specified date, and data theft in 2026 could fall on the wrong side of it if a client changes insurer or lets cover lapse. The second is continuity: a client who drops cyber cover, or moves to an insurer offering a later retroactive date, could lose protection for data stolen years earlier.

For brokers, the questions are whether clients’ retroactive dates protect them against breaches that began well before discovery, and whether insurers begin adding specific wording or exclusions for this kind of exposure.

Duncan Morrison, cyber practice leader at Aon New Zealand in Auckland, has previously noted the importance of boards understanding their financial exposure from cyber events. “Without that financial lens, cyber risk can be underestimated or deprioritised,” Morrison said, as previously reported by Insurance Business . The quantum dimension adds a new layer to that calculation.

Read : Falling cyber alerts may not mean lower risk at renewal

NZ government is already moving on quantum readiness

New Zealand’s government has signalled that quantum readiness is a priority. The Cyber Security Action Plan 2026-2027, published by the Department of the Prime Minister and Cabinet (DPMC), includes a specific action led by the National Cyber Security Centre (NCSC) to “enable New Zealand to process and manage quantum-resistant cryptographic material.”

The Government Chief Information Security Officer (GCISO) has also reported to the Treasury that agencies’ investment proposals do not dedicate enough time and resources to cyber security or emerging threats.

The New Zealand Information Security Manual (NZISM), updated in November 2025, now includes a section on post-quantum cryptography. It recommends that agencies inventory sensitive datasets needing long-term protection, identify systems reliant on public key cryptography, and develop transition plans. The Government Communications Security Bureau (GCSB) has noted it may deprecate current cryptographic standards within the two to three years.

While the NZISM guidance applies to government agencies, it offers a framework brokers can reference when talking to private sector clients their own preparedness, much as recent NCSC supplier-oversight guidance has shaped cyber insurance conversations.

Broader preparedness remains low

A 2025 poll of more than 2,600 professionals by ISACA found that 55% had taken no preparatory action on quantum computing threats. Only 5% had a defined strategy, and 37% had never discussed the topic within their organisation. Respondents from Oceania showed concern at least 10 percentage points above the global average.

Jamie Norton, ISACA board director, said: “Too many Australian and New Zealand organisations remain in reactive mode.”

Cyber threats are already escalating in NZ

The quantum risk arrives on top of a worsening threat environment. The NCSC’s Cyber Threat Report 2025 recorded 331 incidents of potential national significance in the 2024/25 year. Criminal or financially motivated actors accounted for 137 of those, up from 65 the year. Direct financial losses reported to the NCSC reached $26.9 million, up from $21.6 million.

The report also found that 53% of small and medium enterprises experienced a cyber threat in the first half of 2025, up from 36% in 2024. A separate NCSC quarterly report for the first quarter of 2026 recorded three C2 (highly significant) incidents, the first at that severity level since the 2021/22 financial year.

The NZ cyber insurance market has softened even as threat levels have risen, with Aon classifying conditions as soft in the first quarter of 2026.

Read : NZ cyber threat rises as insurance market moves the other way

What should brokers be asking clients?

Neo said many organisations remain focused on AI without assessing their broader exposure. “The timeline is getting shorter and shorter for them to be ready, to protect against quantum threat,” she said.

Cassini said upgrades would be costly but necessary. “I think they should be looking at how safe and upgradable it is. It’s a little bit of extra money, but I think it’s worth it,” he said.

Under the Privacy Act 2020, New Zealand organisations must take reasonable steps to protect personal information. As quantum threats become more widely documented, what qualifies as “reasonable” may shift to include readiness for quantum-safe encryption. The Cyber Security Action Plan also notes that the Ministry of Justice is advising on incentives to protect personal information, including a potential civil pecuniary penalty regime under the Privacy Act.

Research firm CyberCube noted in January 2026 that insurers are beginning to explore indicators of cryptographic readiness, although discussions remain focused on education and scenario analysis rather than pricing changes.

For brokers, client conversations cyber cover should now include questions retroactive dates and continuity of cover, data retention policies, encryption standards, and whether systems can be upgraded to post-quantum cryptography before the 2030 window closes.