This week I read the best description of how to measure success against quantum risk. It comes from a recent Department of War (DoW) strategy document, and it is a breath of fresh air. 𝐈 𝐪𝐮𝐨𝐭𝐞: "Quantum resistance is not achieved when PQC is rolled out, but when quantum-vulnerable solutions are deprecated." Let's dissect what that means because it cuts straight through the marketing theatre dominating cybersecurity right now. 𝐃𝐞𝐟𝐢𝐧𝐞:"Quantum-Vulnerable" Any algor

The DoW just gave us a document worth promoting - my favourite line is 𝐐𝐮𝐚𝐧𝐭𝐮𝐦 𝐫𝐞𝐬𝐢𝐬𝐭𝐚𝐧𝐜𝐞 𝐢𝐬 𝐧𝐨𝐭 𝐚𝐜𝐡𝐢𝐞𝐯𝐞𝐝 𝐰𝐡𝐞𝐧 𝐏𝐐𝐂 𝐢𝐬 𝐫𝐨𝐥𝐥𝐞𝐝 𝐨𝐮𝐭, 𝐛𝐮𝐭 𝐰𝐡𝐞𝐧 𝐪𝐮𝐚𝐧𝐭𝐮𝐦-𝐯𝐮𝐥𝐧𝐞𝐫𝐚𝐛𝐥𝐞 𝐬𝐨𝐥𝐮𝐭𝐢𝐨𝐧𝐬 𝐚𝐫𝐞 𝐝𝐞𝐩𝐫𝐞𝐜𝐚𝐭𝐞𝐝. The Department of War’s Post-Quantum Cryptography Strategy landed just a day or so ago, but it deserves far more attention than it’s getting. In my view, it is much more relevant and operationally impor

That should concern every board, regulator, CISO and risk committee still treating post-quantum cryptography as a distant technology problem. The United States has issued a new Executive Order accelerating PQC migration requirements. Notably: • PQC key establishment for High Value Assets by 31 December 2030 • PQC digital signatures for High Value Assets by 31 December 2031 This is the second major shift in federal timing expectations. That matters. Governments do not compress

Three post-quantum KEMs now sit inside one of the principal international standards for asymmetric encryption: ML-KEM, Classic McEliece and FrodoKEM. Read that again. Not one algorithm. Three. From three different mathematical families. Why this matters before the detail. A standards body had a choice. It could have ratified the market's preferred answer, ML-KEM, and closed the question. It did not. It standardised a structured lattice scheme, an unstructured lattice scheme a