The quantum audit

This evening, I am chairing a quantum debate at the City CIO Club with Richard Murray, who co-founded ORCA Computing. Hosted at the Walbrook Club, I am really looking forward to this. Richard is an excellent communicator.

He has spent seven years building photonic quantum machines designed to sit in commercial data centres next to the GPUs. In June his kit went into Digital Realty's new innovation lab in London, which tells you where the company thinks the market is.

I thought you might like to see the pre-read for the dinner to arm our CIOs with some questions Richard.

What companies are using quantum for

Finance is furthest along and the results are getting harder to wave away. HSBC ran an experiment with IBM on production-scale bond data, more than a million quote requests across 5,000 corporate bonds, and reported up to a 34% improvement in predicting whether a trade would be filled at a quoted price.

Vanguard published work with the same team on portfolio construction under real-world constraints. Both were run on historical data rather than live trades, which matters, though the point stands that somebody finally measured something.

Pharmaceutical and chemical companies use quantum simulation for molecular binding, catalyst design and battery materials, because modelling electron behaviour is the one job where classical machines hit a wall that more compute will not fix.

Aerospace, logistics and energy companies are working on combinatorial optimisation, which covers routing, scheduling and anything carrying hundreds of constraints. Telecoms and industrials are testing quantum machine learning on high-dimensional pattern problems such as fraud.

Almost all of it runs as hybrid quantum-classical work through the cloud, with the quantum processor behaving as a specialist accelerator alongside CPUs and GPUs rather than as a replacement for either.

Is it useful?

McKinsey's latest technology monitor counts more than 300 organisations collaborating with quantum providers, including JPMorgan, Airbus and Boehringer Ingelheim, and revenue across quantum computing companies passed $1bn in 2025.

The State of Quantum 2026 survey has 89% of enterprises reporting hands-on quantum work, 10% with limited production use and 3% running it at scale. Investment reached $8.3bn in 2025, driven by bigger deals rather than more of them. IBM's Enterprise 2030 study found 59% of executives expect quantum-enabled AI to transform their industry by 2030 while only 27% expect to be using quantum themselves.

Nearly everyone is experimenting, very few are in production, and the distance between those two numbers is the argument we are having on Wednesday.

The clock with dates on it

The security side comes with a timetable, which makes it a governance matter rather than an innovation one. The NCSC has set three milestones for UK organisations: cryptographic discovery and a migration plan by 2028, high-priority systems migrated by 2031 and full migration by 2035.

The threat underneath the timetable is harvest now, decrypt later.

An attacker takes encrypted data today and holds it until a machine exists that can open it. Anything you encrypt with a value life beyond ten years is already exposed, which covers medical records, legal files, government contracts, deal material and most of what an insurer sits on.

Scary.

Resource estimates for breaking today's encryption have been falling too. Papers this year proposed that RSA-2048 might need fewer than 100,000 physical qubits, and that the curve protecting most digital signatures might need fewer than 500,000, against machines that today run hundreds to thousands of noisy ones.

Those are theoretical proposals rather than demonstrations, and they still moved the estimate in the wrong direction.

To consider...

Quantum sits in two boxes on the board agenda and they move at different speeds with different ROI stories.

The cryptography box is live now, has fixed dates and belongs to your CISO with a budget attached.

The compute box is a watching brief with a small learning budget, a named owner and one problem to point it at, so that when the hardware does arrive you have people who know what to ask for instead of a procurement exercise starting from zero.