The encryption deadlines are real now, and most people have not started
Only 13% of organisations have post-quantum cryptography in production and 60% have not meaningfully begun. The threat model is not a future computer — it is a recording made today.
Post-quantum cryptography spent years as a topic that was simultaneously important and safely ignorable. The standards landed in August 2024 — FIPS 203, 204 and 205 — and the deadlines that follow them are now close enough to matter.
Adoption has not kept pace. Only around 13% of organisations have post-quantum cryptography in production, and roughly 60% have not begun a meaningful migration.
The threat model people get wrong
The common objection is reasonable-sounding: no quantum computer can break RSA today, so why spend effort now?
The answer is harvest-now-decrypt-later. An adversary who records encrypted traffic today can decrypt it whenever the capability arrives. For data with a long confidentiality life — medical records, legal documents, government communications, financial history, anything about a person that stays true — the relevant question is not when the machine exists, but how long your data needs to stay secret.
If something you transmit today must remain confidential for fifteen years, the deadline for protecting it was already in the past.
That is why the migration is happening now despite the absence of a working attack. It is the only category of security work where waiting for the threat to materialise is definitionally too late.
What is actually changing
The important piece for most systems is FIPS 203, ML-KEM, which replaces RSA and ECDH for key establishment — the part of TLS that negotiates session keys.
The deployment pattern is hybrid: classical and post-quantum key exchange together, so the connection is at least as strong as the better of the two. That is deliberate and sensible; the new algorithms are less battle-tested, and a hybrid construction means a flaw in the new one does not leave you worse off than before.
Infrastructure has moved further than most application teams realise. AWS rolled hybrid post-quantum TLS into KMS in 2024 and expanded it to Certificate Manager and Secrets Manager in early 2026, with ML-KEM as the default hybrid algorithm. Google and Cloudflare have both committed to 2029 for full migration.
The deadlines worth diarising
On 21 September 2026, NIST moves all remaining FIPS 140-2 certificates to Historical status, leaving only FIPS 140-3 validated implementations acceptable for new US federal procurement.
From 1 January 2027, new National Security System acquisitions must support CNSA 2.0 — which reaches VPNs, routers, operating systems and communications hardware sold to defence contractors and federal agencies.
Executive Order 14306 requires TLS 1.3 or successor support across federal systems by 2 January 2030.
These are procurement deadlines rather than laws of physics, and that is exactly why they bite. They propagate down supply chains as contractual requirements long before any cryptographic threat appears.
What a normal team should do
Most organisations are not going to implement lattice cryptography, and should not. The work is inventory and dependency management.
Find out what you use. A cryptographic inventory — which algorithms, in which systems, for what, with what data lifetime — is the prerequisite for everything else, and it is where the industry actually is: around 38% of Fortune 500 firms had completed at least a partial inventory by early 2026, up from 12% in late 2024. The majority still cannot answer the question.
Classify by data lifetime, not by system importance. The urgent systems are the ones carrying data that must stay confidential for a decade, which is not always the same as the systems you consider critical.
Let your platform do the work where it can. If your TLS terminates at a managed load balancer or CDN, hybrid key exchange is largely a configuration and upgrade question rather than a code change. That covers a great deal of exposure cheaply.
Care about crypto-agility more than about algorithms. The durable lesson is not "adopt ML-KEM". It is that any system where the algorithm is hardcoded across dozens of call sites will be painful to migrate — this time and next time. Being able to change primitives without rewriting the application is the property worth building.
The reasonable position
For most small teams there is no emergency this quarter. There is a straightforward piece of homework: know what you use, know how long your data must stay secret, and confirm your platform's roadmap.
That takes an afternoon, and it puts you ahead of the 60% who have not started — which, given the deadlines now attached to procurement, is a position with commercial value as well as a security one.
Building something like this?
We are a product studio in Kathmandu. Tell us what you are building and an engineer will reply.