Quantum-safe: getting ready for a threat with no date

Nobody can say when a quantum computer could break much of the maths that keeps today's data secret and proves who sent it. Switching to safer maths takes years. How can a security team tell how far along it really is?

For exampleEmail between two offices must stay secret for ten years. On the way, it passes through an old piece of network equipment that still locks it with the old maths. Yet the team's progress dashboard says "mostly ready", because the company hosting the public website switched the website to quantum-safe maths. The website got safer. The secret email did not.

The basics, in plain words

Encryption scrambles data so only someone with the right key can read it. A digital signature is a stamp that proves a file, a software update or a message really came from who it says.

Secure connections to websites (the padlock in your browser) and digital signatures both rely on one family of maths, called public-key cryptography. NIST, the US body that sets technical standards, says a large enough quantum computer, a new kind of computer, could break much of today's public-key cryptography.

Quantum-safe means maths that neither such a machine nor an ordinary computer is expected to break: the new replacements for public-key maths (called post-quantum cryptography), and some older maths that already holds up. Moving the systems that use the vulnerable maths over is the migration, and NIST expects it to take years.

Progress, two ways · a made-up example

One score

Percent quantum-safe

Can fall just because a check found more to fix, though nothing got worse. Can jump when the website's host changes a setting, though the team did nothing. Can't show what was never checked, so unchecked systems look safe.

Two measures · grouped by why it needs work

Coveragehow much has been checked, and has a named person responsible

Exposureof what has been checked, how much is high-risk

Readable laterEmail between two offices, sent through an old network boxHigh · must stay secret 10+ years
Forgeable laterThe key that signs software updatesHigh · slow to replace, and a fake would do harm
Weak alreadyAn old connection setting one server still offersFix first · unsafe today
Fine as isBackups locked with strong maths that already holds upNo change
Never checkedSystems nobody has scanned, or nobody ownsNeeds attention · a gap, never counted as safe

Each row names its group and how urgent it is. Technical names, such as the algorithm, are one tap away.

What a team can control

Nobody can say when the machine will arrive, so a plan that waits for that date never starts. But a team does control two things: how long each kind of data must stay secret, and how long its own systems take to replace. An EU roadmap, a plan written for EU countries (a recommendation, not a law), uses those two, plus how much harm an attack would do, to decide what counts as high-risk.

On public websites, much of the progress is someone else's

One 2026 study, accepted at a peer-reviewed conference, looked at websites that already use quantum-safe maths to keep their connections secret. By its estimate, 93.92% got that from a setting at the outside company that hosts the site or carries its traffic, not from anything the site's owner did. It found none yet using quantum-safe signatures. A dashboard that counts this as the team's own work overstates what the team has done.

Why it matters

The risk starts before the machine exists, in two ways. Someone can copy scrambled data today and store it; NIST, in a draft of its plan for the switch, warns that this data could be read once such a machine exists. And the signatures that approve software updates can take more than eight years to replace, and a faked one would do serious harm, so the EU roadmap counts them as high-risk too.

In August 2024, NIST published the new quantum-safe standards and said to start switching "immediately". Its draft plan has two deadlines. After 2030, the weakest versions of the old public-key maths still allowed today may only be used at your own risk. After 2035, none of the old public-key maths is allowed. The EU roadmap asks for high-risk uses to switch by the end of 2030.

Nobody knows when the machine will arrive. In 2024, NIST wrote that some experts predict one could appear "within a decade". Its website now says such machines "may be years or decades away".

What I'm trying

Group every system by why it needs work, not by the technical name of its maths. Readable later: someone could record it now and unscramble it once the machine exists. Forgeable later: a signature someone could fake then; signing that is slow to replace, such as for software updates, has to switch early. Weak already: unsafe today, quantum computer or not. Fine as is: nothing to do. Engineers can still tap through to the technical names. (The four groups are my proposal. The facts behind them: NIST IR 8547 draft; EU roadmap; NIST SP 800-52 Rev. 2 and SP 800-131A Rev. 2.)
Two numbers, never one: coverage (how much has been checked and has a named person responsible) and exposure (of that, how much is high-risk). Checks may find more old maths than expected (NIST SP 1800-38B draft), so finding more should read as progress, not failure. (The two numbers are my proposal.)
Among the quantum risks, decide what to fix first with the EU roadmap's two tests: if this leaked ten years from now, would it still do harm? Would replacing it take more than eight years? Neither test needs a date for the machine. (The tests are the EU roadmap's.)
Track progress separately for keeping data secret and for signatures, and split each into what the team did itself and what an outside company, such as the website's host, did for it. Mark a hybrid switch, old and new maths used together, as step one of two. (The split is my proposal. The facts behind it: the 2026 study above; NIST IR 8547 draft.)
Let AI agents, AI tools that act on their own, do the steps that can be undone, each with a tested way back. A named person approves any step that can't be undone. (My proposal: no source I found specifies this.)

What would show it works

The test: security staff who aren't encryption experts, in two groups, put the same made-up systems in order of what to fix first. One group sees a list sorted by the technical name of the maths, with one percentage. The other sees the four groups, a separate "never checked" row, and the two numbers. It works if three things hold for the second group: their order is closer to an expert's, fewer treat "never checked" as safe, and they aren't slower. It will be a small, informal test, and this page will say how many people took part. So far, nobody has (n = 0).

Next step

Run that test. Until it runs, this is a design proposal, not a finding.

Sources

NIST news: the first three finalised post-quantum (quantum-safe) standards13 Aug 2024: "immediately"; "within a decade"
NIST IR 8547, Transition to Post-Quantum Cryptography Standardsa draft, Nov 2024: data recorded now, read later; signatures and slow replacement; hybrid as a first step; the 2030 and 2035 deadlines; how long the switch takes; the older maths that already holds up (strong symmetric encryption)
NIST post-quantum cryptography projectupdated Aug 2026: what a quantum computer could break; "may be years or decades away"
NIST SP 800-131A Rev. 2, Transitioning the Use of Cryptographic Algorithms and Key LengthsMar 2019: what is already disallowed today
NIST SP 800-52 Rev. 2, Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) ImplementationsAug 2019: old connection versions not to use
NIST SP 1800-38B, Migration to Post-Quantum Cryptography Quantum Readiness: Cryptographic Discoverya preliminary draft, Dec 2023: checks may find more old maths than expected
A coordinated implementation roadmap for the transition to post-quantum cryptographyNIS Cooperation Group, the EU group behind the roadmap; v1.1, Jun 2025; a recommendation: what quantum-safe means, high-risk uses by the end of 2030, the ten-year and eight-year tests, signatures on software updates
Mind the Gap: Policy vs Reality in Post-Quantum TLS DeploymentarXiv 2607.29005, Jul 2026, accepted at a peer-reviewed conference (ACM IMC 2026): the 93.92% estimate; no quantum-safe signatures seen. TLS is the technology behind secure web connections.

Related work

Nothing here is for sale until a page proves it.Next: Letting an agent act alone