Deutsch
English
Español
Français
Nederlands
Português
The convergence of finalized NIST post-quantum cryptography (PQC) standards, active enterprise migration deadlines, and the accelerating quantum computing timeline has made 2026 the pivotal year for organizations to act. With NIST's FIPS 203, 204, and 205 now in force, and major platforms like Google and Microsoft deploying quantum-safe TLS and certificates by default, the 'harvest now, decrypt later' (HNDL) threat has shifted from theoretical to operational. Enterprises storing sensitive data with multi-year retention requirements — from financial contracts to state secrets — face a hardening deadline to migrate from RSA and ECC to lattice-based cryptography. Crypto-agility has become a board-level risk management priority rather than an IT procurement decision.
The NIST Standards: A New Cryptographic Foundation
On August 13, 2024, the U.S. National Institute of Standards and Technology (NIST) finalized three Federal Information Processing Standards (FIPS) for post-quantum cryptography. FIPS 203 (ML-KEM), based on CRYSTALS-KYBER, is a module-lattice-based key-encapsulation mechanism for secure key exchange. FIPS 204 (ML-DSA), derived from CRYSTALS-Dilithium, provides lattice-based digital signatures. FIPS 205 (SLH-DSA), based on SPHINCS+, offers a stateless hash-based signature scheme as a conservative backup. These standards replace vulnerable RSA, ECDH, and ECDSA algorithms that Shor's algorithm would break with a sufficiently powerful quantum computer. The NSA's CNSA 2.0 mandates all three for national security systems, with new systems required to adopt quantum-resistant cryptography starting in 2027 and full compliance by 2035.
The NIST PQC standardization process involved an eight-year evaluation, drawing submissions from cryptographers worldwide. A fourth standard, FIPS 206 (FN-DSA/FALCON), remains in development as of mid-2026.
Harvest Now, Decrypt Later: The Operational Threat
The most urgent driver for migration is the HNDL attack vector. Adversaries — including state-sponsored actors — are already collecting encrypted data today, storing it until quantum computers mature enough to break RSA and ECC become available. Data with long confidentiality requirements, such as classified government communications, healthcare records, financial contracts, and intellectual property, is at immediate risk. According to Palo Alto Networks, HNDL creates "immediate risk for sensitive data that must remain confidential for years or decades." Mosca's theorem formalizes this urgency: if the time to migrate (X) plus the data's required security lifetime (Y) exceeds the estimated arrival of cryptographically relevant quantum computers (Z), migration is urgent. With estimates suggesting quantum resources needed to break RSA-2048 may drop under one million qubits, the window for action is narrowing rapidly.
Enterprise Migration Deadlines in 2026
Microsoft AD CS Adds ML-DSA Support
In May 2026, Microsoft released KB5087539, bringing ML-DSA (FIPS 204) post-quantum signature support to Active Directory Certificate Services (AD CS) on Windows Server 2025. This marks the first post-quantum algorithm to reach general availability in Microsoft's in-box certificate authority. The update supports two certificate types: 'Pure' (single post-quantum algorithm) and 'Composite' (combining classical RSA/ECDSA with post-quantum algorithms for layered security). However, existing CAs cannot be converted to ML-DSA — organizations must stand up new, parallel hierarchies. The Microsoft PQC certificate migration requires Windows 11 24H2/25H2 with KB5067036 and CNG key storage providers instead of legacy CSPs.
Google Chrome's Quantum-Safe TLS
Google is pioneering quantum-safe HTTPS through Merkle Tree Certificates (MTCs) in Chrome, addressing the bandwidth overhead of traditional X.509 certificates with post-quantum cryptography. The rollout includes three phases: a feasibility study with Cloudflare (Phase 1, underway), public MTC bootstrapping (Phase 2, Q1 2027), and the Chrome Quantum-resistant Root Store (Phase 3, Q3 2027). Google's initiative is part of a broader IETF working group, PKI, Logs, And Tree Signatures (PLANTS), aimed at making HTTPS certificates secure against quantum computers. The Google quantum-safe Chrome rollout represents a major step toward default post-quantum security for web traffic.
Why Crypto-Agility Is Now a Board-Level Priority
The scale of the migration is unprecedented. Unlike previous cryptographic transitions (e.g., from SHA-1 to SHA-2), PQC migration affects every system that uses public-key cryptography: TLS, code signing, email encryption, firmware updates, identity systems, cloud services, APIs, HSMs, payment infrastructure, and operational technology. According to the Cloud Security Alliance, only 5.7% of organizations have full visibility into their cryptographic assets, and 80% of identity breaches involve compromised non-human identities. Cryptographic Bill of Materials (CBOM) mapping has emerged as a critical first step — organizations cannot prioritize, finance, or replace what they cannot see.
Regulatory frameworks are compounding the urgency. NIST IR 8547 designates quantum-vulnerable algorithms for deprecation by 2030 and disallowance by 2035. The European Union's NIS2 and DORA directives require financial and critical infrastructure entities to address quantum risk. The NSA's CNSA 2.0 timeline applies to all federal contractors and vendors. Boards are now being asked to track four exact metrics: inventory completeness, HNDL exposure, NIST migration progress, and crypto-agility readiness. The crypto-agility board governance framework treats cryptographic trust as a continuous governance issue rather than a one-time technical cleanup.
Cost of Inaction
The cost of delaying PQC migration extends beyond regulatory fines. Data harvested today and decrypted tomorrow could expose trade secrets, classified communications, and long-term financial positions. For financial institutions, the Quantum-Safe Banking Index framework recommends deploying hybrid TLS 1.3 (X25519MLKEM768) immediately, noting that banks still running algorithm-selection evaluations are considered 18 months behind. The performance overhead of lattice-based cryptography — larger key sizes and slower operations — requires careful integration testing, but hybrid deployments allow organizations to layer classical and post-quantum algorithms, reducing transitional risk.
Expert Perspectives
Charlotte García, a leading cybersecurity analyst, notes: "The convergence of active NIST PQC standards, enterprise migration deadlines like Microsoft's ML-DSA certificates in May 2026, and the accelerating quantum computing timeline makes this the pivotal window for organizations to act before encrypted data harvested today becomes decryptable tomorrow." The Forrester Research 'State of Quantum Computing, 2026' report, published in March 2026, assessed practical quantum utility as arriving within the current planning horizon for most enterprises.
FAQ
What is 'harvest now, decrypt later' (HNDL)?
HNDL is a cyberattack strategy where adversaries collect encrypted data today and store it until future quantum computers can decrypt it. It creates immediate risk for any data that must remain confidential for years or decades.
What are the NIST PQC standards?
NIST finalized three standards in August 2024: FIPS 203 (ML-KEM for key exchange), FIPS 204 (ML-DSA for digital signatures), and FIPS 205 (SLH-DSA, a hash-based backup). These replace RSA, ECDH, and ECDSA.
When must enterprises migrate to post-quantum cryptography?
NIST recommends deprecating quantum-vulnerable algorithms by 2030 and disallowing them by 2035. The NSA's CNSA 2.0 requires new national security systems to adopt PQC by 2027, with full compliance by 2035. However, due to HNDL, organizations with long-lived data should begin migration immediately.
What is crypto-agility?
Crypto-agility is the ability of systems to rapidly replace cryptographic primitives without major architectural changes. It is considered the durable deliverable of PQC migration, allowing organizations to adapt to future algorithm changes.
How can organizations start their PQC migration?
Experts recommend beginning with a cryptographic inventory (CBOM mapping), classifying data by sensitivity and retention requirements, deploying hybrid TLS 1.3 (X25519MLKEM768), and establishing a crypto-agility governance framework with board-level oversight.
Conclusion
2026 marks the transition of post-quantum security from theoretical research to operational imperative. With NIST standards finalized, major platform vendors deploying quantum-safe defaults, and the HNDL threat actively exploited, enterprises can no longer afford to treat PQC migration as a future concern. The organizations that act now — by inventorying their cryptographic assets, deploying hybrid solutions, and embedding crypto-agility into their governance structures — will be best positioned to protect their data against the quantum threat. Those that delay risk exposing their most sensitive information to decryption in the years ahead.
Follow Discussion