THE READINESS GAP

Quantum risk operates on three clocks.

There is no universally accepted date for the arrival of a cryptographically relevant quantum computer. But organizations do not need one to understand the strategic problem.

Researchers continue to make progress toward more capable and reliable quantum systems. A recently published Chalmers University breakthrough, for example, demonstrated a method for performing certain advanced quantum operations more than 1,000 times faster, addressing one of the bottlenecks associated with fault-tolerant quantum computing.

Modern cryptography is embedded throughout applications, networks, identities, certificates, cloud services, devices, software libraries and supply chains. NIST describes migration as a process beginning with cryptographic visibility and inventory, followed by risk assessment, planning and ultimately transition. Its current roadmap calls for quantum-vulnerable algorithms to be deprecated and ultimately removed from NIST standards by 2035, with higher-risk systems moving sooner.

Sensitive information stolen today may remain valuable years from now. That creates the possibility of harvest-now, decrypt-later attacks: adversaries collect encrypted information now and preserve it against the possibility that future capabilities allow them to decrypt it. NIST specifically identifies sensitive or long-lived data exposed to this threat as an important consideration in cryptographic inventory and migration planning.

Quantum readiness begins where these three clocks intersect.

WHY SPEED MATTERS

A ten-year transition and a ten-year threat horizon are not ten years apart.

The mistake organizations can make is treating 2030, 2035 or any other projected quantum milestone as the date on which action must begin. It is better understood as the date by which substantial work may need to be finished.

Cryptographic migration is not a software update. Organizations first need to determine where vulnerable cryptography exists, understand what depends upon it, assess the sensitivity and lifespan of protected information, prioritize systems, coordinate vendors, test replacements and manage migration without disrupting operations.

NIST's guidance reflects precisely this progression. Its migration program begins with cryptographic visibility and risk management, including maintaining a comprehensive inventory capable of guiding the transition.

That changes the strategic calculation. The relevant countdown is not simply time until quantum. It is time until quantum minus time required to migrate.

For organizations protecting information that must remain confidential for many years, the calculation becomes even more urgent. The effective deadline can move earlier still because the useful life of the data must also be considered.

And for organizations protecting information that must remain confidential for many years, the effective deadline can move earlier still.

THE ENTERPRISE PROBLEM

Quantum readiness cannot not belong to the cryptography team alone.

As the transition progresses, PQC will increasingly touch infrastructure, identity, applications, cloud environments, procurement, supply chains, budgets and modernization programs.

That makes quantum readiness an enterprise architecture and management problem as much as a cybersecurity problem.

For federal agencies, the challenge extends even further. Technology suppliers and systems integrators become part of the migration surface because agencies depend upon cryptography embedded in products and services they do not completely control. NIST specifically notes that cybersecurity products, services and protocols will require updates as organizations transition.

Quantum readiness is therefore becoming something agencies will increasingly expect from their technology ecosystem—not merely something they perform internally.

01 / THE TECHNOLOGY CLOCK

How quickly is quantum capability advancing?