Post-Quantum Cryptography Readiness: Migrating to Quantum-Safe Encryption Before Q-Day

Most cryptographic migrations are engineering projects. The transition to post-quantum cryptography (PQC) is unusual because the deadline is set by an adversary’s future capability, the exposure was created by decisions made years ago, and the remediation window closes whether or not an organization has budgeted for it.

The concept at the center of it is Harvest Now, Decrypt Later: an adversary intercepts and stores encrypted traffic today, holds it, and decrypts it once a cryptographically relevant quantum computer (CRQC) exists. Nothing has to be broken today for the loss to occur. Data with a confidentiality half-life beyond the arrival of a CRQC (patent files, M&A correspondence, supplier contracts, health records, geological survey data, sovereign communications) is already exposed at the moment of transmission.

The Q-Day Arithmetic Changed Faster Than The Migration Plans

The long-standing baseline was Gidney and Ekerå’s 2019 estimate of roughly twenty million noisy qubits. In May 2025, Google’s Craig Gidney published a revised figure below one million. By February 2026, work on quantum low-density parity-check codes had pushed the floor to approximately 100,000. Then, on 30 March 2026, a team from the neutral-atom start-up Oratomic and Caltech including John Preskill published an analysis concluding that Shor’s algorithm can be executed at cryptographically relevant scale with as few as 10,000 reconfigurable atomic qubits, with discrete logarithms on the P-256 elliptic curve solvable in days on a 26,000-qubit machine.

The number that matters for a risk committee is the one alongside it. The largest neutral-atom array demonstrated to date, in the laboratory of an Oratomic co-founder, holds roughly 6,100 qubits. It has not been used for computation, and no public hardware roadmap claims a routine RSA-2048 break before the end of this decade. But the gap between the algorithmic requirement and demonstrated hardware has narrowed from six orders of magnitude to well under one.

The estimated cost of breaking RSA-2048 has fallen by three orders of magnitude in seven years

From Advisory Guidance to Dated Obligation

The regulatory position shifted decisively in mid-2026. On 22 June 2026, Executive Order 14412, Securing the Nation Against Advanced Cryptographic Attacks, set hard federal deadlines: post-quantum key establishment for all high-value assets and high-impact systems by 31 December 2030, and post-quantum digital signatures by 31 December 2031. Agency PQC migration leads had to be named within thirty days; the OMB memorandum issued two days later required agency migration plans by 22 October 2026.

The consequential provision is not the agency deadline. It is Section 6(c), which directs the FAR Council to propose rules requiring covered contractors to comply with post-quantum FIPS by 31 December 2030, a year ahead of the agencies they supply. The Department of War’s PQC Strategy, published the following day, requires all its systems to support PQC by end-2030 and use it by end-2031, noting that nearly every deployed military asset is affected. That converts a government programme into a supply-chain condition, and it will reach any firm that sells into that chain, including through tier-two and tier-three relationships.

Principal post-quantum migration mandates and roadmaps in force as of September 2026

Two features of this landscape deserve board attention. First, India’s timeline is materially more aggressive than the US or EU equivalents, full adoption by December 2029 against a 2030–2035 window elsewhere, while remaining advisory rather than statutory, with enforcement dependent on sectoral regulators such as the RBI, SEBI and TRAI. Indian enterprises and exporters therefore face a planning question rather than a compliance one today, and a compliance one the moment a sectoral regulator adopts the roadmap’s language. Second, the G7 framing is the most useful for a multinational: it is explicitly risk-based, it separates activities for institutions from activities for authorities, and it treats cryptographic agility rather than any single algorithm as the durable objective.

The Progress Illusion: Encryption is Well Ahead of Authentication

Public commentary tends to treat PQC migration as a single programme. It is two, with very different maturity curves, and conflating them produces a badly wrong risk picture.

Post-quantum encryption, replacing RSA and ECDH key exchange with ML-KEM (FIPS 203), typically in hybrid form as X25519MLKEM768, is what defeats Harvest Now, Decrypt Later. It is needed today, and deployment has been rapid where a single party controls the default. Post-quantum encrypted traffic rose from roughly 32% of human HTTPS requests across Cloudflare’s network in January 2025 to about 67% by April 2026, driven largely by browser and edge defaults rather than by customer decisions.

Post-quantum authentication, replacing RSA and ECDSA signatures with ML-DSA (FIPS 204) across certificates, code signing and identity, only matters once a CRQC exists, but has a far longer dependency chain: clients, servers, certificate authorities, certificate transparency logs, root stores and browsers must all move together. That work has barely begun.

The measurable expression of this gap is what happens behind the edge. Where organizations have not made an active decision, the traffic between a content delivery network and the customer’s own origin servers remains classically protected. Roughly 9% of scanned origin servers support post-quantum key exchange.

The practical reading for an executive team is uncomfortable but useful. Much of the post-quantum protection an organization currently enjoys was granted by a vendor’s default setting, not earned by its own programme, and it stops at the network edge. It is entirely possible to be two-thirds post-quantum at the perimeter and functionally zero per cent post-quantum in the systems that hold the data.

Where The Cost Actually Lands

Boards habitually underestimate PQC migration because they price it as an algorithm swap. Four cost drivers explain why it is not.

1. 1. 1. Payload and Performance

Post-quantum artefacts are an order of magnitude larger than the ones they replace. An Ed25519 signature of 64 bytes becomes 3,309 bytes under ML-DSA-65; a 32-byte public key becomes 1,952 bytes. Aggregated across a realistic certificate chain, the on-the-wire cost compounds sharply, with measurable effects on short-lived TLS connections, constrained devices and high-frequency transaction systems. This is precisely why Cloudflare and Google Chrome are jointly developing Merkle Tree Certificates, with initial deployments targeted for 2027.

1. 1. 2. Asset lifecycles that outrun the deadline

Any asset with a service life beyond 2030 that cannot accept a firmware-level cryptographic upgrade is a capital expenditure decision disguised as a security finding. This is the binding constraint in operational technology, industrial control systems, payment terminals, smart meters, medical devices, satellite payloads and telecom infrastructure. CISA’s product-category guidance is explicit that networking hardware, hardware security modules, certificate authorities, identity providers, email systems and databases are still in the transitioning category rather than the widely available one which means procurement teams cannot yet buy their way out of the problem in those categories, and specification language matters more than purchase orders.

1. 1. 3. Inventory as a trap

The instinctive first move is a complete cryptographic bill of materials. EO 14412 directs CISA and NIST to publish minimum CBOM elements, and the discipline is sound. But a full CBOM of every algorithm in every library across every product can consume an entire procurement cycle of tooling and advisory spend, and may be stale before it is finished. It also does not identify systems that ought to be using cryptography and are not. The more defensible framing is a quantum impact inventory: what breaks if this system or dataset is compromised, how likely is that, what mitigations exist, and what dependency chain does each create. Sequence by exposure and impact, and fill in the CBOM behind the migration rather than ahead of it.

A system that supports ML-KEM but still permits a classical-only handshake has transitioned in name and remains vulnerable to downgrade in practice. The SSLv3 precedent after POODLE is instructive: backwards compatibility kept the weak path open for years. Any internal or contractual definition of migration completion should specify whether the target is support, preference or the disabling of quantum-vulnerable paths — these are three different security postures and three different budgets.

Capital is Repricing The Category

Transaction activity is the clearest evidence that the private sector is treating this as an infrastructure replacement cycle rather than a compliance line item.

• • • Keyfactor, July 2026. A strategic growth investment of more than USD 1 billion led by Summit Partners, with Insight Partners and Sixth Street Growth retaining significant ownership. The company’s own framing named four converging forces: AI-driven machine identity sprawl, shrinking certificate lifespans, tightening regulation, and the PQC transition with the June 2026 executive orders cited explicitly. Proceeds are earmarked in part for further acquisitions, which signals expected consolidation in machine identity and certificate lifecycle management.
    • IonQ and ID Quantique. IonQ completed its acquisition of a controlling stake in the Geneva-based quantum-safe networking specialist, adding QKD systems, quantum random number generators and single-photon detectors, and bringing nearly 300 granted and pending patents into a portfolio exceeding 900. Vertical integration of quantum computing and quantum-safe communications is now an explicit strategy rather than a thesis.
    • SEALSQ. The Nasdaq-listed post-quantum semiconductor group expanded its dedicated quantum fund to USD 200 million in March 2026, acquired Swiss photonics interconnect developer Miraex outright in June 2026, and pursued then restructured to a minority position a proposed investment in French silicon-qubit developer Quobly. The sequence illustrates both the appetite and the valuation discipline now present in the segment.
    • Inbound to India. In August 2026 SEALSQ announced that Maharashtra-based Palm Technologies had selected its post-quantum hardware security products for India’s digital payment, public transport and connected infrastructure markets, an early indication that the DST roadmap is beginning to generate procurement demand rather than only policy documents.

The pattern across these transactions is consistent. Capital is not flowing primarily to novel algorithms, which are now standardized and free. It is flowing to the layers that make migration executable at enterprise scale: discovery, machine identity, certificate lifecycle, crypto-agility orchestration and secure silicon. Organizations building a vendor strategy should read the same signal: the scarce input is not cryptography, it is the ability to change cryptography without re-architecting.

Where The Clock Runs Fastest

Exposure is not evenly distributed. Four characteristics concentrate it: long data confidentiality horizons, long asset lifecycles, heavy third-party dependency, and regulated status.

Banking and financial services sit at the intersection of all four, and the G7 Cyber Expert Group has already framed the transition in supervisory language. DORA’s ICT risk management requirements expect monitoring of cryptographic threats including those from quantum advances, which makes this an operational-resilience obligation rather than an architecture preference. Telecommunications and energy carry OT estates with twenty-year lifecycles where the migration path may not exist at the application layer at all. Healthcare and life sciences hold data whose confidentiality requirement is measured in decades. Defense and aerospace suppliers face the contractor deadlines directly. Exporters and cross-border manufacturers face a subtler risk: divergence between jurisdictional algorithm mandates producing interoperability failures, which is why the State Department engagement provision in EO 14412 and the EU’s insistence on standardized, hybrid-capable solutions both matter commercially.

For Indian enterprises specifically, the strategic asymmetry is worth naming. India’s roadmap targets full PQC adoption by December 2029, roughly six years ahead of the US and EU end-states, against a National Quantum Mission budget of ₹6,003.65 crore covering all quantum objectives through 2031, a fraction of the USD 7.1 billion the US has estimated for federal migration alone. That gap will be closed by private capital and by sequencing discipline, not by public funding. Firms that build cryptographic inventories and crypto-agile architecture in 2027, ahead of any sectoral regulator making the roadmap binding, will convert a compliance cost into a procurement advantage particularly when bidding into European and North American supply chains where the buyer’s own deadline is already fixed.

Conclusion

None of this requires a view on when Q-Day arrives. The migration is justified by the shape of the risk rather than by a forecast: the exposure is retroactive, the deadlines are already written into procurement rules, and the remediation takes years regardless of when the threat materializes. An organization that begins in 2027 and finishes in 2031 has spent a normal technology refresh budget. An organization that begins in 2030 is buying capability in a constrained market, under regulatory pressure, from vendors with no reason to discount.

The strategic question for a board is therefore not whether quantum computing will break RSA. It is whether the organization can change its cryptography on demand and what it costs to acquire that capability now rather than under duress.