NIST finalised IR 8547. All RSA and ECC deprecated after 2030, disallowed after 2035. One signal verified across seven global regions.

Five material changes between the November 2024 draft and the October 2026 final. Federal milestones, wider algorithm scope, hardware dependencies. Independent analysis.

Two services for founders selling into banks, regulators and governments: independent product validation and retained startup advisory, separate by design.

PQC is not the only reason your cryptographic dependencies need watching. On 8 October 2026, NIST published an initial public draft of SP 800-185 Revision 1, covering the SHA-3-derived functions cSHAKE, KMAC, TupleHash and ParallelHash. The proposed revision introduces streaming interfaces for extendable-output function computations. These allow applications to process input and obtain output incrementally without knowing the complete input or total output length in advance.

Europol’s Harvest now, decrypt later report addresses a serious problem. Sensitive information encrypted today could become readable in the future if sufficiently capable quantum computers can break the public-key cryptography protecting it. Published on 7 October 2026, the report examines that exposure through a criminal and law-enforcement lens. The subject deserves attention. The report deserves scrutiny. It is a useful briefing for readers encountering the threat for the

The GAO PQC audit, published on 6 October 2026, tested 24 US federal agencies on inventory, funding and testing for post-quantum cryptography. None had fully addressed all three. This article sets out what the audit found, where its evidence stops, and how a board outside Washington can run the same test. On 6 October 2026, the US Government Accountability Office (GAO), the audit arm of Congress, published GAO-27-108740, QUANTUM COMPUTING: Federal Actions Needed to Prepare fo

Post-quantum cryptography is still being treated by too many organisations as an algorithm migration. That is the wrong frame. PQC is becoming a trigger for a much broader enterprise risk transformation. The algorithms are being standardised. The harder problem sits around them: discovering where cryptography actually exists, identifying who owns it, understanding which suppliers control critical dependencies, determining which data cannot afford to remain exposed, and creati