Your Quantum Migration Runway Is Getting Shorter

For years, organizations could postpone serious post-quantum planning with one comforting argument: the quantum computers capable of threatening today’s cryptography were still too far away.

That argument is becoming harder to defend.

NIST has now finalized IR 8547, its formal transition roadmap for moving away from quantum-vulnerable public-key cryptography. The report identifies the algorithms that must eventually be retired, the post-quantum standards intended to replace them, and the migration activities organizations should begin undertaking now. NIST’s broader transition framework points toward the removal of quantum-vulnerable algorithms from its standards by 2035, with high-risk federal systems moving considerably earlier.

At almost the same time, Alice & Bob published a new theoretical resource estimate suggesting that its cat-qubit architecture could factor RSA-2048 using approximately 22,593 physical qubits in about 3.14 days. For a 256-bit elliptic-curve discrete logarithm problem, the kind of mathematics relevant to Bitcoin and other ECC-based systems, the company estimates fewer than 30,000 physical cat qubits could complete the calculation in roughly 62 minutes under its stated assumptions.

No such machine exists today. But that is almost beside the point.

The important development is that migration deadlines are becoming firmer while attack-resource estimates remain capable of moving dramatically.

That means organizations should stop treating the quantum timeline as a prediction problem. It is becoming a runway problem.

The first signal is NIST IR 8547 itself. NIST is no longer merely publishing candidate algorithms or encouraging organizations to watch the field. The agency now describes its transition roadmap as the official approach for moving from quantum-vulnerable public-key algorithms toward post-quantum digital signatures and key-establishment mechanisms. It explicitly notes that migration will differ by use case, that organizations must understand their entire cryptographic supply chain, and that visibility, risk prioritization, crypto-agility, and implementation planning are central to the transition.

The second signal is the Alice & Bob estimate. The headline numbers are dramatic, but they should be handled carefully. These are resource estimates based on a particular cat-qubit architecture and specific fault-tolerance assumptions. Alice & Bob itself notes that the headline RSA figure assumes extremely strong bit-flip suppression. If bit flips occur more frequently, the required number of physical qubits rises. This is therefore not evidence that RSA-2048 or Bitcoin can be broken today. It is evidence that the engineering assumptions behind a future attack are not fixed.

That distinction matters because security planning often relies implicitly on those assumptions remaining stable. They may not.

The third signal is the increasing focus on implementation rather than algorithm selection. NIST already states that ML-KEM, ML-DSA, and SLH-DSA form the foundation for most post-quantum deployments and says organizations can begin using them now. Its National Cybersecurity Center of Excellence is working on tools for discovering vulnerable cryptography, prioritizing systems, and demonstrating practical migration techniques.

That is an important shift. The question is no longer:  “Do post-quantum algorithms exist?”

They do.

The question is:  “How long will it take your organization to actually replace what depends on the old ones?”

That answer will be different for every organization. And in many cases, it may be measured in years.

Quantum readiness now has two clocks. The first is the capability clock.

That clock measures progress in quantum hardware, error correction, algorithms, architecture, and resource efficiency. Nobody can tell us precisely when a cryptographically relevant quantum computer will arrive. Estimates will continue to move because the underlying engineering continues to move.

The second is the migration clock.

That clock is much easier to measure.

• How long will it take to identify vulnerable cryptography?
• How long to classify the systems that depend upon it?
• How long to replace certificates and machine identities?
• How long to update applications?
• How long to obtain vendor support?
• How long to remediate embedded devices?
• How long to test interoperability?
• How long to migrate production safely?
• And how long to produce evidence that the transition actually occurred?
• That is your quantum migration runway.

The danger is not simply that the capability clock moves faster than expected. The danger is discovering that your migration clock moves much slower than expected. An organization may believe it has seven or eight years before a policy deadline and therefore conclude that it has plenty of time.

But if inventory takes two years, vendor remediation takes three, application modernization takes another two, and a critical hardware platform cannot migrate until its next replacement cycle, much of that supposed runway has already disappeared.

Harvest-now, decrypt-later makes the calculation even less forgiving. NIST specifically highlights the risk to information that must remain confidential for long periods and suggests that those systems may need to be prioritized earlier in the transition.

So the boardroom question should no longer be:  “When will quantum computers break our encryption?”

That question invites speculation.

A much more useful question is:  “How many years would we need to complete our migration if we had to start today?”

That number can be investigated.

It can be measured.

It can be governed.

Once management knows that number, the organization can compare its migration runway against multiple plausible quantum timelines rather than gambling everything on one forecast.

That is the role QCI-QS1 v2.3 should play. Not predicting Q-Day. Determining whether the organization can complete its transition before uncertainty becomes urgency.

Because NIST has now made the direction of travel clear. Research like Alice & Bob’s reminds us that the other end of the runway is not stationary.

Your organization does not need to know exactly when Q-Day arrives.

It needs to know whether there is enough runway left to get off the ground.

Think Earlier. Trust Must Survive.