Post-Quantum Cryptography: Vendors Ship, Enterprises Stall

Hardware is arriving faster than the plans to use it

On October 1, 2026, Thales used its Cyber Summit in Paris to announce five cybersecurity products and services. The lineup included a hardware security module built for post-quantum protection, an AI-enabled data security posture management tool, software protection aimed at AI-driven attacks, a broader partnership with Google Cloud to secure agentic AI workflows, and a new global approach to real-time threat detection and response 5. A quantum-ready HSM is the most significant item for organizations facing cryptographic deadlines. HSMs anchor the keys that protect payments, identity systems, and code signing, so they are among the first components a migration has to replace.

The launch also highlights a gap. Vendors are shipping post-quantum infrastructure, but most enterprises have not yet decided what to protect first.

The readiness numbers, and why they differ

The surveys paint a weak picture, though they measure different things. A 2025 ISACA poll of more than 2,600 professionals found that only 5% of organizations have a defined quantum computing strategy 1. Another estimate puts the share of organizations running post-quantum cryptography in production at 13%. The same estimate finds that 60% have not begun a meaningful migration 2.

The two figures can both be true. One counts formal strategies and the other counts deployments, and some organizations may have turned on post-quantum options in a few products without any broader plan. Either way, a large majority of enterprises are not moving at the pace the deadlines require. Large organizations are estimated to need eight to fifteen years to complete a full transition 2, which means the work should arguably have started before the standards were final.

The deadline stack keeps getting firmer

The deadlines themselves are not in doubt. NIST finalized three post-quantum standards on August 13, 2024, ending an eight-year competition 2. NIST IR 8547, released in November 2024, sets two dates [1]:

• 2030: algorithms at the 112-bit security level, such as RSA-2048 and P-256, are deprecated, meaning no new deployments.
• 2035: all quantum-vulnerable public-key algorithms, including RSA-3072 and P-384, are disallowed outright.

In 2026, those guidelines became presidential mandates. Executive Order 14412, signed June 22, 2026, requires federal agencies to move their highest-value systems to quantum-resistant cryptography by December 31, 2030 and 2031. It is the first presidential order to set hard calendar dates for post-quantum migration 4. A White House implementation memo gives each agency 120 days to submit a migration plan. It treats the effort as a multiyear, phased program, starting with strategy, planning, and discovery in 2026–2027 3. Agencies must also support TLS 1.3 or a successor no later than January 2, 2030, because its redesigned handshake is the foundation for deploying post-quantum cryptography at the network level 3.

The threat timeline is also getting shorter. Google warned in March 2026 that a quantum computer capable of breaking RSA-2048 could arrive as early as 2029 2. Ongoing research keeps lowering the estimated hardware needed to break RSA and elliptic-curve encryption 4. If that 2029 estimate holds, the 2030 deprecation date leaves almost no margin.

Why private companies can't treat this as a federal problem

Many enterprises appear to assume these mandates apply only to government. That assumption is risky. The federal deadlines are expected to reach contractors through a forthcoming FAR rule, and they sit alongside an existing NSA timeline (CNSA 2.0) that already governs national security systems 4. Any company that sells to government, or sells to a company that does, will likely inherit these requirements through procurement terms rather than legislation.

The federal memo's phasing is a useful model for the private sector as well. It starts with discovery and inventory, not product purchases 3. An organization that does not know where RSA and ECC are embedded in its applications, certificates, and vendor contracts cannot make good use of a new HSM, however capable.

The takeaway

The constraint is no longer technology or vendor supply. Standards have been final for two years 2, federal dates are set 4, and products like Thales' new HSM show that suppliers are ready 5. What remains slow is enterprise planning. With fewer than one in seven organizations in production 2 and migrations measured in years to decades, many will still be partway through the transition when the 2030 deadline arrives. Teams that begin cryptographic inventory now will have a manageable migration. Teams that wait for a contract clause or a breach will face a much harder one.