The answer, up front
Post-quantum urgency is a prioritization problem, not a reason to freeze or to migrate everything at once. Build a cryptographic inventory, rank systems by exposure and tractability, take the quick wins, and use hybrid deployments only where full migration has to wait 2, 3, 4.
Last verified: Sep. 30, 2026.
Why everything feels urgent
NIST finalized its first three post-quantum standards in August 2024 and encouraged administrators to start integrating them immediately, because full integration takes time 1. Governments now publish timelines. Vendors publish roadmaps. The message is clear, but "migrate now" does not say what to do first.
Post-quantum migration touches every system that uses public-key cryptography: authentication, encrypted communications, signatures, certificates, VPNs, APIs, cloud integrations, and hardware security modules. Two reactions fail. One is to freeze. The other is to attack everything at once.
The timelines help. They run for years. The NCSC asks for discovery and planning by 2028, highest-priority migrations by 2031, and full migration by 2035 3. OMB phases federal work the same way, starting with inventory in 2026 to 2027 2. You have time to sequence the work, but not time to skip the sequencing.
Rank by exposure and tractability
The matrix below is ArcQubit guidance. No standard prescribes it. It applies the risk-based approach that OMB and the NCSC describe, which prioritizes sensitive, high-impact systems first 2, 3.
Exposure measures the damage if a system's cryptography falls to a quantum attack. Data that must stay confidential for 15 years carries more exposure than a session token that expires in hours. Regulated data, critical infrastructure controls, and high-value financial transactions also rank high.
Tractability measures how hard the migration is. A library you can update through configuration is tractable. Algorithms embedded in hardware, legacy protocols, or third-party integrations are not.
| High tractability | Low tractability | |
|---|---|---|
| High exposure | Move first | Plan now, execute as dependencies clear |
| Low exposure | Move opportunistically | Deprioritize, revisit at refresh |
Low-exposure systems wait regardless of how easy they are. A quick win on a system that protects nothing sensitive uses effort you need elsewhere.
You cannot rank what you cannot see
Prioritization needs an inventory. Most organizations cannot yet say where public-key cryptography runs across the enterprise. That gap is your first project.
A useful inventory records the algorithm and key size, the location, the purpose, whether the cryptography sits in hardware or software, the data it protects, and an owner. The owner field matters most for supplier-controlled systems, because your fix depends on their roadmap. OMB asks agencies to address vendor and third-party software in their plans 2.
In ArcQubit's view, a large share of exposure sits in code your team did not write. We have no measured figure for that share, so treat it as a working assumption to test in your own environment. Give supplier-owned findings an owner and a follow-up date.
The cryptographic inventory and CBOM guide explains how to build one.
Take quick wins
Not every migration needs a multi-year plan. Early wins reduce risk and build the skills harder migrations need. Look for:
- Configurable libraries. Well-maintained libraries where an algorithm change is a configuration update, not a rewrite.
- New builds. Systems still in development, where you can choose post-quantum algorithms from the start.
- External-facing services. Endpoints where a hybrid deployment adds protection without breaking compatibility.
Each win teaches your team the process, exposes hidden dependencies, and produces a playbook for the next system.
Use hybrid deployments to buy time
Hybrid cryptography runs a traditional algorithm and a post-quantum algorithm together. NIST explains that a well-designed combination stays secure if at least one component stays secure 4. OMB describes the same idea: an attacker must break both schemes 2.
Hybrid is a bridge, not a destination. OMB calls it an intricate and resource-intensive stopgap that carries its own risks, and tells agencies to evaluate the tradeoffs 2. Two stacks cost more to run and to keep current.
Use it where it earns its cost: high-exposure systems that cannot complete full migration soon, often because a vendor update or hardware refresh is out of your hands. The hybrid vs pure post-quantum article compares the options.
What this means for executives and the board
Urgency becomes manageable when leadership asks for a sequence, not a slogan. ArcQubit guidance for the next review:
- Ask for the inventory status and its coverage of high-value systems.
- Ask which systems are high exposure and what blocks each one.
- Approve a small set of quick wins with owners and dates.
- Require a supplier list showing which vendors have published post-quantum roadmaps.
Questions to ask your team this week
- Which systems protect data that must stay confidential beyond 2035?
- Which of those can we update by configuration?
- Which findings depend on a supplier, and who is talking to that supplier?
- Where would a hybrid deployment reduce risk fastest?
Common mistakes
- Skipping the inventory. Teams migrate the wrong systems first or find critical gaps mid-program.
- Ranking by ease alone. Easy systems feel productive, but exposure decides priority.
- Treating hybrid as the finish line. It adds protection now and operational cost later.
- Ignoring supplier-owned cryptography. A finding with no owner never gets fixed.
Read the migration roadmap for the phased plan that follows prioritization.
How ArcQubit approaches it
This box describes ArcQubit's own method.
ArcQubit's QuCode is enterprise discovery and inventory, sold directly as fixed-scope work. It produces a Quantum Exposure Report that names the software, algorithm, location, exposure score, and owner, whether your team or a supplier, for each finding. QuTrust then serves as the migration system of record, keeping the roadmap current so sequencing follows structured prioritization.