Every few months someone frames the quantum threat as a looming scientific shock — as if, one morning, physics will spring a trap and the world's encryption will fall. That is the wrong mental model, and it leads to the wrong budget. We have known since Peter Shor's algorithm in 1994 exactly how a large enough quantum computer breaks the public-key cryptography that secures banking, power, health records, and defense. The standards to replace it are already published. The math is settled on both sides.
So when the break comes, it will not be a physics surprise. It will be a governance one — the discovery that most organizations treated a known, dated, standards-backed migration as a someday problem until the deadline arrived. I want to make the case that Q-Day is a management failure we can still choose not to have, and that the decisions that determine the outcome are being made in budget meetings right now, not in a lab.
The science is the boring part
Here is the entire physics story, and it is thirty years old. Shor's algorithm, run on a sufficiently large, error-corrected quantum computer, factors large numbers and solves the discrete-logarithm problem efficiently — which is to say it breaks RSA and elliptic-curve cryptography, the two pillars under nearly every secure connection you use. Symmetric encryption and hashing are weakened but survivable with larger keys. That's it. There is no hidden twist coming.
The remedy is equally un-mysterious. NIST finalized its first post-quantum standards in August 2024 — FIPS 203, 204, and 205 — and selected a fifth algorithm, HQC, in March 2025 as a mathematically independent backup in case the lattice-based primitives are ever weakened. The drop-in libraries exist. The algorithms work on today's hardware. If this were a science problem, it would already be solved. It is solved. What is not solved is the rollout, and the rollout is a governance artifact end to end.
The clock is already running: harvest now, decrypt later
The reason this cannot wait for a convenient budget cycle is that the exposure is accruing today, before any quantum computer exists. An adversary does not need to break your encryption now — they need only capture your encrypted traffic now and store it until a capable machine arrives. 'Harvest now, decrypt later' turns every long-secret dataset — defense communications, financial records, health data, intellectual property, anything that must stay confidential for a decade — into a liability that is already in someone else's hands, waiting.
That is what makes the governance framing non-optional. You are not budgeting for a future risk; you are funding the containment of a leak that has already started. The question a board should be asking is not 'when is Q-Day' but 'what did we send across the wire in the last five years that still needs to be secret in ten, and where is that ciphertext now?' Framed that way, the deadline is not in the future. It was in the past.
Governments already wrote the deadline down
This is not a voluntary transition that leaders can defer on their own judgment. National Security Memorandum 10 set a government-wide migration target of 2035, OMB has required annual inventories of quantum-vulnerable systems, and the NSA's CNSA 2.0 suite set 2027 as the point at which new national-security-system acquisitions must prefer quantum-resistant algorithms by default. In 2026, a executive order pulled the federal timeline forward by four to five years — software and firmware signing quantum-resistant by 2030, quantum-resistant encryption the exclusive standard for web, cloud, and operating systems by the early 2030s.
Read those dates as what they are: a fixed external schedule that now governs defense suppliers, and increasingly the regulated civilian sectors — finance, energy, healthcare, telecom — that sit downstream of federal procurement and financial regulators. The deadline is no longer a matter of internal appetite. It is a compliance horizon with the government's name on it, and the organizations that treat it as optional are making a governance decision whether they realize it or not.
Why civilian sectors are the harder problem
Defense at least has a forcing function — a chain of command, CNSA 2.0, and auditors who will eventually ask suppliers to prove what they encrypt and how. The civilian critical-infrastructure sectors have the same cryptography and far weaker forcing functions. A regional utility, a hospital network, a payment processor, a water system — each runs on the same RSA and elliptic-curve primitives, each has long-lived secrets, and most have no inventory of where their cryptography even lives, let alone a funded plan to replace it.
That gap is the real national exposure, and it is a governance gap, not a technical one. The algorithms are free. What is missing is ownership: someone accountable for finding every place the organization depends on breakable cryptography, prioritizing it by how long each secret must hold, and sequencing the migration across fiscal years before the deadline sequences it for them. In most civilian institutions, no one owns that today. That is the decision that determines the outcome, and it is being made by default.
What governance actually requires this year
A migration you cannot see is a migration you cannot budget, so the first dollar funds an inventory, not a purchase — a cryptographic bill of materials mapped against secrecy horizons, so the longest-lived, highest-value secrets move first. The second tranche funds migration in that priority order, using hybrid cryptography where a hard cutover is risky, and building crypto-agility in so the next transition is a configuration change rather than another multi-year program. The third, the one leaders forget, funds staying migrated — key rotation, monitoring, and the discipline that keeps deprecated algorithms from creeping back in through a new vendor or an un-reviewed integration.
None of that is exotic. It is program management applied to a known problem with a known deadline. Which is exactly why, when the break comes, 'we didn't see it coming' will be false. We saw it in 1994. We standardized the fix in 2024. We wrote the deadline into federal policy. If the ciphertext still falls, it will be because the governance failed — because someone treated a dated, solved, mandated migration as a problem for a later budget. That is the one part of the quantum story that is still undecided, and it is the only part that was ever ours to decide.
