What Quantum Computing Actually Is

Most executives have already seen the slide. A 300-qubit quantum computer, it says, can represent 2^300 states at once, which is around 2 x 10^90, comfortably more than the roughly 10^80 atoms in the observable universe. The arithmetic is correct. The conclusion normally drawn from it isn’t, and the distance between the two is where a great deal of quantum budget goes to die.

The story that follows the slide is that a quantum computer tries every possible answer simultaneously and returns the right one. Executives who believe that fund pilots in the wrong places, wait for hardware that won’t help them, and defer the one quantum project that has a date attached to it.

What a qubit actually is

A classical bit is a switch. It holds a 0 or a 1, and a machine with three bits can be in any one of eight configurations, one configuration at a time.

A qubit is a two-state quantum system, built from a superconducting circuit, a trapped ion, a photon or a neutral atom, depending on the manufacturer. Its state is described not by a single value but by two numbers called amplitudes, one attached to the 0 outcome and one attached to the 1. That combined condition is superposition. Three qubits carry amplitudes for all eight configurations at the same time, and n qubits carry amplitudes for 2^n of them. That is the exponential number on the slide, and it is real.

Entanglement is the second property. Two qubits can be prepared so that their outcomes are correlated no matter how far apart they sit: measure one and you learn something about the other, instantly, with no signal passing between them. Einstein’s word for it was spooky, and the correlation is genuinely strange, but nothing travels and no message is sent. What entanglement buys a computation is the ability to make the amplitudes of many qubits depend on one another, which is what makes a quantum algorithm more than a set of parallel coin flips.

Why the state-space number misleads

You can’t read those 2^n amplitudes. When a quantum computer is measured, it collapses to exactly one n-bit answer, chosen at random according to the amplitudes. A machine holding 2^300 amplitudes still gives you 300 bits when you look at it, the same as any classical register.

Amplitudes can be negative, or complex, so paths through a computation can cancel each other. The entire craft of quantum algorithm design is arranging that cancellation, which is called interference, so that the amplitudes on the wrong answers destroy one another and the amplitude on the right answer survives to dominate the measurement. That is why quantum speedups are rare and specific rather than general. Nobody has found a way to arrange that interference for most problems, and for many problems there is good reason to think it can’t be done.

We labour this point in every executive session we run, because it is the single correction that changes how a leadership team allocates money. A quantum computer is dramatically better at a short list of mathematical structures and no better at all at everything else.

What the machines can do today

Two numbers are needed to read any hardware announcement, and vendors rarely separate them cleanly.

A physical qubit is a piece of hardware. It is noisy: it decoheres in microseconds to milliseconds and its gates fail at rates in the range of one error per hundred to one per thousand operations. A logical qubit is an error-corrected qubit assembled from many physical ones, using a scheme such as the surface code, so that errors are detected and repaired faster than they accumulate. Every serious cryptographic or chemistry application is specified in logical qubits. Every headline number is in physical qubits.

The gap between them is the whole engineering problem. IBM’s Condor processor reached 1,121 physical qubits in December 2023, and IBM’s more recent effort has gone into smaller, cleaner chips rather than larger ones. Quantinuum’s trapped-ion systems run in the tens of qubits with much lower error rates and much slower gates.

None of these machines has run a commercially useful computation faster than a classical computer could. It’s the honest state of a technology roughly where classical computing was when a room-sized machine could add numbers, and the current work is error correction rather than qubit count.

Where quantum computing plausibly wins

Four problem classes have credible quantum advantage, in descending order of confidence.

Simulating quantum systems. Molecules and materials are quantum objects, and classical computers approximate them expensively. This is the application Richard Feynman proposed in 1981, it has the clearest theoretical footing, and catalysis and battery chemistry are the usual commercial targets.

Factoring and discrete logarithms. Peter Shor’s 1994 algorithm solves both exponentially faster than any known classical method. This is the cryptographic problem, and it is treated separately below.

Unstructured search. Lov Grover’s algorithm finds a marked item among N possibilities in roughly the square root of N steps. A quadratic speedup is real but modest, and it is often eaten by the overhead of running on quantum hardware.

Optimisation and machine learning. The most heavily marketed category and the weakest evidence. Variational and annealing approaches have produced no durable advantage over well-tuned classical solvers, and quantum machine learning faces a loading problem: getting a large classical dataset into a quantum state can cost more than the computation saves. Treat vendor claims in this category as research collaborations, not procurement.

Everything else stays classical. Word processing, databases, web serving, video encoding, most numerical simulation, and any workload that already parallelises well across ordinary processors won’t benefit. Quantum computers will be accelerators reached through a classical machine, in the way a GPU is today.

The deadline that is already running

One quantum application affects every organisation whether or not it ever buys quantum hardware.

Asymmetric cryptography, the kind that uses a public key and a private key, is what lets two parties who have never met agree on a secret over an open network. RSA, Diffie-Hellman and elliptic-curve cryptography all rest on the difficulty of factoring or of discrete logarithms, and Shor’s algorithm dissolves both. A machine capable of running it at scale is called a cryptographically relevant quantum computer, or CRQC.

The resource estimates have moved fast, and that movement is the story. In 2019, Craig Gidney at Google and Martin Ekerå at KTH estimated that breaking RSA-2048 would take about 20 million noisy physical qubits running for eight hours. In May 2025 Gidney revised the estimate to fewer than one million noisy qubits running for under a week. No hardware got better in that period. The algorithms and error-correction schemes did.

Symmetric cryptography and hashing are in far better shape. Grover’s algorithm halves preimage security, so AES-256 and the preimage resistance of SHA-256 behave like 128-bit against a quantum attacker. Collisions are a separate matter: an n-bit hash already offers about 2^(n/2) collision resistance classically, and the best known quantum collision attacks bring that to roughly 2^(n/3), so SHA-256 would sit near 2^85. Doubling key sizes and moving to larger hashes restores the margin, which is why the NSA’s CNSA 2.0 suite mandates AES-256 and SHA-384. There is also a practical argument that Grover’s speedup is largely theoretical, because the algorithm resists parallelisation and the sequential circuit depth involved is astronomical. Symmetric cryptography is a key-length decision. Asymmetric cryptography is a replacement programme.

Why the deadline is earlier than the machine

Encrypted traffic can be captured today and stored until a CRQC exists. That practice is called harvest now, decrypt later, and it moves the deadline forward by the confidentiality lifetime of the data. An organisation holding records that must stay secret for 25 years is already late, whatever year the hardware arrives.

The replacement algorithms exist. NIST published FIPS 203, 204 and 205 on 22 August 2024, standardising ML-KEM for key establishment (formerly Kyber), ML-DSA for signatures (formerly Dilithium) and SLH-DSA as a hash-based signature alternative (formerly SPHINCS+), with HQC selected in March 2025 as a backup key-encapsulation mechanism built on different mathematics. The standards are done. The migration isn’t, and it touches certificate authorities, code signing, VPN concentrators, single sign-on, payment terminals, industrial controllers and firmware that shipped with a ten-year service life and no way to update its cryptography.

What to take from this

Quantum computers are narrow accelerators, not general ones, and the state-space number on the slide describes potential rather than output. The hardware timeline is genuinely uncertain and the algorithmic estimates have consistently moved in the uncomfortable direction. And the cryptographic exposure is an inventory-and-replacement problem you can start on this quarter with no quantum hardware anywhere in the building.

That last point is where technical literacy stops being interesting and starts being operational. A leadership team that understands the difference between a physical and a logical qubit will read vendor claims correctly. A team that also understands where its own RSA and elliptic-curve dependencies live will know how long its migration takes.

Quantum Academy’s executive-track programs are built for exactly that second reader: enough of the physics to evaluate a claim, and enough of the cryptographic detail to scope a migration. You can see the current programs and access options at quantumacademy.com/.

For the migration methodology itself, including cryptographic inventory and prioritisation, see pqcframework.org.