Cryptographic Inflation: The Economics of Uncertainty

PQC Economics

For the past three years, almost every serious discussion about Post-Quantum Cryptography has started with the same question:

How much will it cost?

Governments have published rough estimates. Boards want numbers. Vendors are selling calculators. Consultants are packaging migration roadmaps.

But that question is still too narrow.

It treats PQC like a software upgrade.

It is not.

The economics of PQC are not driven by cryptographic algorithms. They are driven by uncertainty.

That is the real distinction. And it changes the whole conversation.

Cost is not the same as economics

When organisations talk about the cost of PQC, they usually mean the visible part of the work: replacing RSA or ECC with algorithms such as ML-KEM and ML-DSA.

That is implementation.

It is not economics.

Economics is about how organisations allocate finite resources under uncertainty.

Capital. People. Time. Knowledge. Procurement. Governance. Business disruption. Opportunity cost.

Those are the real variables.

The algorithm change is only one line in the bill.

The real cost sits in everything required to identify, understand, coordinate, and safely replace cryptography across an enterprise.

The real product is certainty

Imagine two organisations of similar size.

Both need to migrate their cryptographic estate. Both end up using exactly the same quantum-safe algorithms. Both meet the same technical end state.

And yet one completes the programme for a fraction of the cost of the other.

Why?

Not because its cryptography is better. Not because its engineers are more talented. Not because its technology is newer.

Because it knew what it owned before it started changing it.

One organisation invested in certainty. The other invested in discovering what it should already have known.

That is the real product.

Not cryptography. Certainty.

Why PQC behaves differently

Most technology programmes get cheaper per unit as they scale.

They gain maturity. They gain repeatability. They gain process discipline. They benefit from economies of scale.

PQC does not behave like that.

At least, not at first.

Every new discovery creates more work. A forgotten certificate exposes another application. That application exposes another supplier. The supplier exposes another dependency. The dependency exposes another test. The test exposes another business owner.

The programme does not shrink. It expands.

Until discovery is complete, every answer creates more questions.

That is why PQC often has almost no real economies of scale until an organisation understands its cryptographic dependencies.

Cryptographic Inflation

That is the phenomenon I would call Cryptographic Inflation.

Cryptographic Inflation is the progressive increase in the cost of cryptographic change caused not by the technology itself, but by accumulating uncertainty.

Not by time. Time is only the accelerator.

What time really does is allow uncertainty to pile up.

Every undocumented system. Every unknown certificate. Every inherited application. Every supplier relationship. Every exception no one wrote down. Every acquisition. Every engineer who left. Every year of drift.

None of these directly increase the cost of replacing cryptography.

They increase uncertainty.

And uncertainty is what drives cost.

That is the point most discussions miss.

Five forms of inflation

Discovery inflation

You cannot replace what you cannot find.

Every unknown cryptographic implementation makes the next discovery harder and more expensive. The obvious systems get found first. What remains is the hidden, inherited, undocumented, and awkwardly placed cryptography that nobody fully owns.

That is where the cost starts to rise.

Dependency inflation

Cryptography rarely sits on its own.

One certificate, library, or trust relationship can support dozens of applications, integrations, and business processes.

So when you discover one dependency, you often discover several more.

That is why the programme scope keeps widening even when the technical objective is simple.

Coordination inflation

PQC is not a security-team-only problem.

Infrastructure. Cloud. Networks. Applications. Architecture. Procurement. Legal. Risk. Compliance. Business owners. Suppliers.

Every additional stakeholder adds friction. Every handoff adds delay. Every decision adds governance overhead.

The algorithm stays the same. The coordination cost does not.

Knowledge inflation

Organisations forget things.

People retire. Contractors leave. Systems are modernised. Documentation ages badly. Local knowledge disappears.

So the longer an organisation waits, the more it has to rediscover its own history before it can safely change anything.

That is expensive. And it is avoidable. But only if the work starts early enough.

Time inflation

Delay changes the shape of the spend.

What could have been folded into refresh cycles becomes a standalone programme. What could have been tested in normal release windows becomes emergency work. What could have been procured calmly becomes rushed. What could have been absorbed by existing teams becomes consultant-heavy.

The destination has not changed. The cost profile has.

That is time inflation.

The hidden cost nobody is measuring

The biggest waste in PQC may not be migration itself.

It may be duplicate discovery.

The same cryptographic implementation is found again and again by different teams: application teams, infrastructure teams, cloud teams, security teams, suppliers, auditors.

Each group builds its own inventory. Each group repeats the analysis. Each group consumes budget. Each group thinks it is uncovering something new.

But they are often analysing the same dependency.

That is not just duplicated effort.

That is duplicated expenditure caused by fragmented visibility.

And the less visible the estate, the more times the organisation pays to rediscover it.

That is where the economics quietly break down.

Four debts become one

The industry has spent years talking about technical debt.

PQC exposes something broader.

Technical debt is only one piece.

Visibility debt means the organisation does not know where cryptography is. Dependency debt means it does not know what will break when it changes. Governance debt means no one clearly owns the decision. Knowledge debt means the people who understood the old design are no longer there.

Together, those create something more serious:

uncertainty debt.

That matters because organisations do not spend money paying off algorithms.

They spend money eliminating uncertainty.

That is the real economic engine behind PQC.

What this really means

PQC is not mainly a cryptography programme.

It is a capital-allocation problem under uncertainty.

It is a procurement problem. A governance problem. A discovery problem. A dependency problem. A timing problem.

The organisations that get through it most efficiently will not necessarily be the ones with the biggest budgets.

They will be the ones that understood their cryptographic economics before the programme began.

Because the first organisation to complete PQC will not automatically be the most successful.

The organisation that understands its cryptographic estate first will almost certainly spend less getting there.

That is the economic truth hiding inside the technical one.

#PQC #PostQuantum #QuantumSecurity #CryptographicGovernance #CBOM #CyberRisk #DigitalGovernance #InflectionPoint #QuantumEconomics #SITGConsulting