Post-Quantum Cryptography: The Enterprise Security Mandate for 2030
Post-Quantum Cryptography: The Enterprise Security Mandate for 2030
"The adversary is not waiting for Q-Day. They are collecting your encrypted data today, to read it when Q-Day arrives." — ThinkForge Security Intelligence Brief, Q1 2026
00. Transmission Header
CLASSIFICATION : Tresslers Group Intelligence // ThinkForge Division
DOMAIN : Quantum Computing / Cryptography / Enterprise Security
STATUS : Active Intelligence — Regulatory and Technical
DATE : 2026.05.10
REGULATORY REF : NIST FIPS 203/204/205 — Finalized August 2024
THREAT STATUS : Harvest Now Decrypt Later (HNDL) — Active threat vector
Q-DAY ESTIMATE : Early-to-mid 2030s (consensus range); some projections as early as 2030
ALERT LEVEL : Critical — Migration window: 5–9 years; many enterprises have not begun
On August 13, 2024, the National Institute of Standards and Technology (NIST) published FIPS 203, FIPS 204, and FIPS 205 — the first finalized post-quantum cryptography standards in history. After an eight-year standardization process that began in 2016, evaluated 82 candidate algorithms across four rounds, and involved the global cryptographic research community, the standards are now final.
Enterprises have no analogous inflection point to reference for the scale of this transition. The migration from RSA and elliptic-curve cryptography (ECC) to post-quantum algorithms is not a software update. It is the replacement of the cryptographic foundation underlying every TLS connection, every digital signature, every encrypted email, and every authenticated API call in every enterprise system globally.
It is also not optional. The question is not whether to migrate. The question is whether you migrate before your encrypted data is compromised, or after.
01. Why Quantum Computers Break Classical Encryption — The Technical Foundation
Current public-key cryptography — RSA, Diffie-Hellman, elliptic-curve cryptography — derives its security from mathematical problems that are computationally intractable for classical computers:
- ▸RSA security: based on the difficulty of factoring large integers. A 2048-bit RSA key requires factoring a number approximately 617 decimal digits long — infeasible for classical computers at any realistic timescale.
- ▸ECC security: based on the elliptic-curve discrete logarithm problem — computationally equivalent difficulty.
Why quantum computers change this: In 1994, mathematician Peter Shor published an algorithm that, running on a sufficiently powerful quantum computer, can factor large integers in polynomial time — transforming an intractable problem into an efficient one. The same algorithm solves the discrete logarithm problem that underpins ECC.
A quantum computer capable of running Shor's algorithm against RSA-2048 does not exist today. The gap between current quantum hardware and a cryptographically relevant quantum computer (CRQC) is primarily one of scale and error correction:
Rendering diagram...
02. The Q-Day Timeline — What the Evidence Supports
The consensus among cryptographers, government agencies, and technology companies has shifted meaningfully over the past three years. The honest state of Q-Day estimates as of mid-2026:
The convergence toward the early-to-mid 2030s:
- ▸IBM's public roadmap: "Starling" (first fault-tolerant system) targeted for 2029, with scaling to thousands of logical qubits in the 2030s
- ▸Google's Willow chip (late 2024): demonstrated below-threshold error correction — a necessary milestone — but at a scale far smaller than CRQC requirements
- ▸Expert consensus (as surveyed in multiple 2025 studies): most specialists indicate the early-to-mid 2030s as the most probable window for a CRQC capable of breaking RSA-2048
- ▸Some aggressive forecasts: Q-Day could arrive as early as 2030 or "more likely than not" by 2033 (per some industry analyses)
- ▸Conservative forecasts: mid-2030s to 2040s, citing the engineering difficulty of scaling error-corrected systems
The critical caveat: the quantum computing timeline contains more uncertainty than any other technology forecast Tresslers Group publishes. Unknown unknowns — breakthroughs in error correction, algorithm efficiency, or hardware architecture — could accelerate or decelerate the timeline by years in either direction.
What this means for enterprise action: even the most conservative 2040 estimate does not provide comfort. Migrating enterprise cryptographic infrastructure at scale takes 5–10 years for large organizations. Enterprises that begin migration planning in 2028 will likely not complete it before 2035. Enterprises that wait for Q-Day confirmation will be exposed during the transition period.
03. The Harvest Now, Decrypt Later Threat — Active Today
The most immediately consequential threat from quantum computing is not the one that requires a CRQC. It is the one operating right now.
The HNDL attack pattern:
Rendering diagram...
The HNDL threat is not theoretical. The NSA's 2022 CNSA 2.0 advisory explicitly stated that nation-state adversaries are collecting encrypted data now with the intention of decrypting it when quantum computers become available. Intelligence assessments from Five Eyes nations describe active HNDL collection operations targeting government, defense, and critical infrastructure communications.
Data sensitivity categories requiring immediate PQC priority:
- ▸Any data that must remain confidential for 10+ years (state secrets, long-term IP, strategic plans)
- ▸Any data whose historical exposure would cause significant damage (M&A communications, diplomatic cables, personnel records)
- ▸Any infrastructure with cryptographic keys that cannot be easily rotated (embedded systems, IoT, HSMs with long replacement cycles)
For enterprises in sensitive sectors — defense contractors, pharmaceutical companies, financial institutions — the HNDL threat makes PQC migration urgent today, not in 2030.
04. The NIST Standards — Technical Specification
The three finalized NIST PQC standards (August 2024) replace the classical algorithms they are designed to protect against:
| FIPS Standard | Algorithm | Former Name | Mathematical Basis | Replaces | Use Case |
|---|---|---|---|---|---|
| FIPS 203 | ML-KEM | CRYSTALS-Kyber | Module Learning With Errors (MLWE) — lattice-based | RSA, Diffie-Hellman, ECDH | Key encapsulation, TLS key exchange |
| FIPS 204 | ML-DSA | CRYSTALS-Dilithium | Module Learning With Errors — lattice-based | RSA signatures, ECDSA | Digital signatures, code signing |
| FIPS 205 | SLH-DSA | SPHINCS+ | Hash-based (stateless) | RSA signatures, ECDSA | Digital signatures (conservative backup) |
| FN-DSA (planned) | Based on FALCON | FALCON | NTRU lattice-based | RSA signatures | Digital signatures (compact) |
Why NIST standardized multiple signature schemes: mathematical diversity is a deliberate security decision. If a significant vulnerability is discovered in the lattice-based mathematical approach (which underpins both ML-KEM and ML-DSA), the hash-based SLH-DSA remains unaffected. This is the cryptographic equivalent of diversifying across asset classes — not all schemes fail simultaneously to the same attack.
The performance implications enterprises must understand:
| Algorithm | Public Key Size | Signature/Ciphertext Size | Relative Speed | vs. RSA-2048 |
|---|---|---|---|---|
| RSA-2048 (classical) | 256 bytes | 256 bytes | Baseline | Baseline |
| ML-KEM-768 | 1,184 bytes | 1,088 bytes | ~10× faster key gen | Larger keys |
| ML-DSA-65 | 1,952 bytes | 3,293 bytes | Comparable | Much larger signature |
| SLH-DSA-128s | 32 bytes | 7,856 bytes | Much slower signing | Very large signature |
The key size increase matters operationally. TLS handshakes that currently exchange 256-byte RSA keys will exchange 1,000–2,000+ byte PQC keys. For high-volume APIs, IoT devices with limited memory, and bandwidth-constrained embedded systems, this is not a transparent substitution — it requires hardware and protocol adjustments.
05. The Hybrid Deployment Strategy — The Recommended Approach
Given the maturity uncertainty of the new PQC standards (newly finalized in 2024, not yet battle-tested in production at scale), most cryptographic experts and government agencies recommend a hybrid deployment approach: combining classical algorithms with PQC algorithms in parallel.
Rendering diagram...
The hybrid rationale: a hybrid handshake that uses both ECDH and ML-KEM is secure against both classical adversaries (if ML-KEM has an unforeseen flaw) and quantum adversaries (if ECDH is broken by a CRQC). The combined approach is "paranoid-safe" during the transition period when PQC algorithms have not yet been tested in production at the scale and duration needed to establish full confidence.
Major TLS implementations have begun supporting hybrid modes:
- ▸Cloudflare: deployed hybrid X25519+MLKEM768 (X25519Kyber768Draft00) in production TLS connections
- ▸Google Chrome: experimental hybrid PQC support deployed in 2024–2025
- ▸AWS: KMS and CloudFront supporting hybrid PQC key exchange in preview
06. The Enterprise Migration Roadmap
The PQC migration is a multi-year infrastructure project, not a software patch. Understanding the scope is prerequisite to planning:
Phase 1 — Cryptographic Inventory (Months 1–6): Every enterprise must first understand what it has. This is harder than it sounds. Cryptographic algorithms are embedded in:
- ▸TLS certificates (web servers, APIs, internal services)
- ▸VPN and remote access infrastructure
- ▸Code signing certificates (software builds, firmware)
- ▸Email encryption (S/MIME, PGP)
- ▸Hardware Security Modules (HSMs) — physical devices with fixed crypto support
- ▸PKI (Public Key Infrastructure) — often the most complex and slowest to migrate
- ▸Database encryption
- ▸IoT and embedded devices (often have 10–15 year replacement cycles)
- ▸Legacy applications with hardcoded cryptographic libraries
Rendering diagram...
The timeline reality: enterprises that begin inventory and planning now (2026) are targeting hybrid deployment by 2028 and pure PQC migration completion by 2032–2035. This timeline assumes no major organizational disruptions and sustained focus. Many large enterprises will not complete full migration before the early-to-mid 2030s CRQC risk window.
07. Regulatory and Compliance Drivers
The migration is being accelerated by regulatory mandates, not just technical risk assessments:
US Government:
- ▸NSA CNSA 2.0 (2022): mandated migration plan for National Security Systems — algorithms required: ML-KEM, ML-DSA, SLH-DSA
- ▸OMB M-23-02 (2023): required all federal agencies to develop PQC migration inventories
- ▸Presidential Executive Order on AI and Quantum (2023): directed departments to develop quantum-readiness plans
- ▸CISA PQC guidance: government contractors handling sensitive information must demonstrate PQC migration progress
UK Government:
- ▸NCSC migration roadmap: targeting full PQC adoption for government systems by 2035
- ▸Financial sector guidance: PRA and FCA have issued advisories for financial institutions to begin PQC planning
Financial Sector:
- ▸FSB (Financial Stability Board): issued guidance on quantum computing risks to financial stability
- ▸SWIFT: developing PQC migration plans for interbank messaging infrastructure
- ▸Major banks (JPMorgan, HSBC, Deutsche Bank): have active PQC migration programs
The compliance driver for enterprises: if you supply to the US federal government, participate in financial industry infrastructure, or operate in regulated sectors (healthcare, energy, defense), PQC migration is not discretionary. It is becoming a contractual and regulatory requirement with documented timelines.
08. The Crypto-Agility Imperative
Perhaps the most important lesson from the PQC standardization process — an eight-year process that evaluated 82 algorithms and still produced a fourth standard pending — is that cryptographic standards will continue to evolve. Quantum computing research may reveal weaknesses in lattice-based approaches. New mathematical threats may emerge.
Crypto-agility is the architectural principle that addresses this: designing systems so that the cryptographic algorithm can be swapped without rebuilding the system. This means:
- ▸Abstracting the crypto layer: applications should call a cryptographic service, not hardcode algorithm implementations
- ▸Certificate lifecycle management: infrastructure to rotate certificates rapidly when algorithm changes are required
- ▸HSM planning: selecting HSM vendors with clear PQC upgrade paths (Thales, Utimaco, nShield) and planning replacement cycles
- ▸Protocol negotiation: TLS implementations that support algorithm negotiation (so clients and servers agree on the strongest mutually supported algorithm)
Organizations that achieve crypto-agility are not just prepared for the quantum transition. They are prepared for any future cryptographic transition — including ones driven by classical attacks on classical algorithms that may emerge independently of quantum computing.
09. The Intelligence Monitoring Requirement
The PQC landscape is not static. The following developments require continuous monitoring:
| Event Type | Significance | Monitoring Frequency |
|---|---|---|
| NIST FN-DSA (FALCON) final publication | Fourth standard completion — enables additional implementation options | Quarterly |
| Quantum hardware milestone announcements | Each milestone updates Q-Day risk estimates | Event-driven |
| Algorithm attack publications | Academic papers revealing weaknesses in PQC candidates | Monthly |
| Government migration deadline updates | Changes to mandatory compliance timelines | Quarterly |
| Vendor support announcements | Cloud provider, HSM vendor, browser PQC support | Monthly |
| Nation-state quantum program updates | Intelligence on adversary quantum capabilities | Classified/open source |
The intelligence gap: most enterprises are receiving PQC information through annual security conference presentations, quarterly analyst reports, or vendor marketing materials. None of these update fast enough for the actual pace of development. The quantum computing research community publishes significant results continuously, and algorithm attacks — papers demonstrating weaknesses in candidate algorithms — have already forced NIST to retire earlier candidates (SIKE was broken with a classical laptop in 2022, demonstrating the need for multiple rounds of evaluation).
ThinkForge's quantum intelligence monitoring provides continuous synthesis of this development stream — algorithm publications, hardware milestones, regulatory updates — in structured, actionable format.
10. The Tresslers Group Thesis
Post-quantum cryptography is the largest mandatory security infrastructure project in enterprise history. Most organizations have not begun.
The scope is unprecedented: every public-key cryptographic system deployed globally — which means effectively every secure communication system, every authenticated service, every digital signature — must be replaced within approximately one decade. The analogy is Y2K multiplied by several orders of magnitude in complexity, with no hard deadline to focus urgency, operating against a threat that is partially active (HNDL) and partially future (CRQC).
The enterprises that complete this migration on schedule will have made a significant, non-discretionary infrastructure investment with no revenue upside — only the avoidance of catastrophic downside. The enterprises that do not will face either regulatory non-compliance or active exploitation during the CRQC window.
The investment opportunity is in the companies providing the inventory, migration, and monitoring infrastructure for this transition — a mandatory procurement cycle with a large, time-bounded TAM. The intelligence opportunity is in maintaining continuous synthesis of the technical and regulatory landscape so that security leaders can make timely, calibrated decisions.
The migration mandate is active. The window is closing. The preparation should have started yesterday.
References & Source Intelligence
- ▸NIST. (2024, August 13). FIPS 203: Module-Lattice-Based Key-Encapsulation Mechanism Standard. NIST.gov.
- ▸NIST. (2024, August 13). FIPS 204: Module-Lattice-Based Digital Signature Standard. NIST.gov.
- ▸NIST. (2024, August 13). FIPS 205: Stateless Hash-Based Digital Signature Standard. NIST.gov.
- ▸IBM. (2024–2025). IBM Quantum Roadmap: Starling (2029) and Beyond. IBM Research.
- ▸Google DeepMind. (2024). Willow: A Significant Step in Quantum Error Correction. Google Blog.
- ▸NSA. (2022). Commercial National Security Algorithm Suite 2.0 (CNSA 2.0). NSA Cybersecurity Advisory.
- ▸CISA. (2024). Post-Quantum Cryptography Initiative: Migration Guidance.
- ▸Cloudflare. (2024). Deploying Hybrid Post-Quantum Cryptography in TLS.
- ▸Palo Alto Networks. (2025). Q-Day: The Quantum Threat Landscape Assessment.
- ▸Tresslers Group Intelligence. (2026). Quantum × AI Convergence 2026. [tresslersgroup.com/insights/quantum-ai-convergence-2026]
- ▸Tresslers Group Intelligence. (2026). The Agentic Supply Chain. [tresslersgroup.com/insights/agentic-supply-chain-2026]
Tresslers Group Intelligence — ThinkForge Division Driven by Innovation. Defined by Impact. Quantum-Ready Intelligence for the Transition Decade. © 2026 Tresslers Group. Transmission Complete.