Post-Quantum Crypto Migration: Who's Actually Moving

Jul 26

## NIST Timelines Are No Longer Abstract

For years, post-quantum cryptography (PQC) lived in the realm of "eventually." Conference talks. Research papers. A line item in five-year security roadmaps that nobody expected to actually hit.

That era is over.

NIST finalized its first set of post-quantum standards back in 2024 — ML-KEM (based on CRYSTALS-Kyber) for key encapsulation, and ML-DSA (based on CRYSTALS-Dilithium) for digital signatures. Since then, the guidance has sharpened into something with teeth: federal agencies are working against concrete 2026-2027 migration checkpoints, and the message trickling down to the private sector is unambiguous — "harvest now, decrypt later" isn't a hypothetical threat model anymore, it's an active one. Adversaries capturing encrypted traffic today, betting on a future quantum computer to crack it, is a real and rational strategy for anyone who thinks in decade-long horizons.

Which means the organizations sitting on "we'll deal with it when quantum computers are actually a threat" are already behind. The threat isn't the quantum computer — it's the data being harvested right now.

## What "PQC-Ready" Actually Means

The term gets thrown around loosely, so it's worth being precise. PQC-ready doesn't mean "we ripped out RSA and replaced it with a lattice-based algorithm." In almost every real deployment, it means something more incremental:

**Hybrid key exchange.** Rather than betting everything on new, less battle-tested algorithms, most serious implementations pair a post-quantum algorithm with a classical one (like X25519 + ML-KEM). If the new math has an undiscovered flaw, the classical algorithm still holds the line. If a quantum computer arrives, the PQC half carries the weight. This hybrid approach is what's shipping in TLS implementations from major browser vendors and cloud providers today.

**Algorithm agility.** PQC-ready increasingly means an organization's systems can swap cryptographic primitives without a ground-up rebuild. Given that the standards are still young and cryptanalysis is ongoing, hardcoding a single algorithm choice is now considered a design flaw, not a simplification.

**Signature migration is lagging key exchange.** ML-DSA and its cousin SLH-DSA (stateless hash-based signatures) are standardized, but signature migration touches certificates, code-signing infrastructure, and long-lived trust chains — much stickier to move than a TLS handshake. Expect this to be the long tail of the migration story.

## Sector Adoption: Finance vs. Government vs. Enterprise SaaS

**Government** is moving first, and not by choice — it's mandated. NSA's CNSA 2.0 suite pushes national security systems toward mandatory PQC algorithms on an aggressive timeline, with software and firmware for national security systems expected to support PQC well before the 2030s deadlines originally floated for full transition. Federal contractors are already feeling this pressure flow downstream through procurement requirements.

**Financial services** are moving second, driven by a mix of regulatory anticipation and genuinely long data-sensitivity horizons — a mortgage record or a trade secret encrypted today may still need to be confidential in 20 years. Large banks and payment networks have been running PQC pilots in TLS and internal key management for a couple of years now; the harder problem for them is legacy infrastructure — mainframes and HSMs (hardware security modules) that weren't designed with algorithm agility in mind.

**Enterprise SaaS** is the most uneven tier. The hyperscalers (cloud infrastructure providers) have largely rolled hybrid PQC into their TLS stacks already, often transparently to customers. But mid-market and smaller SaaS vendors are mostly in "watching and waiting" mode, treating this as a someday problem rather than a roadmap item. That gap is going to matter — a lot of enterprise risk lives in vendor supply chains, not in the primary organization's own stack.

## Vendor Landscape: Who's Shipped, Who's Lagging

- **Cloud providers** — the major hyperscalers have PQC hybrid key exchange available in their TLS offerings, generally opt-in today with a clear trajectory toward default-on.

- **Browser vendors** — Chrome and other major browsers have shipped support for hybrid post-quantum key exchange in recent releases, meaning a meaningful share of web traffic is already quantum-resistant at the transport layer without users or site owners doing anything.

- **HSM and PKI vendors** — this is where the lag is most visible. Updating hardware security modules and certificate authorities to issue and validate PQC signatures is a slower, more conservative process, and it's the long pole in the tent for full ecosystem migration.

- **VPN and identity vendors** — mixed picture; some have PQC-hybrid options in beta or early GA, others haven't publicly committed to a timeline yet.

The pattern: infrastructure that sits closest to the network layer (TLS, browsers) is moving fastest. Infrastructure tied to long-lived trust and hardware (PKI, HSMs, code-signing) is moving slowest — and it's precisely that infrastructure that matters most for the "harvest now, decrypt later" threat model.

## Migration Readiness Checklist

Before treating this as someone else's problem, it's worth an honest inventory:

- [ ] Do you know which systems encrypt data with a confidentiality horizon of 10+ years?

- [ ] Have you inventoried where classical algorithms (RSA, ECDSA, plain Diffie-Hellman) are hardcoded without an upgrade path?

- [ ] Are your TLS-terminating services (load balancers, CDNs, API gateways) capable of hybrid PQC key exchange, even if not yet enabled?

- [ ] Do you know your HSM and PKI vendors' PQC roadmaps and timelines?

- [ ] Does your architecture support algorithm agility, or would a crypto swap require a rebuild?

- [ ] Have you flagged "harvest now, decrypt later" as a threat model in your current risk assessments?

The organizations that treat this as a checklist item today will be doing routine maintenance in three years. The ones that don't will be doing emergency infrastructure surgery under regulatory or breach pressure — a much worse position to migrate from.

---

*Note: this draft references publicly known standards and general industry trends as of Claude's knowledge cutoff (Jan 2026). Before publishing, verify current vendor rollout status and any newer NIST guidance — this space moves fast.*

Post-Quantum Crypto Migration: Who's Actually Moving

AI vs. AI: The New Security Arms Race

Secrets That Changed History

Your Site Title

email@example.com