Post-Quantum Cryptography Roadmaps Shrink as Qubit Estimates Fall

The deadline moved closer

For about ten years, the move to post-quantum cryptography (PQC) was something security teams planned for and kept putting off. In 2026 that changed. Two things happened in the same year. Governments turned loose 2035 targets into binding dates, and quantum computing groups kept publishing papers showing that breaking today's encryption needs far less hardware than anyone had assumed. Taken together, the coverage points to one conclusion: an organization still treating PQC as a problem for the 2030s is already behind.

The biggest policy event was Executive Order 14412, "Securing the Nation Against Advanced Cryptographic Attacks," signed on June 22, 2026. It requires federal agencies to move their most sensitive systems to post-quantum encryption by December 31, 2030, and to post-quantum authentication by December 31, 2031.8 An OMB memo released alongside it lays out the steps: inventories and planning through 2027, pilots through 2028, key establishment by 2030, signatures in 2031, and all remaining systems by 2035.20 The order also reaches beyond government. The FAR Council has to propose a rule by December 2026 that would require covered contractors to comply with NIST's FIPS standards, including the post-quantum ones, by the end of 2030.20

Why the hardware math matters

The deadlines got tighter because estimates of what it takes to break current encryption keep dropping. In 2019, Google researcher Craig Gidney estimated that factoring a 2048-bit RSA key would take about 20 million physical qubits.26 In May 2025 he cut that to fewer than one million qubits running for under a week, and he got there through better algorithms rather than better hardware.27 The more exact figures in his paper are roughly 898,000 physical qubits and a runtime of 4.96 days.24

2026 brought further cuts. In February, Sydney startup Iceberg Quantum posted a preprint describing its "Pinnacle Architecture." It replaces conventional surface codes with quantum low-density parity-check (QLDPC) error-correcting codes and claims RSA-2048 could be factored with fewer than 100,000 physical qubits under standard hardware assumptions.23 In March, Google Quantum AI estimated that 256-bit elliptic-curve cryptography could be broken with fewer than 500,000 physical qubits in about nine minutes after precomputation.24 That matters because elliptic-curve cryptography protects most TLS sessions, SSH and code signing.24 Oratomic, a startup working with Caltech and Berkeley researchers on neutral-atom machines, then set the lowest figure yet: around 10,000 physical qubits, although a faster attack on ECC-256 would need about 26,000 qubits and take ten days.28

This is the core of the quantum-company story. The most important results this year were not new machines. They were resource estimates from Google, Iceberg and Oratomic that changed how far away the threat looks. Cloudflare says it moved its own target for full post-quantum security to 2029 in April 2026, citing the Google and Oratomic work.8 Google set a 2029 deadline for its own migration in March, citing faster-than-expected progress in hardware, error correction and factoring estimates.1 Microsoft is more cautious, targeting a full transition by 2033.1

Where the reporting diverges

The coverage agrees on the trend. It disagrees on how alarmed readers should be.

The skeptical reading is well supported. A detailed analysis of the Pinnacle paper notes that the 98,000-qubit figure is a best case. It assumes superconducting hardware with one error per thousand operations, one-microsecond cycles, and a month of uninterrupted fault-tolerant operation. On trapped-ion or neutral-atom platforms the same paper's estimates rise into the millions.30 The same analysis puts today's leading machines at roughly 100 to 1,000 times short of that qubit count. It lists IBM's Heron at 156 qubits, Google's Willow at 105 and Quantinuum's Helios at 98.30 It also identifies real-time decoding of large QLDPC codes as the hardest unsolved problem.30 Another review points out that QLDPC codes need qubit connectivity that no physical platform has shown at scale.24 According to that analysis, computer scientist Scott Aaronson persuaded the Iceberg authors to change a title about "breaking RSA-2048" because journalists would assume the attack had already been carried out.30

Some claims are less solid. One outlet described a March 2026 algorithm from the Advanced Quantum Technologies Institute (AQTI), called "JVG," as needing about 1,000 times fewer quantum resources than earlier methods. It also noted that the paper used the phrase "cybersecurity apocalypse," which is unusual for serious research.21 Another tracker described the same work much more modestly, with requirements possibly below 500,000 physical qubits in the most optimistic case.25 When two accounts of one paper differ that much, the safe course is to rely on the Google and Iceberg work, which has been examined in detail, and treat the JVG claims as unconfirmed.

On timing, the commentary still mostly places a cryptographically relevant machine somewhere between 2032 and 2035.21 But the strongest argument in the coverage is about the rate of improvement, not any one estimate. The count fell from 20 million qubits in 2019 to under a million in 2025 and under 100,000 in 2026, and each step came faster and with fewer exotic assumptions than the one before.30 Planning for that trend is the sensible approach, not betting on a particular year.

Harvest now, decrypt later

There is a second reason the exact date matters less than it seems. An attacker can record encrypted traffic today and decrypt it once quantum machines can do so. NIST's transition guidance makes this point. Signatures and authentication carry no backward-looking risk, because a login from 2025 can't be undone later. Confidential data captured today can be exposed later.15 One migration guide puts it plainly: data that must stay secret for seven to ten years is already exposed.3 This is why the federal order handles encryption first and authentication a year later, a split Cloudflare says matches how widely post-quantum encryption is already deployed online.8

The standards are ready. Organizations mostly aren't

Algorithms are no longer the obstacle. NIST finalized ML-KEM, ML-DSA and SLH-DSA on August 13, 2024. FN-DSA (Falcon) is in draft, and HQC was chosen on March 11, 2025 as a code-based backup to the lattice-based ML-KEM.13 Under NIST IR 8547, RSA-2048, P-256 and similar algorithms are deprecated after 2030, and all quantum-vulnerable public-key algorithms are disallowed after 2035. The guidance exempts hybrid schemes as long as the post-quantum part is approved.13 The IETF has standardized hybrid X25519MLKEM768 key exchange for TLS 1.3 as RFC 10024.13 Microsoft made ML-DSA generally available in Active Directory Certificate Services on Windows Server 2025 in May 2026, which puts post-quantum certificates on the platform most enterprise PKIs already run on.2

Organizations are lagging. A July 2026 DigiCert survey found 87% of organizations planning or piloting PQC, but only 7% had deployed quantum-safe cryptography across most of their certificates.2 Ponemon's 2026 research, sponsored by Entrust, found 68% of organizations rate managing their cryptographic assets as extremely or very difficult. Only 38% said they were actively transitioning, and that share fell from the previous year.2 Infrastructure is also a constraint. As of early 2026, no hardware security module (HSM) vendor had completed a FIPS 140-3 Level 3 validation that includes PQC algorithms.1

What a practical roadmap looks like

Most guidance follows the same order: assign an owner, build an inventory, rank by risk, deploy hybrid cryptography, and design systems so algorithms can be swapped later. One mid-market guide recommends copying the federal model of a single accountable migration lead, since a migration that belongs to everyone belongs to no one.6 Enterprise PKI specialists suggest ranking assets by how long their data must stay confidential, not by how many there are. They also warn that ML-DSA signatures are roughly 15 to 50 times larger than the classical signatures they replace, and that certificate chains have to be migrated starting from the root.2 Defense contractors face an extra step. NSA's CNSA 2.0 suite requires ML-KEM-1024 and ML-DSA-87 for new National Security System acquisitions from January 1, 2027. A roadmap built on the civilian defaults won't carry over without rework.2

The guidance disagrees on one question: should a complete inventory come before deployment? Some guides treat continuous cryptographic discovery as the required first step.2 Cloudflare argues the opposite. Protect public internet traffic now and don't let inventory work delay post-quantum encryption on the most sensitive systems.8 Cloudflare's position is the better one. Hybrid key exchange for internet-facing traffic is available now, it directly addresses harvest-now-decrypt-later, and it doesn't require a finished asset map. Inventory still matters. It should run alongside deployment rather than hold it up.

The timelines are converging. The EU expects national PQC strategies by the end of 2026 and high-risk systems migrated by 2030.4 Australia will stop approving traditional asymmetric cryptography after 2030.4 Canada targets high-priority systems by 2031.9 With the policy dates fixed, the remaining unknown is quantum hardware, and recent estimates have kept moving that date earlier.