Quantum-safe security
Preparing for quantum computing is already a practical security question. The opportunity lies in turning new standards into funded upgrades and lasting customer relationships.
What I’m watching: A dated change in how independent sources describe this technology’s possibilities, followed by new voices and sustained attention.
What could change the picture?
- What the evidence says
- Published standards and a major vendor’s deployment plans make the migration tangible. The missing commercial evidence is what customers are spending, how upgrades perform and which suppliers earn recurring revenue.
- Early recognition to watch
- A dated change in how independent sources describe this technology’s possibilities, followed by new voices and sustained attention
- Commercial confirmation
- Funded migration contracts convert standards into recurring revenue. Next evidence: Collect funded migration tenders, rollout acceptance, maintenance revenue and legacy inventory.
- What people used to expect
- Working expectation to monitor: Cost per safely migrated system remains constrained by Inventory, migration tools and implementation expertise. This is a research hypothesis, not measured consensus.
- What may be changing
- Potential change to investigate: Funded migration contracts convert standards into recurring revenue. Current evidence does not yet demonstrate a broad change in belief.
- Who could benefit
- Candidate how a business could benefit in Quantum-safe security: Test distribution and recurring security services against migration work that ends after installation.
- Timing
- Catalyst dependent; no supported repricing date yet
- What the market may already expect
- Current price, expectations and investable exposure have not been assessed in this packet. Existing source evidence is not a buy or sell cue.
- The strongest reason to be cautious
- Large technical need may create temporary consulting revenue with little defensible recurring profit.
- What would change the view
- Reassess if mandatory migration does not produce durable margin or retention for the chosen supplier.
Detailed research notes
Dated research baseline, imported today rather than a new event: NIST finalised its first three post-quantum cryptography standards and said they were ready for immediate use. (2024-08-13). Final standards do not establish an organisation's cryptographic inventory, completed migration, interoperability, cost per migrated system or the timing of a cryptographically relevant quantum computer. NIST is the standard setter, not an independent market benchmark. Google reports hybrid ML-KEM at google.com and *.googleapis.com and opt-in X25519MLKEM768 support for TLS1.3 application/proxy load balancers. (2026-08-11). Vendor claim, not independent customer negotiation or acceptance proof. Key exchange is not completed certificate/signature, key-lifecycle or whole-estate migration. The2029 readiness target is forward-looking; some hardware may extend beyond it. No cost or security configuration change inferred.
Follow the evidence
Google reports hybrid ML-KEM at google.com and *.googleapis.com and opt-in X25519MLKEM768 support for TLS1.3 application/proxy load balancers. Limitation: Vendor claim, not independent customer negotiation or acceptance proof. Key exchange is not completed certificate/signature, key-lifecycle or whole-estate migration. The2029 readiness target is forward-looking; some hardware may extend beyond it. No cost or security configuration change inferred. Existing research checked 2026-10-12.
NCSC recommends discovery/planning by 2028, highest-priority migration by 2031 and completion by 2035. Commodity-IT SMEs generally follow vendor updates; bespoke systems require their own assessment. Limitation: Indicative guidance, not a universal statutory deadline or quantum-breakthrough prediction. Application, protocol, supplier and long-lived hardware dependencies differ. Inventory/testing are not completed migration. Organisation-specific duties, costs and qualified security-owner acceptance remain unestablished. Existing research checked 2026-10-12.
NIST finalised its first three post-quantum cryptography standards and said they were ready for immediate use. Limitation: Final standards do not establish an organisation's cryptographic inventory, completed migration, interoperability, cost per migrated system or the timing of a cryptographically relevant quantum computer. NIST is the standard setter, not an independent market benchmark. Existing research checked 2026-10-05.
low confidence · Assessment 17 Oct 2026. Evidence dates are shown separately.