🌐 Quantum Weekly - The Global Signals That Actually Mattered (19 - 25 October 2026)

The week of 19 to 25 October was about architecture: which mechanism establishes keys, on which link, and who is accountable for the choice. South Korea's science ministry started a three-year expansion of its quantum communications testbed, whose overseas hub trials quantum key distribution (QKD) on domestic and local overseas segments and post-quantum cryptography (PQC) on the long-distance international segment. Japan's ruling party asked for early PQC deadlines for priority government systems and for QKD as a second layer of protection. Toshiba launched a platform that delivers QKD, PQC and hybrid keys over one network. The UK and Singapore put supervisory expectations for the quantum-safe transition on the agenda of their financial dialogue. On the supply side, Cisco set out a December 2026 plan for its core portfolio, Cloudflare rebuilt a data-residency control on hybrid ML-KEM key wrapping, and NowSecure measured how little post-quantum code mobile apps carry. Quantinuum claimed a logical error-rate record that is not yet peer reviewed, and Alice & Bob reported results under France's defence-led programme that it describes as not yet below threshold. Confirmed signals came from the United States, the United Kingdom, Singapore, France, Japan and South Korea. None of the nine changes the evidence on when a cryptographically relevant quantum computer will exist.

📌 SITG-Consulting - Own Announcement (outside the signal count)

On 22 October 2026 I published "BRICS Post-Quantum Cryptography Readiness 2026: An Empirical Assessment of the BRICS-11" on Zenodo. No member state reaches Tier 1, the threshold for a national migration programme with implementation under way. Six of the eleven (Brazil, India, Indonesia, Iran, Saudi Arabia and the United Arab Emirates) sit at Tier 2, with structured government preparation. China, Ethiopia and Russia sit at Tier 3; Egypt and South Africa at Tier 4. The classifications assess migration machinery from public sources to an evidence cut-off of 27 September 2026, not how much vulnerable cryptography has been replaced. I set out why fragmentation across the bloc matters in "BRICS Post-Quantum Readiness 2026: Why Cryptographic Fragmentation Matters" (23 October 2026). The method follows the Thematic Reviews approach.

🇺🇸 United States - Quantinuum Claims a 99.9995% Logical Fidelity on Helios; No Peer-Reviewed Paper Yet

Hardware Architecture / Error Correction / Vendor Claims

The Detail: On 19 October 2026 Quantinuum, in a release datelined Broomfield, Colorado, reported a logical fidelity of 99.9995% on its Helios commercial computer using a colour code, which it equates to "just five errors in a million operations".

• Quantinuum describes the result as a world record, 10 times lower in error rate than its own record of the previous month and 100 times lower than the best published result on any other hardware modality. Those comparisons are Quantinuum's claims.

• Quantinuum states that each tested increase in code distance cut the remaining logical errors "by a record factor of 12". It links the result to Apollo, its fault-tolerant machine, which it expects to be available by 2029.

• The release cites no peer-reviewed paper. The supporting research is a document hosted by the company. The release gives no count of logical qubits for a full computation, and its forward-looking statements note that results achieved in experimental settings may not hold at larger scale.

Why it matters: The logical error rate is the input that sets qubit overhead in published resource estimates for attacks on RSA and elliptic-curve cryptography. A lower rate, if it holds under review, reduces the hardware those estimates require. Until a paper is published, risk functions should log this as a dated vendor claim alongside last week's peer-reviewed Google result, not as an established milestone. It is a demonstration of error suppression on a small code, not of cryptanalytic capability. A migration plan anchored to regulatory dates does not move on it.

🇸🇬 🇬🇧 Singapore and United Kingdom - Two Financial Authorities Put Quantum-Safe Supervisory Expectations on a Bilateral Agenda

Financial Supervision / Cross-Border Coordination / QKD and PQC

The Detail: On 20 October 2026 HM Treasury and the Monetary Authority of Singapore (MAS) held the 11th UK-Singapore Financial Dialogue in Singapore. The MAS release and the joint statement on GOV.UK record the exchange.

• The statement says the exchange on quantum technologies covered both countries' approach to quantum security and "supervisory expectations for financial institutions transitioning to quantum-safe technologies".

• It names two inputs: the UK National Cyber Security Centre's post-quantum cryptography migration guidance, and lessons learnt from MAS' Quantum Key Distribution sandbox with industry partners.

• The Bank of England and the Financial Conduct Authority took part alongside HM Treasury and MAS. The 12th dialogue will be hosted by the UK in 2027.

• The statement records a discussion. It sets no new requirement and no date.

Why it matters: Supervisory expectations for the quantum-safe transition are now a bilateral item between a G7 financial centre and Singapore, one week after Singapore's Cyber Security Agency publicly reiterated its 2031 CII migration target. The two jurisdictions brought different reference points to the table: MAS its QKD sandbox, the UK its NCSC guidance. The NCSC's published position is that it "will not support the use of QKD for government or military applications" and that PQC is the best mitigation. Groups regulated in both jurisdictions should run one migration programme and record how it meets each supervisor's expectations, rather than wait for a joint text. I tracked the dialogue in my "PQC Governance Digest: Cut-off 23 October 2026" (25 October 2026). A PQC Readiness Assessment produces that record against both sets of expectations.

🇺🇸 United States - NowSecure Finds No Detectable PQC in 97% of 136,711 Mobile Apps, and States the Limits of Its Own Method

Software Supply Chain / Mobile / Measurement

The Detail: On 20 October 2026 NowSecure, in a release datelined Chicago, reported that 97% of 136,711 iOS and Android apps contain no detectable post-quantum cryptography. 4,241 apps (3.1%) showed PQC-related code.

• NowSecure states that detection "does not by itself confirm use at runtime", and that the absence of PQC code does not rule out PQC protection supplied by the operating system, the network stack or the server.

• This is vendor research, not a regulator's finding.

Why it matters: The figure measures what app developers have compiled in, not what protects the session. Transport-layer key exchange supplied by a phone's operating system would not appear in the count, so the 97% is not a measure of exposure. The governance point is narrower and more useful: an organisation that ships a mobile app should know whether its key exchange comes from its own code, a third-party library, the platform or the server, and who is accountable for each. In "Why a Cryptographic Assurance Standard Is Now a Board-Level Requirement" (23 October 2026) I set out why a migration plan records intent and only an assurance standard produces evidence.

🇫🇷 France - Alice & Bob Reports Phase 1 Results Under the Defence-Led PROQCIMA Programme, Not Yet Below Threshold

Sovereign Programme / Defence Procurement / Hardware Architecture

The Detail: On 20 October 2026 Alice & Bob, in a release datelined Paris, shared its first results from PROQCIMA, the French government's quantum computing programme led by the Defence Innovation Agency (AID) and the Directorate General of Armaments (DGA).

• PROQCIMA aims for two prototype universal quantum computers, each capable of supporting 1,000 logical qubits, ready for industrialisation by 2032. Five companies were selected: Alice & Bob, Pasqal, Quandela, Quobly and C12.

• For Phase 1, Alice & Bob states it assembled and operated three demonstrators, two on 6-qubit chips and one on a 12-qubit chip, and ran multiple cycles of a distance-3 repetition code.

• The company states the logical error rate is "not yet below threshold". The release cites no peer-reviewed paper.

Why it matters: A defence ministry is running a ten-year competitive procurement for fault-tolerant hardware with a dated target of 2032, and a participant has published interim results that state plainly what has not yet been achieved. Set beside Quantinuum's claim in the same week, it shows the range in how hardware progress is reported: one release leads with a record, the other with a gap. Boards and risk functions reading hardware news should weigh the stated limits as heavily as the headline figure.

🇯🇵 Japan - Ruling Party Asks the Government to Set Early PQC Deadlines and to Add QKD as a Second Layer

National Policy / Migration Deadlines / QKD

The Detail: A proposal dated 20 October 2026 from the Liberal Democratic Party's Policy Research Council, through its National Cybersecurity Strategy Headquarters, sets out measures to strengthen Japan's cyber defences. The party published notice of it on 21 October.

• Under section 3(1), addressed to the National Cyber Office, a bullet on accelerating PQC migration notes that major Western countries reportedly plan to move high-impact systems to PQC around 2030 to 2031, and asks that government agencies set early migration deadlines for systems judged high priority. It sets no year.

• Under section 3(7), addressed to the communications ministry, the proposal describes the introduction of QKD as an urgent second layer of protection alongside PQC for communications between government and critical-infrastructure bodies handling sensitive data, and asks for faster construction of a QKD network linking Tokyo, Nagoya and Osaka.

• The proposal also calls for a cyber response headquarters led from the Prime Minister's Office.

• It is a ruling-party proposal, not government policy.

Why it matters: The proposal cites reported Western targets of around 2030 to 2031 without fixing a Japanese year. It also takes a position on QKD that the UK's NCSC does not share. Suppliers to Japanese government agencies should watch for PQC deadlines set system by system if the government adopts the proposal, and should watch whether QKD becomes a procurement expectation on domestic trunk routes. A layered design adds a second key-establishment system to govern, not a substitute for authenticated PQC.

🇯🇵 Japan - Toshiba Launches a Platform That Delivers QKD, PQC and Hybrid Keys Across One Network

Network Infrastructure / QKD / Key Management

The Detail: On 21 October 2026 Toshiba, in a release datelined Kawasaki, announced the launch of its Quantum-Safe Networking (QSN) Platform.

• Toshiba states that PQC "provides quantum-resistant key exchange", that its QSN Link "provides dedicated point-to-point QKD", and that its Key Delivery System "delivers QKD, PQC and hybrid keys across the network". The release does not explain how hybrid keys are constructed.

• Toshiba claims the platform "delivers the highest level of security" and that a single hub can serve hundreds of remote sites. Those are Toshiba's claims.

• The release names no customers, no availability date and no product certification. Toshiba states it chairs the ETSI Industry Specification Group on QKD.

Why it matters: In the same week, the Japanese proposal described a layered model and the Korean testbed a segmented one; this is a vendor product built to deliver both kinds of key. In a layered design the key delivery and management system becomes the control point, because it decides which key protects which link. Buyers should ask in writing which mechanism establishes each key, how keys are combined, how parties are authenticated, and which certificate covers each component. The questions that separate a claim from evidence are the ones I set out in "Quantum Washing: Four Tells That a Post-Quantum Claim Is Marketing, Not Migration" (15 October 2026).

🇰🇷 South Korea - Science Ministry Starts a Three-Year Expansion of the National Quantum Communications Testbed, Pairing QKD with PQC

Sovereign Infrastructure / QKD / International Links

The Detail: On 21 October 2026, for 22 October morning papers, the Ministry of Science and ICT (MSIT) issued a press release announcing the full-scale start of expanded demonstration infrastructure for the commercialisation of quantum communications. The release text is held in an attachment that was not opened for this edition. The details below are attributed to Korean press reports of the release, which quote MSIT officials.

• The programme has three hubs. KT leads the commercial and future hubs. SK Broadband leads the overseas hub, which links with testbeds in Singapore, Poland and Bulgaria.

• In the overseas hub, QKD is trialled on domestic and local overseas segments and PQC is applied to the long-distance international segment, for cross-border trials.

• Commercial expansion is reported as Daegu in 2026, Gwangju and Busan in 2027, and Gangwon in 2028, with a 2026 budget of KRW 7.4 billion (KRW 3.75 billion government, KRW 3.65 billion private).

Why it matters: This is a testbed configuration, not a national allocation of mechanisms. It still shows the design question that layered and mixed networks raise: in my assessment, once different legs of one path use different key-establishment mechanisms, each leg carries its own assurance route and failure mode, and the boundary between them needs an owner. Organisations connecting to the Korean testbed, or to its Singapore link, should map which mechanism protects which leg. Cryptographic Agility Services build that map before the boundary becomes a dependency.

🇺🇸 United States - Cisco States It Plans Quantum-Safe Capabilities Across the Majority of Its Core Portfolio by December 2026

Network Equipment / Secure Boot / Supply Timelines

The Detail: On 22 October 2026 Cisco published a corporate blog post by Nathan Jokel, SVP Corporate Strategy.

• Cisco states: "By December 2026, Cisco plans to enable quantum-safe communications capabilities across the majority of our core portfolio".

• It states that new campus, branch and data centre routers, switches and firewalls "are planned for launch with quantum-safe secure boot".

• The post cites the NSA's 2027 target for compliant new National Security System acquisitions and the June 2026 Executive Order, which it says directs high-value and high-impact federal systems to adopt PQC for key establishment by the end of 2030 and for digital signatures by the end of 2031.

• The post describes plans. It does not describe any product as shipping, and it names no models, firmware versions or validation certificates.

Why it matters: Network equipment bought now will still be in service at the 2030 and 2031 dates Cisco itself cites. Secure boot is the same layer Lattice and SEALSQ addressed last week, and it carries the longest lock-in. A dated vendor plan is useful to procurement only once it is mapped to specific models, firmware and certificates. Buyers should ask, before the next refresh contract, which of the products they are buying fall inside "the majority of our core portfolio", and in what configuration the quantum-safe functions run.

🇺🇸 United States - Cloudflare Rebuilds Geographic Key Protection with Hybrid ML-KEM

Data Residency / Key Management / ML-KEM

The Detail: On 23 October 2026 Cloudflare published a blog post announcing a post-quantum geographically restricted key manager.

• The design uses HPKE (RFC 9180) with a hybrid ML-KEM-768 and X25519 KEM to wrap private-key material.

• Cloudflare states that unwrapping is controlled by regional provisioning, a TPM-backed hardware identity for each server and its server inventory, which maps that identity to a data centre and location; a request fails closed if any required check fails.

• It is in closed beta for Data Localization Suite customers. Cloudflare states general availability is planned for the first quarter of 2027.

• Cloudflare states it replaced its 2022 design because "No production-ready post-quantum ABE scheme is available today", and frames the motivation as harvest now, decrypt later.

Why it matters: Data-residency controls are where regulation and cryptography meet. A key restricted to a region depends on two things: the cryptography that wraps it, and the provisioning, identity and inventory controls that decide which servers may unwrap it. The algorithm change addresses the first; the second remains an operational control that has to be evidenced. An organisation relying on such a control to meet a localisation obligation should ask about both, because wrapped key material harvested today could be recovered later if the wrapping is classical. Note the status: a closed beta with general availability planned. Post-quantum protection of confidentiality continues to move ahead of authentication, as I set out in "How Post-Quantum Cryptography Works in TLS 1.3: The Hybrid Handshake Explained" (19 October 2026).

🌐 Global Sweep - The Architecture Choice Is Being Made in Asia

Ecosystem / Capital Markets / PQC Infrastructure / Hardware Architecture / Sovereign Security

The Detail:

• Sovereign security: South Korea's ministry began a three-year testbed expansion whose overseas hub trials QKD on domestic and local overseas segments and PQC on the long-distance international segment. Japan's ruling party asked for early PQC deadlines for priority government systems and QKD as a second layer. Neither sets a migration deadline. France's defence-led PROQCIMA programme published interim results from one participant.

• Financial supervision: the UK and Singapore discussed supervisory expectations for the quantum-safe transition, with MAS' QKD sandbox and the NCSC's PQC guidance as the two named inputs.

• PQC infrastructure: Cisco set out a December 2026 plan for its core portfolio; Cloudflare put hybrid ML-KEM key wrapping into a data-residency key manager in closed beta; Toshiba launched a platform delivering QKD, PQC and hybrid keys; NowSecure measured PQC code in mobile apps.

• Hardware architecture: Quantinuum claimed a logical error-rate record, not yet peer reviewed. NVIDIA reported a simulation of fault-tolerant quantum computing on the JUPITER supercomputer at Jülich on 19 October; it is noted and not counted.

• Standards track: the IETF draft on adapting constrained devices for PQC was posted as revision 09 on 20 October, received a security directorate review marked "Has Issues", and was deferred from the 22 October IESG telechat to 5 November. Noted, not counted.

• US federal: the 22 October deadline under OMB Memorandum M-26-15 for agency PQC migration plans passed with no published statement from OMB or the White House.

• Capital markets: no in-window raise met both the primary-source standard and the inclusion rule (see What Was NOT Missed).

• Regions with no confirmed in-window signal meeting the primary-source standard: Canada; Germany, the Netherlands, Finland, Sweden, Denmark, Spain and Italy; GCC (Qatar, UAE, Saudi Arabia, Bahrain, Kuwait, Oman); China, India, Australia and Taiwan; Africa (South Africa, Nigeria, Kenya, Ghana); Latin America (Brazil, Chile, Mexico, Colombia). This records that no signal was verified to the standard; it does not show that nothing occurred.

• Geographic position: nine signals from six jurisdictions. The United States supplied four, Japan two, and South Korea, France and the joint UK-Singapore dialogue one each.

• Standards bodies and regulators with no confirmed in-window PQC output identified: NIST, NSA, CISA, UK NCSC, ENISA (an Estonia webinar on 22 October, with no publication), BSI, ANSSI, Europol, Singapore's CSA.

Why it matters: Last week governments wrote down dates. This week the question moved to mechanism. A Japanese ruling-party proposal, a Korean ministry testbed and a Japanese vendor each paired QKD with PQC, while the UK's published position is that PQC is the best mitigation and QKD should not be relied on alone. A multinational may now face different expectations on how keys are established in different jurisdictions, and that difference has to be governed as a design decision rather than discovered in an audit.

🔮 SITG-Consulting COMMENT - THE WEEK'S REAL SIGNAL

The week's highest-consequence signal is divergence on mechanism. Japan's ruling party proposed QKD as a second layer alongside PQC, South Korea's ministry testbed pairs the two on different segments, a Japanese vendor launched a platform delivering both, and MAS brought its QKD sandbox to a supervisory dialogue. The UK's NCSC states that QKD "does not provide authentication" and that it will not support QKD for government or military use. Published deadlines already provide planning anchors. The unresolved question is which mechanism protects which link, and who assures it. In my assessment, that answer now varies by jurisdiction.

• Japan and South Korea: a layered or segmented design adds a second key-establishment mechanism to govern. Each mechanism needs an owner, an assurance route and a failure plan, and the boundary between segments becomes the weakest point if nobody owns it. QKD still depends on authenticated classical channels.

• UK and Singapore: supervisors are comparing notes before either has written a joint expectation. Banks in both jurisdictions should not wait for one; they should evidence how a single programme meets both.

• Cisco and Cloudflare: Cisco describes planned capabilities; Cloudflare offers a closed beta. Neither announcement establishes a generally available, independently validated implementation of the capabilities described. Plans enter procurement only once mapped to models, firmware and certificates.

• Quantinuum and Alice & Bob: one release leads with a record, the other with a gap. Neither is peer reviewed. The stated limits are the part to record.

• OMB: federal agencies' migration plans fell due on 22 October and nothing was published. Boards relying on federal progress as a benchmark cannot see it.

The defining shift: the board question has moved from "when must we migrate" to "which mechanism, on which link, assured by whom". In "Why a Cryptographic Assurance Standard Is Now a Board-Level Requirement" (23 October 2026) I set out why that answer has to be evidenced, not asserted. Quantum Trust and PQC Assurance Services test supplier and architecture claims against that standard.

⚠️ Important - What Was NOT Missed

• No credible evidence of near-term cryptographically relevant quantum advantage. Quantinuum's result is not yet peer reviewed, and Alice & Bob states its logical error rate is not yet below threshold.

• No breakthrough reducing the need for hybrid PQC or for migration of signatures.

• OMB M-26-15: the agency migration plan deadline of 22 October passed with no OMB or White House publication found. Recorded as a dated non-event.

• Intel's agreement to acquire Classiq was announced on 26 October, after the window closed. It falls to the next edition.

• IDEMIA Secure Transactions and KT on post-quantum SIMs for Korean defence communications, and an Israel Innovation Authority ecosystem report, were reported on 26 October with no in-window primary located. Excluded.

• India: the Technology Development Board's ₹150 crore agreement with QNu Labs is dated 16 October, before this window; this closes the open point from the previous edition. C-DAC and Bank of India signed an exploratory quantum-technology MoU on 22 October per the national broadcaster DD India; no PIB, C-DAC or Bank of India release was located, and the MoU does not name PQC or QKD. Not counted.

• eMudhra, an Indian certificate authority: browsers blocked eight of its intermediate CAs from 17 October after their private keys were found recoverable; eMudhra acknowledged the flaw and on 22 October announced its exit from the certificate business. It is a key-lifecycle failure, not a PQC event, and is not counted.

• WBTC (Hong Kong, 18 October, before the window) announced preparation to migrate Bitcoin custody addresses; the release reports no PQC adoption. Not counted.

• Xanadu (Toronto, 19 October) received provisional approval for up to USD 10 million of additional DARPA funding; Arqit (London, 20 October) announced an investment of undisclosed size in Sirius Computer. Capital items without a governance or deployment signal. Not counted.

• Telefónica and IQM (Madrid, 23 October) will install a quantum computer for the Community of Madrid; Forschungszentrum Jülich reported a quantum gate speed record (23 October). Neither has a direct PQC or cryptanalytic implication. Not counted.

• ETSI's Security Conference (19 to 22 October) held a cryptography and quantum readiness track; presentations only, no publication. Not counted.

• QuantrolOx's reported €12 million Series A and a Colombian quantum-safe observatory report surfaced in the window; no company release was located for the first and no release date for the second. Held pending.

• The UK NCSC's update to its TLS guidance to include PQC configurations is dated 15 October, in the previous window, and was not covered there. Recorded for completeness.

• Forward context: the IETF constrained-devices draft returns to the IESG telechat on 5 November; Singapore's Quantum-Safe Kickstarter Grant programme period begins on 1 November; electronica runs from 10 to 13 November; Cisco's stated portfolio date is December 2026; Cloudflare's stated general availability is the first quarter of 2027.

  
  

⚠️ Disclaimer

This newsletter is produced by SITG-Consulting for informational purposes only. It does not constitute professional advice, whether legal, technical, regulatory, or otherwise. The content reflects publicly available information and the author's independent analysis as of the date of publication. Readers should verify all claims independently and seek qualified professional counsel before making decisions based on this material. SITG-Consulting accepts no liability for actions taken or not taken based on the contents of this newsletter.

Previous edition: https://www.sitg-consulting.com/post/quantum-weekly-the-global-signals-that-actually-mattered-12-18-october-2026 Full archive: https://www.sitg-consulting.com/blog