The post‑quantum transition is no longer a distant technical milestone - it is an operational, fiduciary, and supply‑chain reality. Yet many organisations still approach PQC with a single, unhelpful question: “Are our vendors quantum‑ready?” The truth is blunt. That question has no diagnostic value. It produces marketing language, not evidence. And it leaves organisations exposed to cryptographic blind spots they don’t even know they have. To prepare for PQC, organisations ne

Brian C Founder & CEO, SITG-Consulting | Thought Leader & Forensic Strategist Quantum Risk, PQC, Compliance & Governance | Independent Validation | Board Advisor | Author | Quantum Risk Management 7 September 2026 This week in The Quantum Weekly the signal finally outran the noise. On 3 September, the G7 Cybersecurity Working Group published Preparing for the Post-Quantum Era: A Call to Action, reframing PQC migration as a collective infrastructure transition rather than a co

Brian C Founder & CEO, SITG-Consulting | Thought Leader & Forensic Strategist Quantum Risk, PQC, ERM, Compliance & Governance | Independent Validation | Board Advisor | Author | Quantum Risk Management 24 August 2026 This was a week in which post-quantum cryptography stopped being a standards conversation and became a procurement, assurance and deployment conversation across three continents simultaneously. A Canadian module cleared the highest independent hardware validation

You likely interacted with several cryptographic endpoints before finishing your morning coffee. Your smartphone authenticated to Wi-Fi. Your laptop established a corporate VPN session. Your browser negotiated secure connections to email, cloud software, or online banking. Every single interaction relied on asymmetric cryptography to authenticate entities, perform key exchanges, verify digital signatures, or establish encrypted channels. Understanding where those cryptographi

Post‑quantum cryptography is being sold as the next great migration. Replace RSA and ECC, update certificates, test applications, move on. That narrative is incomplete. It protects the lock, not the contents of the safe. The real exposure begins when an organisation cannot prove where its most valuable data has been. The Crown Jewel is the data itself — the record, design, or transaction whose loss would cause material harm. If that data has travelled through environments you

The 47-day certificate era is coming - and your #discovery tools are about to break. ⏳🔒 Nearly all security and infrastructure teams know about Ballot SC-081v3 passed by the CA/Browser Forum: • March 15, 2026: Validity capped at 200 days • March 15, 2027: Ceiling drops to 100 days • March 15, 2029: Mandatory 47-day max lifespan We talk often about auto-renewals, but we aren't talking enough about discovery. If your discovery strategy relies on active network port scans run m

Brian C Founder & CEO, SITG-Consulting | Thought Leader & Forensic Strategist Quantum Risk, PQC, ERM, Compliance & Governance | Independent Validation | Board Advisor | Author | Quantum Risk Management 17 August 2026 This week closed a loop opened the week before and started several new ones. Nine days after an AWS cryptographer's preliminary algorithm reopened questions about the mathematics beneath ML-KEM, a formal, machine-checked refutation from researchers at MIT, Stanfo

🌐The Global Signals That Actually Mattered (3 - 9 August 2026) Brian C Founder & CEO, SITG-Consulting | Thought Leader & Forensic Strategist Quantum Risk, PQC, ERM, Compliance & Governance | Independent Validation | Board Advisor | Author | Quantum Risk Management 10 August 2026 This week's structural signal was theoretical provenance meeting sovereign procurement, moving on independent clocks. An Amazon Web Services cryptographer posted a preliminary polynomial-time quantum

The Netherlands sits in Tier 2 of SITG-Consulting’s Europe’s Post-Quantum Readiness 2026 assessment. That is an important distinction. The Netherlands has produced some of the strongest practical PQC migration guidance we found anywhere in Europe. But strong guidance is not the same thing as a governed national migration programme. Government Posture: Strong Guidance, No Binding Migration Programme The Dutch position is built around two important pieces of work. The PQC Migra

Lithuania stands apart in our assessment of post-quantum readiness across the EU-27. It is the only Member State to reach Tier 1, High Confidence. This does not mean Lithuania has completed its PQC migration. It means something more useful at this stage: the country has established publicly verifiable migration machinery, with governance, mandatory actions, implementation dates, inventory requirements and procurement provisions. Government Posture: From Awareness to Execution

Brian C Founder & CEO, SITG-Consulting | Thought Leader & Forensic Strategist Quantum Risk, PQC, ERM, Compliance & Governance | Independent Validation | Board Advisor | Author | Quantum Risk Management 3 August 2026 This week's structural signal was verification, not capability. Anthropic stated its AI model broke a NIST post-quantum signature candidate that had survived two full rounds of accredited human expert review; the algorithm's own developers confirmed the finding an

Norway’s digital ecosystem is one of the most mature and trusted in Europe. The country is now entering an early but serious quantum-transition phase. The government has begun developing a national quantum technology strategy for publication in 2026, supported by the Research Council of Norway, Innovation Norway and the Norwegian National Security Authority (NSM). Investment is also increasing, including NOK 244 million awarded to four national quantum research centres. NSM’s

The sensational headlines surrounding Anthropic’s AI work on HAWK reveal a fundamental misunderstanding of how global cybersecurity actually operates: cryptanalysis is not a panic event; it is the continuous quality-control engine of the digital world. The framing that "AI broke post-quantum security and everything is collapsing" is pure noise. Here is the reality. 1. This Is an Ongoing Discipline Run by Dedicated Teams Cryptanalysis isn't something that happens once in a blu

Cuba operates one of the most state‑controlled cybersecurity regimes in the Western Hemisphere. Its legal architecture is built on Decreto 360/2019, Decreto‑Ley 35/2021, and Resolution 105/2021, all of which focus on ICT security, cyberspace defence, telecom control, and mandatory incident reporting - none of which contain PQC migration, crypto‑agility, or quantum‑risk provisions. Government Posture: Strong Control, No Quantum Strategy Cuba’s cybersecurity model is centralise

The UAE is a high-maturity digital state with world-class infrastructure, aggressive AI adoption, and strong cybersecurity regulation. Recognizing its exposure as a global hub, the UAE moved decisively into action. In late November 2025, the UAE Cybersecurity Council approved the National Encryption Policy and Executive Regulation No. 71 of 2024, legally mandating Post-Quantum Cryptography (PQC) migration. Government Posture: Global Pioneer in Mandatory Migration The UAE's di

Mexico is in the developing stage of PQC adoption. The country faces elevated quantum risk due to classical cryptography across financial services, government systems, and telecom networks. Movement has begun through national cybersecurity reform and early PQC capability building, but Mexico still has no formal PQC migration roadmap. Government Posture: Cybersecurity Plan 2025–2030 Mexico’s Digital Transformation and Telecommunications Agency launched the National Cybersecur

Colombia is in the early stage of PQC adoption. The country faces elevated quantum risk due to heavy reliance on classical cryptography across financial services, government platforms, and telecom networks. Movement has begun through digital signature reform and initial alignment with NIST standards, but Colombia has no national PQC roadmap yet. Government Posture: Digital Signature Reform Colombia’s digital signature law, Law 527 of 1999, is being updated to include post qua

Every week I see organisations announcing their Post-Quantum Cryptography strategy. Strategies. Roadmaps. Working groups. Steering committees. Pilot programmes. Then along comes some actual data. DigiCert's 2026 Quantum Readiness Outlook surveyed 1,001 IT and cybersecurity decision-makers across the United States, United Kingdom and Australia. 87% say they are planning, testing or implementing PQC. Only 7% have deployed quantum-safe or hybrid cryptography across most of their

27 July 2026 This week the confirmed signal set was dominated by state and quasi-state actors building coordination infrastructure rather than by vendors announcing capability. Israel opened a funded tender for national quantum R&D infrastructure, the UK's National Cyber Security Centre convened its first joint government-industry PQC migration workshop, and Japan's government-backed research agency launched a fiscal-year-scheduled silicon quantum manufacturing programme. In

Taiwan is advancing PQC through semiconductor security requirements, national defense modernization, and selective government upgrades. It does not publish loud quantum strategies, but it is quietly building one of the most security driven PQC environments in Asia due to geopolitical exposure and its central role in global chip supply chains. Government Posture: Security Driven PQC Adoption The Executive Yuan and National Science and Technology Council treat quantum risk as