How serious is it now? Are we at an inflection point?
Answer
Yes, and you can see it in three places. The cost of an attack keeps falling: in 2019, breaking RSA-2048 was estimated to need 20 million qubits; in 2025 Google cut that to under a million, and this year every new estimate went lower again. Google, which is building these machines, and Cloudflare have both pulled their own migration deadlines in to 2029. And policy now has dates: federal high-value systems need post-quantum encryption by the end of 2030 and signatures by 2031. Nobody can build those machines yet. But attackers can record encrypted traffic today and decrypt it later, so the risk is already here.
Related questions
“So when is Q-Day?”
Nobody knows, and that’s the point. Gidney supports deprecating after 2030 not because he expects the machines by then, but because he’d rather not bet on progress being slow.
“Isn’t this vendor hype?”
The dates come from NIST and the White House. And Google, which builds quantum computers, moved its own deadline to 2029. Cloudflare did too, and it’s careful to say 2029 isn’t a prediction of Q-Day; it’s the deadline to be ready.
Learn more
- NIST IR 8547: Transition to Post-Quantum Cryptography StandardsNIST, Oct 2026
- Executive Order 14412: Securing the Nation Against Advanced Cryptographic AttacksWhite House, June 2026
- How to factor 2048-bit RSA integers with less than a million noisy qubitsCraig Gidney, Google, 2025
- Safeguarding cryptocurrency by disclosing quantum vulnerabilities responsiblyGoogle Research, Mar 2026
- Shor’s algorithm compiled on cat qubits: 22,593 qubits for RSA-2048 in 3.14 daysAlice & Bob, IACR ePrint, Oct 2026
- Cloudflare targets 2029 for full post-quantum securityCloudflare blog, Apr 2026
- Quantum Threat Timeline Report 2025Global Risk Institute
How does a security leader begin determining exposure?
Answer
I use Mosca’s inequality. Three numbers: how long your data has to stay secret, how long it’ll take you to migrate, and how long until an attacker has a capable quantum computer. If the first two add up to more than the third, you’re already exposed. For a CISO, that becomes three questions: what data has to stay confidential for seven to ten years or more, where does it cross networks someone could record, and is it protected by RSA, ECC or Diffie-Hellman? Now here’s where I’ll be a bit contrarian. Everyone tells you to start with a full cryptographic bill of materials. But in a big organization that can take a whole procurement cycle, and it’s stale the day you finish it. Cloudflare suggests a “quantum impact inventory” instead. Don’t ask where all our crypto is. Ask what happens if this system is compromised, how likely that is, and what reduces the risk. That gets you moving on what matters while the full inventory catches up. In the G7’s six phases, this is discovery and then risk assessment: where is it, and in what order do we fix it?
Related questions
“What tools find the crypto in my environment?”
PQCA has open-source CBOM tooling, and NIST’s NCCoE Migration to PQC project has practical discovery guidance.
“Don’t we still need a CBOM?”
Yes, eventually, and sooner for crown-jewel systems. It’s not either-or. The point is not to make a complete inventory the gate before you protect anything. You can tunnel internet-facing traffic through post-quantum infrastructure before every system is cataloged.
“What counts as a cryptographic asset?”
Certificates, keys, algorithms, libraries, protocols and HSMs, plus the systems and data they protect.
Learn more
- The White House’s post-quantum executive order is an important milestoneCloudflare blog, June 2026 (source of the “quantum impact inventory”)
- CBOMkit: open-source CBOM generation and viewerPost-Quantum Cryptography Alliance, Linux Foundation (free)
- QuCode: post-quantum discovery and exposure reportingArcQubit (commercial)
- QuTrust: post-quantum migration management and evidenceArcQubit (commercial)
- Migration to Post-Quantum Cryptography projectNIST National Cybersecurity Center of Excellence
How does quantum fit with competing priorities?
Answer
Don’t run it as its own program. Attach it to work that’s already funded: certificate automation, vendor risk reviews, procurement standards and refresh cycles. Procurement is the biggest lever. Where post-quantum support is widely available, in cloud platforms, browsers and servers, messaging and disk encryption, CISA says buy only products that support it. Most of your progress will come from vendors, and contract language costs almost nothing. And for every finding, ask who owns it: your team or a supplier. Supplier-owned items need a name, a date and contract language.
Related questions
“We have no budget.”
Most of the cost folds into refresh cycles you’ve already planned. The new spend is mostly people time for inventory and contract language.
“What goes in the contract?”
Post-quantum support by default at no extra cost, a dated roadmap, a CBOM (CycloneDX 1.6 or later), and notice when the vendor changes or deprecates an algorithm.
Learn more
- Product Categories for Technologies That Use Post-Quantum Cryptography StandardsCISA
- The White House’s post-quantum executive order is an important milestoneCloudflare blog, June 2026 (source of the “quantum impact inventory”)
What are the most meaningful steps today?
Answer
Five things. Protect internet-facing traffic first, because it’s the easiest to harvest. Put post-quantum requirements into procurement. Start on signatures and PKI now: root certificates and code signing have the longest dependency chains. Build crypto-agility, so the next algorithm change is a configuration change and not a re-architecture. And define what “done” means. If a system supports post-quantum but still accepts classical-only connections, an attacker can downgrade it. So for every finding, ask four questions: where is it, in what order, who owns it, and can we prove it’s fixed?
Related questions
“ML-KEM-768 or 1024?”
768 is NIST’s recommended default. Defense work under CNSA 2.0 uses 1024.
“Is hybrid worth the trouble?”
Yes. NIST allows hybrid classical-plus-post-quantum, and it has said the 2035 disallowance isn’t meant to apply to hybrid modes.
Learn more
- FIPS 203: Module-Lattice-Based Key-Encapsulation Mechanism (ML-KEM)NIST
- Post-quantum adoption on the InternetCloudflare Radar (live data)
- Open Quantum Safe (liboqs)PQCA open-source library for developers
- CNSA 2.0 algorithms advisoryNSA (for defense contractors)
Advice for a CISO who has done very little
Answer
Don’t panic, and don’t wait. In the first six months: name an owner, brief the board, find your long-lived sensitive data, and update procurement language. From six to twelve months: discovery on your highest-value systems and vendor surveys on post-quantum roadmaps. In year two: hybrid post-quantum TLS on external traffic, a PKI pilot, and crypto-agility standards for new development. That sequence follows the G7’s six phases: prepare, discover, prioritize, migrate, test, and monitor. And you’re not alone. Average readiness in industry surveys is about 25 out of 100.
Related questions
“Is there a standard framework for this?”
The G7 Cyber Expert Group published a six-phase roadmap in January 2026: prepare, discover, prioritize, migrate, test and monitor. It was written for the financial sector, but it works for anyone.
“How do we know when we’re actually done?”
Four questions for every finding: where is it, in what order, who owns it, and can we prove it. Done means verified: a rescan confirms the change, and classical-only connections are refused so nobody can downgrade you.
“What do I tell my board?”
Three questions: where is our long-lived data, which vendors aren’t ready, and who owns this. If you can’t answer them yet, that’s the briefing.
Learn more
- Advancing a Coordinated Roadmap for the Transition to Post-Quantum Cryptography in the Financial SectorG7 Cyber Expert Group, Jan 2026
- Harvest now, decrypt later: enterprise research noteCloud Security Alliance, May 2026 (readiness survey data)
- CBOMkit: open-source CBOM generation and viewerPost-Quantum Cryptography Alliance, Linux Foundation (free)
- ArcQubit products and the six-phase migration roadmapArcQubit
Running the program: six phases, four questions
The six phases describe the program. The four questions are what every finding inside it has to answer.
The G7 lays out six phases for the program: prepare, discover, prioritize, migrate, test, and monitor. Inside that program, every finding has to answer four questions. Where is it? In what order do we fix it? Who owns it, including the pieces our suppliers own? And once it’s fixed, can we prove it? A system that supports post-quantum but still accepts classical-only connections hasn’t really been fixed, so “done” has to mean verified, not just deployed.
The six phases
| Phase | What happens | Which question it answers |
|---|---|---|
| 1. Awareness & Preparation | Executive owner, governance, board briefing | Sets up ownership for the whole program |
| 2. Discovery & Inventory | Find algorithms, keys, certificates and third-party dependencies | Where is it? |
| 3. Risk Assessment & Planning | Prioritize critical systems and long-lived confidential data | In what order? Who owns it? |
| 4. Migration Execution | Deploy post-quantum or hybrid algorithms, roughly 2026–2029 | The work itself |
| 5. Migration Testing | Confirm systems and external partners still interoperate | Can we prove it? |
| 6. Validation & Monitoring | Continuous crypto-agility; watch new threats | Can we prove it, continuously? |
The four questions, inside every phase
Where is it?
Find the quantum-vulnerable cryptography.
- What it means
- RSA, ECC and Diffie-Hellman in code, dependencies, certificates, configs, devices and vendor products. Start with your most important systems, not a complete census.
- Evidence
- A targeted inventory of crown-jewel systems, with coverage stated honestly (“we’ve scanned 40% of critical systems”).
In what order?
Rank by exposure and by how hard it is to change.
- What it means
- Long-lived sensitive data and internet-facing traffic first (harvest now, decrypt later). Roots of trust and code signing next, because they take longest. Regulatory deadlines can move items up.
- Evidence
- A ranked list that shows why each item sits where it does, and a dated roadmap.
Who owns it?
Put a name, or a supplier, on every finding.
- What it means
- Each finding is either yours to fix or a vendor’s. Supplier-owned items get a contact, a post-quantum date and a follow-up, and go into renewal terms.
- Evidence
- An owner and due date on every finding; vendor roadmap responses on file.
Can we prove it?
Verify after implementation, then keep verifying.
- What it means
- Rescan to confirm the change, and test that classical-only connections are refused, so an attacker can’t force a downgrade. Rescan on a schedule, because new code and new vendors bring new cryptography.
- Evidence
- Before-and-after scan results, handshake tests showing post-quantum key exchange, and a record a board or auditor can check.
Learn more
- Advancing a Coordinated Roadmap for the Transition to Post-Quantum Cryptography in the Financial SectorG7 Cyber Expert Group, Jan 2026
- ArcQubit products and the six-phase migration roadmapArcQubit
- QuCode: post-quantum discovery and exposure reportingArcQubit (commercial)
- QuTrust: post-quantum migration management and evidenceArcQubit (commercial)
- CBOMkit: open-source CBOM generation and viewerPost-Quantum Cryptography Alliance, Linux Foundation (free)
- Post-Quantum Cryptography AllianceLinux Foundation open-source projects, including Open Quantum Safe and CBOMkit
Facts to have ready
“Checked” items were confirmed against NIST, Google, Cloudflare, Alice & Bob and news coverage on November 5. The one item marked “Industry survey” comes from survey data and couldn’t be independently confirmed.
| What | The number | Status |
|---|---|---|
| EO 14412 signed | June 22, 2026: “Securing the Nation Against Advanced Cryptographic Attacks” | Checked |
| Federal key establishment (encryption) | High-value assets and high-impact systems by Dec 31, 2030 | Checked |
| Federal digital signatures | By Dec 31, 2031 | Checked |
| Federal contractors | Post-quantum FIPS compliance by end of 2030 | Checked |
| NIST IR 8547 final | Oct 27, 2026; RSA and ECC deprecated after 2030 and disallowed after 2035, at all key sizes | Checked |
| Hybrid after 2035 | NIST says the 2035 disallowance isn’t meant for hybrid modes | Checked |
| OMB M-26-15 | Agency migration plans due about Oct 22, 2026, before IR 8547 went final | Checked |
| RSA-2048 estimate, 2019 | About 20 million qubits | Checked |
| RSA-2048 estimate, 2025 (Gidney) | Under 1 million noisy qubits, under a week | Checked |
| 256-bit ECC (Google, Mar 31, 2026) | Under 500,000 physical qubits, about 20× fewer than before; minutes per key | Checked |
| RSA-2048 (Alice & Bob, Oct 29) | 22,593 physical cat qubits, 3.14 days; a preprint on its own hardware assumptions, not directly comparable | Checked |
| Industry deadlines | Google and Cloudflare both target 2029 (Cloudflare: a readiness deadline, not a Q-Day prediction) | Checked |
| Readiness | Average about 25 out of 100 (750 executives) | Industry survey |
| Default parameter set | ML-KEM-768; CNSA 2.0 (defense) uses ML-KEM-1024 | Checked |
Take it back to your organization
Five questions to ask yourself, and the challenge worth putting to your team for each.
How ready are we, honestly?
Ask yourself
Rate your organization from 1 to 10 on post-quantum readiness.
Challenge your organization
Could your team define a cryptographic asset today: certificates, keys, algorithms, libraries, protocols and HSMs, plus the systems and data they protect? Which blocker is really holding you back: visibility, vendor dependence, legacy and OT systems, or budget?
Could we brief our executives tomorrow?
Ask yourself
Imagine the board asks for a quantum risk update next week.
Challenge your organization
Can you answer three questions: where is our long-lived data, which vendors aren’t ready, and who owns this? If you can’t yet, that is your first finding, not a failure.
What would we fix first?
Ask yourself
Name the one system you would protect first.
Challenge your organization
Have you considered that there’s no single answer? Long-lived confidential data comes first because of harvest now, decrypt later. Roots of trust and code signing come next because they take the longest. Critical availability systems follow.
What will we have done in 12 months?
Ask yourself
Pick one milestone you could prove a year from now.
Challenge your organization
Good candidates: post-quantum TLS on all internet-facing traffic, post-quantum clauses in every new contract, or a cryptographic inventory for your top 10 crown-jewel applications. Which one can your team commit to, with an owner and a date?
Is this really a priority?
Ask yourself
Be honest about whether it is funded, not just agreed.
Challenge your organization
If the answer is “yes, but unfunded,” have you considered folding the work into certificate automation, vendor reviews and refresh cycles that are already in the budget?