🌐 Quantum Weekly - The Global Signals That Actually Mattered (5 - 11 October 2026)

The week of 5 to 11 October put readiness evidence and capital on the same page. A federal auditor in Washington published a dated baseline showing that none of 24 US agencies had fully addressed all three preparatory practices for post-quantum migration. Europe's law-enforcement agency said timing uncertainty should not be the main concern and urged proactive crypto-agility. Microsoft and the IETF moved post-quantum certificate infrastructure forward on the testing and encoding sides. The US Department of Energy named the scientific workloads that are to inform its fault-tolerant quantum programme. On the capital side, DARPA moved four hardware developers into the independent verification stage of its benchmarking programme, Gartner sized the 2026 market at under USD 1 billion and forecast start-up attrition, a Pasadena neutral-atom developer reported USD 775 million in total funding, a University of Sussex spin-out closed a Series A above USD 100 million, IonQ made an interconnect claim and Fujitsu signed a research-centre MOU with a US state. Confirmed signals came from the United States, the European Union, the United Kingdom and Japan, plus one international standards body. None of the eleven changes the timeline for a cryptographically relevant quantum computer. This edition also carries my own announcement of a memorandum of understanding between SITG-Consulting and MTechnix of Kuala Lumpur.

🇺🇸 United States - GAO Finds None of 24 Federal Agencies Fully Addressed All Three PQC Preparatory Practices

Federal Audit / Cryptographic Inventory / Transition Funding

The Detail: On 6 October 2026 the US Government Accountability Office published GAO-27-108740, "Quantum Computing: Federal Actions Needed to Prepare for Emerging Cyber Threat". GAO built an evaluation framework of three preparatory practices from Office of Management and Budget guidance and applied it to the 24 Chief Financial Officers Act agencies. GAO states that none of the 24 fully addressed all three practices.

• The three practices are: develop and annually update a prioritised inventory of agency systems with vulnerable cryptography; identify and annually update the funding needed to move priority systems to PQC; and test PQC in agency environments.

• GAO found that one agency fully addressed the applicable inventory activities, none fully addressed the funding practice and none tested PQC in its own environment.

• GAO attributes the gaps in part to a lack of cryptography expertise, a lack of processes for developing cryptography inventories and identifying transition funding, and a lack of plans to guide PQC testing.

• This is the public version of a sensitive report GAO issued in September 2025. GAO states it worked with the Office of the National Cyber Director from September 2025 to September 2026 to prepare it.

• The sensitive report made 89 recommendations to 23 agencies. GAO reports that 12 agencies agreed, two partially agreed, seven neither agreed nor disagreed, one disagreed with three of its four recommendations while agreeing with the fourth, and the Department of the Interior did not respond. The public version adds no new recommendations.

• GAO reports the majority view among industry experts that a cryptographically relevant quantum computer will be developed, possibly as soon as the 2030s, and states that development estimates vary widely.

I set out the audit's evidence limits, an eight-question version of the GAO test for organisations outside government and seven questions for the board in "None of 24: The GAO Audit of Federal PQC Readiness" (8 October 2026).

Why it matters: The constraint GAO names is expertise and process, not algorithm availability. Three practical consequences follow. First, the evidence predates the agency migration plans that OMB memorandum M-26-15 requires by 22 October 2026, so the report is a baseline and does not judge those plans. Second, suppliers to federal agencies should expect inventory and funding questions to flow down to them. Third, boards outside government now have a published, auditor-grade benchmark: an organisation with no evidenced inventory has no grounds to assume it is ahead of agencies operating under a written federal instruction. In "The PQC Readiness Assessment Evidence Gap" (8 October 2026) I set out why a readiness score without dependency mapping and governance authority fails the same test, and in "PQC Is Not About the Quantum Computer" (9 October 2026) I argued that inventory, funding and ownership survive even if the machine is never built. A structured PQC Readiness Assessment tests the same three practices with evidence attached.

🇪🇺 European Union - Europol Publishes Two Quantum Reports and Says Timing Uncertainty Should Not Be the Main Concern

Law Enforcement / Harvest Now, Decrypt Later / Crypto-Agility

The Detail: Europol published two reports on 7 October 2026: "Quantum Computing and Cryptocurrencies: Bridging technical expertise and decision-making", produced by its European Cybercrime Centre (EC3), and "Harvest Now, Decrypt Later", developed with Universidad Carlos III de Madrid under Europol's Advisory Group on Research and Development.

• Europol's announcement states that the timing of these capabilities remains uncertain, that this should not be the main concern because adapting systems and coordinating security upgrades will take time, and that crypto-agility should be pursued proactively.

• The HNDL report analyses exposure across TLS, SSH and OpenPGP storage. Its mitigations include a cryptographic inventory, identification of data needing long-term confidentiality, data minimisation, stronger key management, a phased PQC transition, and hybrid key exchange as a transitional step.

• The report states there is currently no clear evidence that HNDL is being systematically exploited at scale.

• The cryptocurrency report states that cryptocurrency wallets are "the primary point of exposure to quantum threats", and that the blockchain's core integrity, secured by cryptographic hash functions, "remains largely resistant to quantum attacks".

I reviewed the HNDL report in "Europol's HNDL Report Is Useful, but It Is Not a Migration Plan" (10 October 2026).

Why it matters: A law-enforcement agency framing HNDL places the exposure in the territory of evidence, retention and criminal motive as well as network architecture. Europol's own caveat matters as much as its warning: possibility, feasibility and measured scale are separate categories, and a risk register should record them separately. The decision Europol pushes towards is architectural: which systems can change algorithms by configuration, and who is authorised to make that change. Retention schedules for long-lived confidential data become a control in their own right. Cryptographic Agility Services address that replaceability question directly. Custodians of digital assets should read the wallet report as a law-enforcement risk signal on wallet keys, migration coordination and long-term cryptographic exposure.

🇺🇸 United States - DARPA Moves Four Hardware Developers into Independent Verification Under Its Quantum Benchmarking Initiative

Hardware Architecture / Public Capital / Independent Verification

The Detail: On 7 October 2026 IonQ announced that it has advanced to Stage C of DARPA's Quantum Benchmarking Initiative (QBI) under an agreement with a potential value of up to USD 300 million, running through 2029. IonQ states that funding beyond the initial obligation remains subject to future appropriations and DARPA funding actions.

• DARPA announced on 7 October 2026 that four organisations had entered Stage C: Atom Computing (Boulder, Colorado; neutral atoms), Diraq (Sydney, Australia; silicon CMOS spin qubits), IBM (Yorktown Heights, New York; modular superconducting processors) and IonQ (College Park, Maryland; trapped ions). DARPA states they join Microsoft and PsiQuantum, which advanced to Stage C after taking part in US2QC, a pilot precursor to QBI.

• DARPA states QBI is designed to verify and validate whether any quantum computing approach can achieve utility-scale operation, meaning its computational value exceeds its cost, by 2033.

• DARPA states Stage C tests whether the proposed utility-scale systems can be constructed as designed and operated as intended. IonQ states that multiple generations of its Superion systems will go through DARPA's independent verification and validation.

• DARPA's programme page lists seven organisations remaining in Stage B, including Quantinuum, QuEra Computing and Xanadu, and DARPA states it expects additional companies to advance to Stage C.

Why it matters: This is the one place in the week where vendor roadmaps go in front of an independent government verifier with funding attached. That changes the evidence base for anyone relying on hardware timelines in a risk model. Two cautions apply. Stage C selection is not confirmation that any architecture will work as planned, and "up to" figures are ceilings contingent on appropriations, not committed sums. Procurement and investment committees should cite QBI stage status as a dated fact and keep each vendor's own delivery claims attributed. Neither stage status nor a vendor's delivery claims change the cryptographic migration case, which rests on dates already published.

🇺🇸 United States - Gartner Sizes 2026 Quantum Revenue at USD 869.9 Million and Forecasts Over Half of Start-ups Failing by 2030

Market Sizing / Vendor Viability / Public Sector Demand

The Detail: On 8 October 2026 Gartner, in a press release datelined Stamford, Connecticut, published its quantum computing revenue forecast.

• Gartner forecasts worldwide quantum computing revenue of USD 869.9 million in 2026, up 22.9% year on year, and USD 1.1 billion in 2027.

• Gartner projects the public sector will lead spending through 2027, at USD 219 million in 2026 and USD 245 million in 2027, with banking, finance and insurance overtaking it from 2028 (USD 289 million against USD 280 million).

• Gartner expects that by 2030 an exhaustion of viable commercial revenue will force over 50% of quantum computing start-ups out of business, and describes the market as overcrowded.

• Gartner VP Analyst Gaurav Gupta states that "the early quantum advantage era has arrived" because noisy intermediate-scale processors can now do limited complex tasks. That is Gartner's characterisation.

Why it matters: Gartner's own attrition estimate is a counterparty-risk statement. The forecast applies to quantum computing start-ups and does not extend automatically to PQC software and cryptographic-component providers. The governance lesson carries across: any organisation embedding a component or service from an early-stage vendor should test financial continuity, support, portability, source-code escrow and exit terms before signing. The forecast also describes a relatively small market in which Gartner expects the public sector to remain the largest spending segment through 2027, at about a quarter of 2026 revenue. A revenue forecast is not risk evidence, and the "advantage" language refers to limited tasks with no bearing on cryptanalytic capability. In "The Hidden PQC Cost in Quantum M&A" (5 October 2026) I set out why consolidation of this kind brings inherited cryptographic debt into each transaction.

🇺🇸 United States - DOE Names Eight Priority Applications to Inform Its Fault-Tolerant Quantum Programme

Scientific Utility / Benchmarking / Public Investment

The Detail: On 8 October 2026 the US Department of Energy announced its Quantum Genesis Priority Applications: eight applications, with example target computations, across four scientific domains.

• The domains are chemistry (reaction mechanisms and dynamics in complex chemical systems), materials (quantum materials and materials in extreme environments), subatomic physics (the interactions that create protons and neutrons, and the structure of atomic nuclei) and applied mathematics (the linear and differential equations that underpin much of science).

• DOE states it will use the applications to inform the execution of the three pillars of Quantum Genesis: the Q Competition, a National Quantum Computing User Facility, and focused research on applications of fault-tolerant quantum computers.

• A White House fact sheet of the same date describes them as eight key problems that will guide the Quantum Genesis Q Competition.

• The Q Competition is not new this week. DOE launched it on 17 September 2026 with up to USD 215 million in planned funding, for systems with "at least 100 logical qubits". Applications close on 19 October 2026.

Why it matters: No scientifically relevant fault-tolerant machine is evidenced by this announcement. DOE has named the workloads that are to inform its programme, which puts a government science agency in the position of saying what useful means. Application definitions and funding objectives are programme architecture; demonstrated capability is a separate matter. Procurement, policy and investment teams should record the eight applications as evaluation targets and read them alongside DARPA's Stage C verification: both move the test of hardware claims out of the vendors' hands. Cryptanalysis is not among the four domains.

🇺🇸 🌐 United States / IETF - Microsoft Tells Enterprises to Test Post-Quantum Certificate Ecosystems as the IETF Composite ML-KEM Draft Advances

PKI / ML-DSA-87 / Composite ML-KEM / Vendor Readiness

The Detail: On 8 October 2026 the Microsoft Security Blog published "Post-quantum authentication: Why organizations should start testing certificate ecosystems now".

• The guidance centres on Microsoft's PQC TLS Pilot Program, launched on 27 August 2026, under which approved certificate authorities in the Microsoft Trusted Root Program evaluate ML-DSA-87 roots and issuance. Microsoft states the August release added seven pilot roots operated by ComSign, DigiCert, HARICA, IdenTrust Services, Sectigo, Shanghai Electronic Certification Authority and SSL.com. Admissions remain open through the end of 2026.

• Microsoft states that pilot certificates are not publicly trusted and must not be used for production or public-facing websites.

• Support on supported Windows 11 systems begins with the 28 July 2026 updates, and ML-DSA certificates can be used with Schannel in supported scenarios.

• Microsoft's six recommended steps begin with inventorying certificate-dependent systems and include assessing CA, PKI, HSM, software and platform vendor roadmaps.

On 6 October 2026 the IETF LAMPS Working Group published revision 22 of draft-ietf-lamps-pq-composite-kem, which defines combinations of ML-KEM with RSA-OAEP, ECDH, X25519 and X448 for X.509 PKI. Its intended status is Proposed Standard. The draft notes that certain jurisdictions have recommended that ML-KEM be used only within a hybrid, and cites BSI and ANSSI among the agencies that advocate hybrid schemes.

Why it matters: Authentication is where dependency chains run deepest: certificates, trust anchors, HSMs, appliances and firmware must move together, and a large share of that sits inside supplier products. Microsoft supplies a test environment; the IETF draft supplies the encoding that lets hybrid keys travel through existing PKI structures. Neither substitutes for knowing which systems issue, validate or store certificates. I set out how cryptography inside supplier software escapes discovery in "Shadow Cryptography: The Estate Nobody Signed For" (7 October 2026), and why hybrid mandates in one market and hybrid prohibitions in another leave organisations holding dependencies they did not choose in "Sovereign Algorithms: The Dependency Nobody Chose" (8 October 2026). Vendor "PQC-ready" claims on CA, HSM and appliance roadmaps should be tested against evidence, which is the scope of Quantum Trust and PQC Assurance Services.

🇬🇧 United Kingdom - University of Sussex Spin-out Universal Quantum Closes a Series A Above USD 100 Million

Capital Markets / Trapped-Ion Hardware / UK Spin-out

The Detail: On 8 October 2026 the University of Sussex announced that its spin-out Universal Quantum has secured over USD 100 million in Series A funding.

• The University describes it as the largest Series A raised by a UK quantum firm and a record for a Sussex spin-out.

• The round was co-led by Firgun Ventures and DCVC, with participation from EDBI, Invus, Integral GlobalTech, Main Sequence, Hostplus, NGS Super, IAG Capital, EdenBase, Full Disclosure and Dave Baszucki, among others.

• The University states the company has sites across three continents and more than 100 employees. Chief Executive Dr Sebastian Weidt states the company's progress "reflects our partners' belief that we represent one of the most credible paths to quantum computing at scale". That is the company's claim.

• Secondary coverage reports the funds will support a planned R&D centre in Singapore and expansion in the United States, Japan and Hamburg. The Singapore centre itself was announced by Universal Quantum in September 2026, in a release carried on the EDB site, outside this window.

Why it matters: The round shows sovereign-adjacent capital (Singapore's EDBI, Australian superannuation funds) taking positions in UK-originated hardware. For UK policy, the question is where the intellectual property, manufacturing and talent will sit as the company scales across jurisdictions. For buyers and partners, a multi-jurisdiction footprint brings export-control, data-residency and supply-chain questions that should be settled in contract before reliance. "Largest" and "most credible" are the issuer's characterisations.

🇺🇸 United States - Oratomic Reports USD 775 Million Raised Since Its March 2026 Launch

Capital Markets / Neutral-Atom Hardware / Concentration Risk

The Detail: On 8 October 2026 Oratomic, in a press release datelined Pasadena, California, announced that it has raised a total of USD 775 million since its launch in March 2026.

• The release states the financing was led by ARCH Venture Partners, Spark Capital, Khosla Ventures, Index Ventures, General Catalyst and Bezos Expeditions.

• Oratomic states it is building fault-tolerant quantum computers on reconfigurable neutral-atom arrays and quantum error correction, and that funds will support its team, laboratory infrastructure and systems.

• Secondary reporting describes the latest tranche as a USD 475 million Series B at a valuation of about USD 5.4 billion, and quotes the chief executive expecting a large-scale fault-tolerant machine by 2030. Neither figure appears in the release text I reviewed.

Why it matters: Read alongside Gartner's forecast, the same week produced a 2026 market sized at USD 869.9 million and a single seven-month-old company reporting USD 775 million raised. That gap between capital and revenue is the condition Gartner's attrition estimate describes. Investment and procurement committees should treat fault-tolerance dates from privately funded developers as attributed claims, and should not let headline capital substitute for independent technical verification of the kind QBI provides.

🇯🇵 🇺🇸 Japan / United States - Fujitsu Signs an MOU with New Mexico to Establish a Quantum Computing Research Centre

Regional Capital / Research Infrastructure / Intent, Not Capacity

The Detail: On 8 October 2026 the Office of the Governor of New Mexico announced a collaboration with Fujitsu to establish a quantum computing research centre in the state. Fujitsu published its own release from Kawasaki on 9 October. Fujitsu's release pictures an MOU signing with Governor Michelle Lujan Grisham and Fujitsu CTO Vivek Mahajan.

• The centre is to cover quantum hardware, software, algorithms and theory, with education and workforce programmes.

• Fujitsu will collaborate with the Quantum New Mexico Institute, builds on existing FUJITSU-MONAKA work with New Mexico State University, and will "explore" joint research with Sandia National Laboratories, Los Alamos National Laboratory and the University of New Mexico.

• Fujitsu's release states that the State has committed USD 150 million to support investments alongside companies establishing or expanding quantum operations in New Mexico. The Governor's office states that more than USD 450 million has been committed to quantum since 2019, including a USD 150 million research fund. Fujitsu's release discloses no Fujitsu funding amount, no dates and no named quantum system.

Why it matters: This is a statement of intent with a state incentive attached; the USD 150 million is a general state commitment and carries no Fujitsu allocation. The facility and the state funding are located in New Mexico; the Japanese dimension is corporate. Organisations that might later consume services from a hybrid quantum-HPC centre should ask where data, keys and intellectual property would reside, which export-control regime applies, and which jurisdiction governs the service. None of those questions can be answered from the release. In "WEF Next-Generation Computing Framework: Readiness Is Not an Investment Case" (11 October 2026) I set out the evidence gates, workload economics and named decision owners that should sit between an announcement of this kind and any commitment of capital.

🇺🇸 United States - IonQ Claims 1 kHz Entanglement Between a Trapped Ion and a Solid-State Memory

Hardware Architecture / Quantum Networking / Vendor Claim

The Detail: On 9 October 2026 IonQ, datelined College Park, Maryland, announced a demonstration of a memory-enhanced quantum interconnect.

• IonQ states it achieved entanglement rates above 1,000 per second between a trapped-ion qubit and a silicon-vacancy solid-state memory through a photonic interconnect.

• IonQ claims this is "the fastest quantum interconnect rate between qubits of any platform" and more than four times the previous trapped-ion record, which it attributes to IonQ co-founder Chris Monroe's research group at Duke University. Monroe, IonQ's Chief Scientist, is also a collaborator on the paper.

• IonQ states the architecture is expected to be compatible with other qubit types, including neutral atoms and superconducting systems with transducers. The demonstration itself used trapped ions.

• IonQ links the work to DARPA's HARQ programme. The associated arXiv preprint (2610.10705), submitted on 7 October 2026, reports an average ion-to-memory Bell-pair rate of 1.03 kHz at 87.9% fidelity, and describes the rate as four times that of the fastest photonic link between two trapped ions. Neither figure appears in IonQ's release. The preprint has not undergone journal peer review, and I identified no independent replication.

Why it matters: Interconnect rate bears on modular scaling. It does not bear on cryptanalytic capability today. The "world-first" and "fastest" labels are IonQ's. The preprint supports the measured rate; the claim of a record across all platforms depends on which benchmarks are compared. The comparison baseline is a result from a group led by IonQ's own co-founder, and the preprint has not been peer reviewed. Risk and investment committees should record the result as an attributed vendor statement until replication or review. The Quantum Cryptographic Assurance Standard provides a structure for separating vendor claims from validated evidence.

🇬🇧 🇲🇾 United Kingdom / Malaysia - SITG-Consulting and MTechnix Sign an MOU Linking Cryptographic Assurance to Certification Readiness

Independent Assurance / Certification Readiness / Evidence Continuity

The Detail: On 10 October 2026 I announced that SITG-Consulting has signed a memorandum of understanding with MTechnix Sdn. Bhd., a Kuala Lumpur firm led by Madan Kumar Panwar, to give clients a defined route from independent cryptographic assurance to certification readiness.

• SITG-Consulting provides independent validation, assurance and governance advisory on cryptographic risk.

• MTechnix prepares organisations for certification against recognised standards, including ISO/IEC 27001 (information security), ISO 22301 (business continuity) and ISO/IEC 20000-1 (IT service management), supports System and Organization Controls 2 (SOC 2) readiness, and carries out compliance assessments against IEC 62443 for industrial control environments.

• MTechnix arranges certification through accredited certification bodies.

• Each piece of work is scoped under its own Statement of Work.

Why it matters: The gap the arrangement addresses is structural. A post-quantum cryptography programme produces decisions on algorithms, inventories, migration sequencing and control ownership. A certification audit asks whether controls are documented, operating and evidenced. Where the two sit with unconnected advisers, the evidence produced for one may not be in the form the other requires, and the audit exposes the difference. For clients in financial services, critical infrastructure, healthcare, energy, telecoms and government, the arrangement gives one line of sight from cryptographic risk through to the certification they are pursuing. This is my own announcement and sits outside the count of independently sourced signals in this edition.

🌐 Global Sweep - The Auditor Measured Readiness While the Market Measured Capital

Ecosystem / Capital Markets / PQC Infrastructure / Hardware Architecture / Sovereign Security

The Detail:

• Governance: GAO published a dated baseline of federal PQC preparation (none of 24 agencies fully addressed all three practices). Europol said timing uncertainty should not be the main concern and that crypto-agility should be pursued proactively. Both start from the same dependency: know what cryptography runs, and be able to change it.

• PQC infrastructure: Microsoft urged certificate-ecosystem testing under its ML-DSA-87 pilot, and the IETF published revision 22 of the composite ML-KEM draft for X.509. Both make inventory of certificate-dependent systems the first step.

• Hardware architecture: DARPA moved Atom Computing, Diraq, IBM and IonQ into QBI Stage C independent verification. DOE named eight priority applications to inform its fault-tolerant programme. IonQ separately claimed a 1 kHz ion-to-memory interconnect, reported in a preprint that has not been peer reviewed.

• Capital markets: Gartner sized 2026 revenue at USD 869.9 million and forecast over 50% start-up failure by 2030. In the same week Oratomic reported USD 775 million raised and Universal Quantum closed a Series A above USD 100 million. Fujitsu signed an MOU with New Mexico, which cites a USD 150 million state quantum commitment.

• Sovereign security: no sovereign PQC deployment or new national mandate was confirmed in the window.

• Regions with no confirmed in-window signal meeting the primary-source standard: Canada; Germany, France, Netherlands, Finland, Sweden, Denmark, Spain and Italy (beyond the EU-level Europol signal); GCC (Qatar, UAE, Saudi Arabia, Bahrain, Kuwait, Oman); China, South Korea, Australia (no Australian-sourced signal; Sydney-based Diraq's Stage C entry is confirmed by DARPA's 7 October release and counted under the United States), Singapore, India and Taiwan; Africa (South Africa, Nigeria, Kenya, Ghana); Latin America (Brazil, Chile, Mexico, Colombia).

• Geographic position: the eleven signals come from US, EU, UK and Japanese sources and one international standards body. Fujitsu's research centre and its state funding are located in New Mexico, so Japan contributes a corporate source and no located development. The SITG-Consulting and MTechnix MOU is my own announcement and sits outside the count. The list above records that no signal was verified to the primary-source standard; it does not show that nothing occurred in those jurisdictions.

• Standards bodies and regulators with no confirmed in-window PQC output: NIST, ENISA, UK NCSC, BSI, ANSSI, ASD, CRYPTREC, ETSI.

• My weekly PQC Governance Digest (cut-off 9 October 2026) (10 October 2026) tracked the GAO, Europol, Microsoft and IETF signals against the same verification standard.

Why it matters: Two measuring systems ran in parallel. Auditors and agencies measured readiness and found it incomplete; investors and analysts measured capital and found it abundant. The governance consequence is sequencing. Capital flowing into hardware does not shorten an organisation's own migration path, and a hardware milestone does not create an inventory. In "The PQC Baker's Dozen" (6 October 2026) I noted that eight of thirteen common transition mistakes happen before any cryptography changes. This week's evidence fits that pattern.

🔮 SITG-Consulting COMMENT - THE WEEK'S REAL SIGNAL

The week's highest-consequence signal is the GAO baseline. It is public, dated and auditor-sourced, and it records that agencies with a written instruction from November 2022, a statute behind it and the standards body inside the same government had not fully addressed three preparatory practices. Every board can now be asked a direct question: on the same test, what would we score?

• GAO: the bottleneck is expertise, process and funding method. A programme that opens with algorithm selection or a product purchase and defers inventory repeats the gap GAO documents. The agency plans due on 22 October will show whether that has moved; the memorandum does not provide for their publication.

• Europol: its position is that timing uncertainty should not be the main concern, because adapting systems takes time. Data with long confidentiality life, retained today under classical key exchange, is a present exposure, and retention policy is a control. Europol's own statement that large-scale HNDL exploitation is not evidenced should stay in the register beside the warning.

• Microsoft and the IETF: authentication is the harder migration because it runs through suppliers. Inventory of certificate-dependent systems is step one on both documents. Organisations that cannot name which appliances, HSMs and applications validate their certificates cannot plan this phase.

• DARPA QBI and DOE: independent verification of hardware roadmaps is now funded and under way, and DOE has named the scientific workloads that are to inform its fault-tolerant programme. Cite stage status and application definitions as fact; keep delivery dates attributed to the vendors who state them.

• Gartner, Oratomic and Universal Quantum: abundant capital, a sub-USD 1 billion market and Gartner's forecast that over half of quantum computing start-ups will be forced out of business by 2030 sit side by side. Vendor continuity, source-code escrow, portability and exit terms belong in third-party risk registers before any quantum or quantum-safe component enters a critical path.

The defining shift: evidence of incomplete preparation is now a published benchmark rather than an emerging expectation. In "Why 'Start With Discovery' Is the Wrong First Step in PQC Transformation" (12 October 2026) I set out why an executive mandate and governance gates must come before the scan. A PQC Discovery Sprint run inside that mandate is the bounded route to the inventory GAO found incomplete at 23 of 24 agencies.

⚠️ Important - What Was NOT Missed

• No credible evidence of near-term cryptographically relevant quantum advantage. GAO records expert views that a CRQC is possible as soon as the 2030s, with widely varying estimates.

• No breakthrough reducing the need for hybrid PQC. The IETF composite ML-KEM draft and BSI and ANSSI hybrid preferences point the other way.

• No validated vendor claim that changes enterprise migration timelines. IonQ's interconnect result and fault-tolerance dates quoted in funding coverage remain attributed claims.

• QuantumGate and NEC GCC's UAE post-quantum partnership appeared in trade coverage on 5 and 6 October; QuantumGate's own news listing dates it 30 September 2026. Excluded as out of window.

• An article titled "Preparing your cryptography for post-quantum computing", syndicated on 7 October, is a techUK guest insight published on 6 October 2026. It restates the NCSC's existing 2028, 2031 and 2035 migration milestones and is not a new NCSC publication. Excluded.

• Singapore's National Quantum-Safe Network award was reported on 9 October; the Centre for Quantum Technologies dates the result to 21 September 2026. The QuIC whitepaper on EU Chips Act 2.0 was reported on 10 October; QuIC published it on 17 September 2026. Both excluded as out of window.

• Quantisimo and GigCapital8 announced a definitive business combination agreement on 9 October 2026, filed with the SEC under a GigCapital8 Form 8-K. Closing is expected in the first quarter of 2027, subject to shareholder and listing approvals. Noted here as a pending transaction.

• SEALSQ announced on 6 October that its USD 10 million PIPE in WISeSat had closed on 1 October 2026. Excluded as a transaction completed before the window.

• Universal Quantum's Singapore R&D centre was announced by Universal Quantum on 9 September 2026, in a release carried on the EDB site; Xanadu's QROM cost work dates from May 2026; the NSA's National Security Systems measures and BSI's Classic McEliece advice date from 1 October 2026 and were covered in the previous edition. All excluded as out of window.

• Forward context: DOE Q Competition applications close on 19 October 2026, and OMB M-26-15 agency PQC migration plans are due by 22 October 2026.

  
  

⚠️ Disclaimer

This newsletter is produced by SITG-Consulting for informational purposes only. It does not constitute professional advice, whether legal, technical, regulatory, or otherwise. The content reflects publicly available information and the author's independent analysis as of the date of publication. Readers should verify all claims independently and seek qualified professional counsel before making decisions based on this material. SITG-Consulting accepts no liability for actions taken or not taken based on the contents of this newsletter.

Previous edition: https://www.sitg-consulting.com/post/quantum-weekly-the-global-signals-that-actually-mattered-28-september-4-october-2026 Full archive: https://www.sitg-consulting.com/blog