The answer, up front
Building edge controllers and access gateways often stay in service for 15 to 20 years, so the encryption protecting them today will likely outlive the hardware. That mismatch is the core of the quantum-era problem for commercial facilities, from office towers to hotels. The current reporting is led by vendor and opinion pieces, which should be read as viewpoints rather than independent findings, but the shared point is credible: equipment with long lifecycles bought now carries encryption that a future quantum computer could break, so purchasing and architecture decisions made today have long tails.
Smart buildings
A Propmodo article by a Neeve executive warns that adversaries can harvest building data such as security logs and intellectual property now and decrypt it later 1. It cites an NSA expectation of post-quantum support in new networking equipment beginning January 2027, calls 2028 a practical tipping point, and urges owners to move from legacy VPNs toward zero-trust architectures and to buy hardware with headroom for larger algorithms 1. The author works for a vendor and the piece is US-focused, so treat the dates as the author's framing.
Hospitality
Hospitality faces a similar exposure. In January 2026, Mark Fancourt argued in Hotel Online that much of global digital security, hospitality systems included, rests on algorithms quantum computers could break, and he criticized the industry's weak baseline information-security practice while a major cryptographic transition approaches 2. The piece is opinion with limited technical depth, so it signals concern more than it establishes fact.
The payments angle
Card acceptance gives facility operators a more specific read. A 2025 Mastercard research white paper, written with contributors from NTU Singapore and PQStation, estimates a cryptographically relevant quantum computer is at least 10 years away and probably 20 or more, and argues card-transaction harvest risk is low because EMV cryptograms are single-use and symmetric, while long-lived digital signatures form the harder migration problem 3. Hotels and retailers sit on that card-acceptance infrastructure, though the paper targets financial services.
What this means for facility owners
The honest first steps need no facility-specific standard: inventory where cryptography lives across building and payment systems, prioritize the long-lived trust anchors and access controls, and write crypto agility into new hardware tenders so a later algorithm change does not force a rip-and-replace.
How ArcQubit approaches it
ArcQubit treats discovery as the foundation. QuCode maps where vulnerable cryptography sits across building and enterprise systems, and QuTrust holds the migration plan so owners can sequence upgrades against real hardware refresh cycles rather than all at once.