Subscribe now

In this edition: When I led the last edition with the cryptography executive order, it was the only document on the table. Since then the rest of the architecture has landed, and a memorandum signed before the order turns out to be the piece that holds the whole thing together. I walk through the three-layer structure, built in a deliberate order: NSPM-12 as the governance keystone, signed ten days before the executive order with its role in the framework clear only now; the executive order and the Department of War strategy as the mandates; and OMB M-26-15 as the implementation playbook that arrived in two days when the order allowed ninety. I cover why the same 2030 and 2031 dates mean three different things depending on which document you read, why SLH-DSA is approved for civilian systems but banned from National Security Systems, where the three words “unless otherwise noted” put a 2033 deadline back on the table, and why the FAR contractor rule is the part of all this most likely to reach your organization whether or not you sell to the government. The companion quantum innovation order gets its due, the shared certification bottleneck gets named, and the Flapdoodle covers the quantum substitutes the Pentagon just declared out of bounds. Also: the official Federal Register numbers for the EOs are in, and are not what the whole media published the last few days.

What the Executive Order Started, Four Documents Finished

For four years the federal post-quantum framework told agencies to get ready and never told them when to be done. The pieces were real. NIST published three PQC standards in August 2024, the Quantum Computing Cybersecurity Preparedness Act created a statutory obligation, NSM-10 set a 2035 risk-mitigation goal, and OMB M-23-02 imposed planning deadlines for inventories and reporting. What was missing was a dated, enforceable line telling agencies when migration itself had to finish. June 2026 filled that gap, and it did so with five documents that interlock rather than overlap.

Read together, they form a three-layer architecture assembled in a deliberate order: governance first, mandates second, implementation third. The governance layer is NSPM-12, signed June 12, which overhauled cybersecurity governance for National Security Systems for the first time in 35 years. It re-established the Committee on National Security Systems with the power to issue binding directives to every agency that operates an NSS, and it named the NSA Director as National Manager. That memorandum has nothing to say about post-quantum cryptography directly. It is the layer that makes CNSA 2.0 enforceable government-wide instead of inside the Pentagon alone.

The mandate layer came ten days later. EO 14412 set hard deadlines for civilian high-value assets and high-impact systems, with NSS carved out by name. The Department of War PQC Strategy, released June 23, covered the systems the order deliberately does not touch. EO 14413 established the offense-side complement. Then the implementation layer: OMB M-26-15, the civilian execution playbook, landed June 24.

Here is the one sentence your board needs: every federal high-value asset and high-impact system, civilian and defense alike, now carries a dated PQC migration deadline with a named accountable official behind it, and through federal procurement that obligation is about to reach a large slice of the private sector. The carve-out for National Security Systems hands those systems to a separate authority chain, the one NSPM-12 created, where the CNSS and NSA enforce CNSA 2.0.

I put the whole framework in one frame in a complete reference guide; this edition is the curated tour.

The Civilian Half: EO 14412 and the Playbook That Arrived in Two Days

Executive Order 14412 sets the top-level dates for civilian federal systems. High-value assets and high-impact systems, meaning anything rated “high” under FIPS 199, must transition to ML-KEM (FIPS 203) for key establishment by December 31, 2030, and to ML-DSA (FIPS 204) for digital signatures by December 31, 2031. The one-year split is the right call, and it is the sequencing I have argued for through the Applied Quantum PQC Migration Framework for years. Key establishment goes first because Harvest Now, Decrypt Later is an active threat against data in transit today, and because swapping a key-encapsulation algorithm into a key exchange is operationally lighter than rebuilding a certificate hierarchy. Signatures get the extra year because signature migration touches PKI, cross-certification, and the entire certificate lifecycle. The order describes the harvesting threat in all but name, stating that adversaries can collect encrypted data now and decrypt it once quantum capabilities mature.

OMB M-26-15, signed by OMB Director Russell Vought, turns those dates into an operational plan. Section 4(b) of the order gave OMB ninety days to issue this guidance. OMB delivered it in two. Combined with the DoW strategy, which was cleared for publication in April and held for a June 23 release, the pattern is obvious: the orders, the defense strategy, and the OMB memo were drafted as one package, and the signing was the starting gun for releasing documents that were already written. Anyone waiting for the implementation details before acting has lost that excuse.

The memo establishes a five-phase timeline running from 2026 to 2035. Phases 1 and 2 cover strategy, discovery, and pilots through 2028. Phase 3 completes key-establishment migration for the priority categories by 2030, Phase 4 completes signatures by 2031, and Phase 5 sweeps up the remaining civilian systems by 2035. That last phase is the first official federal document to reconcile the order’s hard 2030 and 2031 dates with the broader 2035 horizon. For any organization that has been unsure whether 2030 or 2035 was its planning target, the answer is now precise: it depends on how your systems are classified. Hold federal high-value data or run a high-impact system, and your date is 2030. Everything else gets 2035 at the latest.

Two provisions are written for the engineering team as much as for the planners. First, M-26-15 treats crypto-agility as an implementation requirement with named architectural patterns rather than a principle to aspire to. A system hardcoded to a specific algorithm is out of compliance even when that algorithm is correct today. Second, the memo calls hybrid cryptography “an intricate and resource-intensive stopgap,” cooler language than most European regulators use, which signals that OMB sees full PQC as the target and treats dual-stack operation as a transitional state agencies should plan to exit. Agency migration plans are due to OMB and the Office of the National Cyber Director around October 22. The plan that lands on a federal CISO’s desk this October has to include phased timelines, automated inventory, resource estimates, and governance roles, and none of that gets assembled in 120 days by an agency that has not already started.

One civilian-side wrinkle that matters for contractors. M-26-15 approves SLH-DSA (FIPS 205, the hash-based scheme formerly called SPHINCS+) as a conservative signature fallback that avoids lattice assumptions. CNSA 2.0 deliberately excludes it. A civilian agency can choose it; a National Security System cannot. That divergence is small on paper and a real tracking problem for any organization that straddles both worlds.

The Defense Half: the DoW Strategy and the 2033 Hiding in Three Words

The Department of War PQC Strategy is the defense-side companion to the executive order, and that pairing is the story. For the first time, US post-quantum migration carries dated deadlines on both sides of the line separating ordinary federal systems from National Security Systems. DoW Chief Information Officer Kirsten Davies announced the release and tied it to the previous day’s executive actions, though the document itself carries an April 16 clearance stamp. It was finished early and held to land alongside the orders.

The strategy sets two headline dates. By December 31, 2030, all DoW systems must support PQC or be phased out. By December 31, 2031, all DoW systems must use PQC, “unless otherwise noted.” It organizes the work into five lines of effort and two acquisition tracks: a High Assurance track for NSA-certified devices that depend on the agency’s Key Management Infrastructure, and a Commercial Solutions track built on NIST-standardized algorithms in commodity IT. It builds on a November 2025 CIO memorandum that already required component-level inventories, named migration leads, and pre-deployment approval for PQC technologies.

Now the three words. “Unless otherwise noted” is the most consequential clause in the document, because it is what puts 2033 back into a plan that otherwise reads as 2030 and 2031. The strategy commits NSS to CNSA 2.0, whose exclusive-use dates run to 2033 for operating systems, web and cloud services, large PKI, and constrained devices. Those are exactly the categories the strategy spends most of its length on: embedded encryption units in weapon platforms, enterprise defense PKI, the edge devices in unmanned and space systems. The hardest systems in the portfolio answer to a 2033 backstop baked in by reference, even though the headline date reads 2031.

This is worth flagging because the DoW press release claimed the department would “accelerate ahead of the timelines” set by the executive order. That claim is not quite justified by the actual text. The order does not set timelines for the DoW’s core National Security Systems in the first place; it scopes its dates to civilian high-value and high-impact systems and routes NSS through a separate channel under CNSA 2.0.

On the systems where a fair comparison exists, the DoW’s milestones are softer, not harder. The order requires civilian high-value systems to complete key-establishment migration by 2030. The strategy requires only that systems support PQC by 2030, with use deferred to 2031. A capability gate is a weaker commitment than a finished migration. The department moved fast on tempo, and that speed is real and to Davies’s credit. It did not commit to earlier end dates than the rest of government.

Where the strategy is strongest is its refusal to let confidentiality stand in for the whole job. A solution that migrates only encryption, with no PQC authentication, will not count as PQC at all. This writes the Trust Now, Forge Later thesis into federal policy: the signature and authentication threat is systematically underweighted next to encryption, and for a department whose catastrophic scenarios include forged firmware signatures on weapon systems, putting authentication on equal footing is the correct judgment. The strategy also defines “done” as deprecation across the entire data pathway, with the vulnerable algorithms removed rather than left running alongside the new ones, and it rejects QKD and other false substitutes outright. Even outside the Pentagon this lands: a two-order, one-strategy, one-sensing-program rollout in a single week is a national-security posture shift, and the effective federal deadline moved to 2030 whether you wear a uniform or not.

The Same Two Years, Sliced Three Different Ways

Here is the part almost every write-up of this rollout has missed, and it is where migration programs go to fail. The executive order and the DoW strategy both land on 2030 and 2031, so the convergence looks like alignment. The two documents are slicing the same deadline along entirely different axes, and a third axis sits underneath them.

The executive order slices by cryptographic function: key establishment by 2030, signatures by 2031. The DoW strategy slices by migration stage: support by 2030, exclusive use by 2031. CNSA 2.0, which governs the National Security Systems at the center of the defense plan, slices by product category: software and firmware signing and traditional networking reach exclusive use by 2030, while web and cloud, operating systems, large PKI, and constrained devices run out to 2033.

Picture a CISO at a defense prime. As a federal contractor, the firm answers to the order’s FAR rule, which flattens everything to one date: comply with NIST’s PQC standards by 2030. The civilian agencies it sells to slice that deadline by function. Its NSS-adjacent work slices it by stage. The NSS hardware underneath slices it by product category, with the categories running to 2033. The same two years, decomposed three ways, plus a flat procurement date, and none of the four congruent with the others. The headline convergence is real. So is the divergence underneath it, and the systems hardest to migrate are precisely the ones where the schedules pull apart. If you span civilian and defense systems, map every system against all of these lattices, because the earliest binding deadline that applies to you is your real deadline, and “2030 and 2031” hides more than it reveals.

The Contractor Cascade Is the Part That Reaches You

If you take one operational point from this edition, take this one. The procurement provision is where the federal mandate reaches furthest into the private sector, and it reaches organizations that may never deal with a federal agency directly.

The order directs the FAR Council to publish a proposed rule within 180 days, putting it around December, requiring covered contractors to comply with NIST’s PQC standards by December 31, 2030. Once finalized, that rule extends the federal mandate into the private sector through the largest lever the government has over technology: the point of sale. A prime contractor that needs PQC-validated products by 2030 imposes that requirement on its subcontractors, who impose it on their suppliers, and the obligation propagates down every tier until it reaches companies far from any federal contract. This is the pattern that made FedRAMP the de facto cloud security baseline and is making CMMC the baseline for defense supply-chain security. The DoW strategy compounds it by directing CMMC updates to include PQC requirements and by sitting on top of the November 2025 memo’s inventory and approval regime.

For a defense prime, that means the FAR rule for civilian work, CMMC-PQC and the November memo for defense work, and CNSA 2.0 for anything NSS-adjacent, all at once. The one piece of good news is the Cryptographic Bill of Materials mandate, which directs CISA and NIST to define minimum CBOM elements within 270 days, around March 2027. That gives contractors a common format to demand structured cryptographic data from their own suppliers. I have argued for years that you cannot migrate what you cannot inventory, and three overlapping compliance regimes cannot be tracked in a spreadsheet. The bottom line: a rule nominally aimed at “covered federal contractors” will, in practice, set PQC expectations across a large share of the US technology economy by the end of this decade, and the companies that cannot demonstrate compliance by 2030 risk losing access to supply chains that serve the largest technology buyer on earth.

The Bottleneck Both Tracks Share

Every part of this plan funnels through a validation chokepoint, and the coordinated rollout makes the problem worse rather than better, because the chokepoint exists on both tracks at once. On the High Assurance side, NSA certification gates every encryption unit, and Type 1 certification has historically been the binding constraint on military crypto modernization. On the commercial side, the Cryptographic Module Validation Program gates every product that needs FIPS 140-3 validation, and that process currently runs around 18 months or longer.

The order tells NIST to accelerate the validation program. The DoW strategy calls for streamlined NSA certification. Both documents acknowledge their respective chokepoint. Neither has widened it. An order to accelerate a certification queue is a statement of intent, and intent has never validated a cryptographic module. Here is where I would put my own money on a slipped date: if any of the 2030 deadlines gives way, it gives way here, in the gap between the volume of products that need validating and the throughput of the programs that validate them.

The Other Order: Building the Threat While Defending Against It

EO 14412 has a twin. Executive Order 14413, “Ushering in the Next Frontier of Quantum Innovation,” is the offense-side complement, and the two are designed to work as a pair. One races to defend the nation’s data; the other races to build the machines that will eventually threaten it.

The order’s centerpiece is the Quantum Computer for Application Development and Discovery Science initiative, a national effort to deliver a science-grade quantum computer to a Department of Energy facility, one that performs scientific work no classical computer can replicate. The language carefully sidesteps the trap of “quantum supremacy” benchmark claims. The Secretary of Energy has ninety days to publish technical specifications, which will be the first real signal of what the government considers achievable and which hardware approach it believes is closest. The order also directs three next-generation quantum sensor projects to be fielded by September 30, 2028, with the DoW announcing a sensing initiative of up to $200 million, and it treats the quantum supply chain as a sovereignty problem, echoing the argument I made in Quantum Sovereignty: the “just buy the box” escape hatch is closed, because the vendor still controls firmware, calibration, and support, and answers to its own government’s jurisdiction.

The honest caveat is funding. The order directs spending “subject to the availability of appropriations,” which means Congress still has to authorize it. The $625 million the White House cited is existing investment, not new money attached to the order. The policy direction on both offense and defense is now set, and the cross-reference between the two orders ties them together: the innovation order asks the DNI and the Secretary of War to track the national-security implications of advancing quantum computers, “such as the implications for the migration to post-quantum cryptography.” Whether execution matches ambition is a question for the procurement machinery and the appropriations process, not the policy.

Quantum Flapdoodle: The Substitutes the Pentagon Just Named Out of Bounds

This rollout did the debunking work for me, so let me amplify it. Both the DoW strategy and OMB M-26-15 close the door on the alternative-physics shortcuts that vendors have been selling as escapes from the migration work. The strategy refuses quantum key distribution, quantum networking, non-local quantum randomness, and pre-shared-key schemes that lack PQC asymmetric key establishment as legitimate routes to quantum resistance. The OMB memo lists only the NIST-standardized algorithms and adds a one-line warning at the bottom of its table: symmetric-key-based protocols should also be avoided. There are no alternative routes on offer.

If you are still being pitched a “mathematically proven unbreakable” box, or a proprietary algorithm that conveniently sidesteps the standards process, or QKD as a drop-in replacement for the cryptography the order just mandated, the federal government has now told you in two documents that those things do not count. The reasoning on symmetric key distribution is worth keeping straight, because it is subtle. The symmetric algorithm itself is not the concern, Grover’s algorithm and its debatable practical feasibility aside. The concern is symmetric key establishment and distribution riding on a channel that itself uses quantum-vulnerable cryptography, where the symmetric protection is only as strong as the key-distribution mechanism underneath it. Any vendor still pitching one of these excluded technologies into federal procurement is selling a future audit finding dressed up as a security product.

From the Applied Quantum Desk

A quiet note of validation, then back to work. The framework I publish freely, the Applied Quantum PQC Migration Framework, already answers most of what these documents make mandatory: the minimum-viable CBOM, the separation of key-establishment and signature tracks, crypto-agility architecture, and vendor governance. The federal package did not change the methodology. It removed the margin for delay.

If you are a CISO staring at an October plan deadline, a program manager mapping systems against three deadline lattices, or an investor doing diligence on a vendor’s PQC roadmap, Applied Quantum does this work: crypto-inventory, crypto-agility implementation, PQC migration, vendor due diligence, and procurement support. The book-length version of the methodology lives in Quantum Ready, and the self-assessment scorecard is a free diagnostic if you want to see where you stand before the plan is due.

What to Do Now

The actions have not changed since I first wrote them. The deadline has.

• Build a cryptographic inventory you can audit. Use automated tooling now, software composition analysis and protocol scanners, and build toward a central CBOM even before the federal standard drops in early 2027.

• Identify your binding deadline. High-value or high-impact system, 2030. DoW system, support by 2030 and use by 2031. NSS under CNSA 2.0, category-dependent up to 2033. Federal contractor, 2030. Non-priority civilian, 2035. If more than one applies, the earliest one governs.

• Put crypto-agility in your procurement specs today. A system you buy in 2027 that cannot swap algorithms without re-architecture is a system you will be replacing before 2030.

• Force your vendors onto PQC roadmaps with named delivery dates. Procurement-driven compliance reaches further and faster than regulation, and it is about to reach your supply chain.

• Stop handicapping Q-Day. None of these documents estimate when a cryptographically relevant quantum computer will exist. They treat it as a planning assumption and set deadlines on migration complexity and the harvesting threat. As I have written for years, the ecosystem, not the physics, sets the clock now.

If this map saved you an afternoon of reading five policy documents, forward it to the colleague who still thinks they have until 2035. Corrections are welcome and I publish them, as the EO-number fix at the top of this edition shows. Hit reply, tell me what I missed, and tell me whether a single-theme special edition like this one is useful or whether you prefer the usual mix. I read everything.

— Marin

Subscribe now

In this edition: President Trump signed Executive Order, setting the first enforceable federal completion deadlines for post-quantum migration: key establishment by December 2030, digital signatures by December 2031, with contractors pulled in through FAR amendments and a new cryptographic-bill-of-materials mandate. I predicted this almost exactly a month ago. I walk through what the order does, why the 2030 headline matters well beyond the agencies it legally binds, and where the open-source PQC Migration Framework already answers the questions it makes mandatory. France's ANSSI confirmed PQC certification requirements from 2027 days earlier. I also cover why implementation risk is now the binding constraint: Daniel Bernstein's ML-DSA key recovery in under a second, the open reproduction of Google's ECC circuits and where the qubit count floors out, and CNSA 2.0 in the new picture. The Flapdoodle: vendors selling "mathematically proven unbreakable" cryptography against the standard the EO just mandated, and fabricated quantum salary guides.

The EO That Moved the Date

If you have been using the US government’s 2035 timeline as a reason to put off your post-quantum migration, that excuse is gone. On June 22, President Trump signed Executive Order “Securing the Nation Against Advanced Cryptographic Attacks,” and the date that matters is now 2030. Every federal high-value asset and high-impact system must complete PQC migration for key establishment by 31 December 2030 and for digital signatures by 31 December 2031. Federal contractors face a 2030 compliance deadline through mandatory Federal Acquisition Regulation amendments.

This is not the first piece of US federal PQC policy. NSM-10 and OMB M-23-02 have required agencies to inventory their cryptography and plan their migrations since 2022, and National Security Systems have had hard dates under CNSA 2.0. I keep a running map of the whole US PQC regulatory framework. What EO changes is the nature of the obligation, not the scope. NSM-10 and M-23-02 already targeted high-value and high-impact systems, but their requirement was to inventory and plan, with 2035 as an aspiration to be met "as feasible." That is a planning mandate with a soft horizon: an agency could file annual inventories and call itself compliant without completing a single migration. The order replaces it with a completion mandate, hard 2030 and 2031 dates, named accountable officials, and FAR rules extending the same deadline to contractors. The scope barely moved. The enforceability did, and the finish line jumped five years closer.

Each agency must appoint a PQC migration lead within 30 days. OMB has 90 days to issue binding migration guidance. NIST must run a pilot migration on its own systems by end of 2027. The order names Harvest Now, Decrypt Later explicitly as a present-tense threat.

I Called This a Month Ago

On May 24, I published a piece arguing that PQC deadlines were about to compress and specifically flagged a draft US executive order pulling federal migration toward 2030. Four weeks later the order is signed, with the dates almost exactly where I expected. The deadlines have been moving in one direction for two years. The signals were public for anyone willing to read them instead of the reassuring headline number.

The Two Sharpest Edges

Two provisions deserve attention beyond the headline dates. The contractor mandate requires the FAR Council to publish a proposed rule compelling covered contractors to comply with NIST FIPS incorporating PQC by 31 December 2030. That reaches every company selling to the federal government, turning a federal completion deadline into a contractual obligation across the defense industrial base and the wider federal supply chain.

The cryptographic bill of materials (CBOM) mandate is the other. Within 270 days, CISA and NIST must define minimum CBOM elements for automated assessment of cryptographic assets in hardware and software. You cannot migrate what you cannot see, and discovery has been the part organizations consistently underestimate. A standardized CBOM is the most consequential part of the order, and the least discussed.

A companion order, EO, was signed the same day to fund a science-grade quantum computer and refresh the national strategy. The same administration is pushing to build the machine and to defend against it.

The 2030 Headline Travels Further Than the Order

The legal force of EO is narrow: it binds federal agencies and, through the FAR, their contractors. It has no hold on a German manufacturer, a Brazilian bank, or a private US company outside the federal supply chain. What it changes is the pressure environment around all of them. For three years, the most common reason I heard for deferring a migration was some version of “the US government says 2035.” That number was NSM-10's "as feasible" aspiration, a planning horizon rather than a completion deadline, but boards reached for it because it was convenient. The executive order deleted five years from that excuse.

Auditors, insurers, and clients who were also anchored to 2035 are recalibrating to the same 2030 headline, and the procurement reach into the contractor base means the deadline propagates through supply chains well past the agencies it formally binds. Your board will see “2030 deadline,” and the question that follows, are we exposed to this, lands on whoever owns security. The legal obligation extends only to federal agencies and their contractors, but the gravitational pull reaches well past them.

If You Don’t Know Where to Start

So the question has landed on your desk. The order specifies what to achieve and by when; it does not tell anyone how. That gap is what I built the open-source PQC Migration Framework to fill: how to run cryptographic discovery and produce a CBOM, how to sequence key-establishment and signature migration against 2030 and 2031, how to handle the hybrid decision, and how to stand up the governance. It is free under CC BY 4.0, with extensions for government, defense, critical infrastructure, financial services, telecommunications, and payments. If you are staring at a compressed deadline and an empty plan, start there.

If you need more than a framework, that is what my company, Applied Quantum, does: cryptographic discovery, CBOM architecture, migration planning, vendor due diligence, and board briefings. The deadline is fixed, the work is large, and the organizations that start while it is a program will not be doing it as a crisis in 2029.

France Confirms: PQC Certification From 2027

Days before the executive order, France’s ANSSI confirmed PQC requirements for product security certification from 2027, with all enterprise purchases expected to be quantum-safe by 2030. France had been signaling this since late last year; the news is the public, dated confirmation, and the convergence it creates. The US sets 2030 for federal key establishment, France sets 2030 for enterprise procurement, the EU’s roadmap targets 2030 for critical infrastructure, and Australia wants classical asymmetric cryptography gone by end of 2030. Four jurisdictions, arriving independently at the same year.

The Deadline Map, Redrawn

I maintain a Global PQC Deadlines Deep Dive mapping 60+ milestones across 15+ jurisdictions, and I am updating it now to reflect the executive order. The compression: September 2026, FIPS 140-2 sunset. November 2026, CMMC Level 2 enforcement. January 2027, CNSA 2.0 procurement gate and ANSSI certification. 2030, the convergence year. 2031, US federal digital signatures.

On hybrid, the jurisdictions still split: BSI and ANSSI mandate it, NCSC and CNSA 2.0 push pure PQC, Australia discourages it. No single global configuration satisfies all of them, which is why crypto-agility has moved from best practice to operational necessity. For the full mapping and the interactive Global PQC Migration Timeline, see the Deep Dive.

Why Implementation Is Now the Binding Constraint

The executive order mandates migration to NIST-standardized algorithms on a hard timeline. The algorithms are well-tested. The implementations are brand new, and that is where the near-term danger lives.

Daniel J. Bernstein published working attack code against two classes of ML-DSA (FIPS 204) software vulnerabilities, recovering the secret key in under one second on a laptop. His probability estimate: 25% of ML-DSA libraries will ship with severe vulnerabilities at initial release, and solo ML-DSA would produce an order of magnitude more breakable keys than hybrid Ed25519+ML-DSA over the next five years. In his framing, the near-term risk from our own implementation code exceeds the near-term risk from quantum computers by three orders of magnitude. I wrote my own analysis of why this settles the hybrid question for now: hybrid carries real cost (double the maintenance, new SOC monitoring for downgrade attacks), but Bernstein’s evidence is why we pay it through the code-maturation period. The EO’s CBOM and vulnerability-disclosure provisions point in the same direction: they treat implementation flaws as the live threat, alongside algorithm choice rather than as an afterthought.

Google’s Secret ECC Circuits: Open, Reproduced, and Approaching a Floor

In March, Google Quantum AI showed that Shor’s algorithm could break 256-bit elliptic curve cryptography with roughly 1,175 logical qubits and about 2.6 million Toffoli gates, but hid the designs behind zero-knowledge proofs. Two months later, the secret was out. André Schrottenloher at Inria independently built circuits matching Google’s qubit counts and beating them on gates: 1,462 logical qubits and roughly 1.9 million Toffoli gates per point addition for secp256k1. Craig Gidney confirmed the match and conceded the ZKP approach had failed. Trail of Bits had already found bugs in the ZKP prover that allowed forging a proof claiming zero Toffoli gates.

The circuits for breaking ECC-256 are now fully open. The resource-estimate trajectory, from 20 million physical qubits in 2019 to under 500,000 physical qubits today, keeps compressing, and harvest-now-decrypt-later is already happening, which is precisely why the executive order names it as a present threat.

How far does this fall? A public scoreboard at ecdsa.fail tracks the logical-qubit cost as researchers shave it down, and I worked through where the floor sits. The logical-qubit count is approaching an arithmetic floor near 500, set by the irreducible width of the modular arithmetic. But a leaner logical circuit often raises the bar to building the machine, because squeezing the qubit count demands higher gate fidelity and deeper circuits, pushing physical-qubit and error-correction requirements up. The logical number shrinking toward 500 and the physical machine remaining enormously hard are both true at once. You don’t need a Q-Day prediction to justify acting. The threat is concrete, the circuits are open, and the deadline is set.

CNSA 2.0 in the New Picture

The executive order clarifies: National Security Systems stay under CNSA 2.0, not the new 2030/2031 schedule. CNSA 2.0 remains the most operationally specific mandate anywhere: ML-KEM-1024 and ML-DSA-87 only, SLH-DSA excluded, January 2027 procurement gate, hard deadlines running 2030 through 2035.

Bernstein’s findings create a direct tension here. CNSA 2.0 pushes pure ML-DSA into environments where the code has had the least time to mature and a key recovery does the most damage. The validation gap bites too: no FIPS 140-3 module with PQC support is validated yet, earliest realistic validation mid-2027, after the procurement gate. The order directs NIST to revise the CMVP within 180 days to accelerate validations. Whether that closes the gap in time is the open question.

Coming Soon: Quantum Ready

My book Quantum Ready ships in the next few weeks. It covers the full path from board mandate through discovery, hybrid deployment, vendor governance, and building crypto-agility as a permanent capability. The executive order just turned “we should plan for this” into a dated federal mandate, and the book is the structured way from one to the other. Sign up at quantumready.com to be notified at launch.

Quantum Flapdoodle: “Mathematically Proven Unbreakable,” and Other Fictions

The executive order mandates migration to NIST-standardized algorithms. Right on cue, four companies pitched me partnership deals for proprietary post-quantum cryptography in a single morning, most promising “mathematically proven unbreakable” encryption. No such thing exists. Every one was a proprietary algorithm with no NIST standardization and no national-agency review, and the history of proprietary cryptography is a graveyard of schemes their vendors swore were unbreakable until someone competent looked.

What the NIST process bought was years of public cryptanalysis, the only thing that earns confidence in a primitive, and the EO just made those algorithms a federal requirement. The one-afternoon test: is the algorithm NIST-standardized or nationally approved? Is the specification public? Has it survived independent peer review? Three no’s and you are looking at the same con every broken proprietary cipher started as.

While we’re auditing confident claims: I reverse-engineered five quantum salary guides from recruitment agencies, and none are based on actual salary data. The numbers follow a formula: general software benchmark plus a 15 to 30% “quantum premium,” rounded to the nearest $5,000. When I asked for datasets, none could produce them. Fabricated benchmarks set unrealistic expectations and reinforce the perception of quantum as a gold-rush field, a fitting close for an edition about the distance between a confident claim and an evidenced one.

If you found this edition useful, forward it to a colleague whose PQC program is still planning to 2035. They need to see the new dates. If I got something wrong, hit reply. I read everything and correct publicly. The full PostQuantum.com resource library is at postquantum.com, and the open-source migration framework is at pqcframework.com.

— Marin

Subscribe now

In this edition: On Friday evening, the US government ordered Anthropic to shut off its two most capable AI models for every customer worldwide, within hours, no warning. I explain why that is the cleanest argument yet for quantum sovereignty, and why buying a US machine outright does not escape the problem. A short detour into helium-3, the coolant a whole class of quantum computers can’t run without and the subject of much discussion in recent weeks, shows how deep the dependency reaches. I point to my two new build deep dives that take you from an empty lab to a working machine, the older sovereignty deep dive that mapped this terrain, and the QuantWare raise that shows the componentized supply chain forming in real time. My book Quantum Sovereignty ships in a few days, with Quantum Systems Integration as its engineering companion.

America Just Made the Case for Quantum Sovereignty

At 5:21 p.m. Eastern on Friday, June 12, Anthropic received a letter from the US Department of Commerce. By that evening, two of its most capable AI models were dark for every customer on the planet. Not throttled, not geofenced. Off. Anthropic did not choose to pull them; its own government ordered it to, through an export-control directive barring any foreign national, anywhere, from using the two models. Since no provider can separate foreign nationals from everyone else in real time, the only way to comply was to switch them off for the entire customer base, Americans included.

I set the AI-policy fight aside in my full analysis, because for the argument I care about it doesn’t matter whether the order was justified. For the past year, American quantum founders, investors, and officials have asked me a version of the same question: why are so many of your clients asking about independence from US quantum technology? It is the best in the world. What is the worry? I never had an example clean enough to make the answer land. On Friday evening, Washington provided one.

The shape of the action is what matters, and it holds whether the underlying call was sound or mistaken. Speed: the directive arrived at dinner and the models were gone the same night, no grace period to move workloads. Reach: it turned not on where you sit but on who you are, sweeping up a German pharmaceutical firm, a Brazilian bank, a Japanese manufacturer, whatever data center they use. Recourse: the vendor objected plainly, called it a misunderstanding, and complied within hours anyway, because a provider’s obligations to its own government sit above its contracts with its customers.

Here is why this lands harder for quantum than for AI. The same export-control machinery applies, and the dependency underneath is heavier. The industries that will need quantum compute most urgently, the narrow set where quantum delivers real advantage, pharmaceuticals, chemicals, batteries, advanced materials, are also the ones most central to national security. I called this the utility trap in my Quantum Utility Map. And buying the hardware outright does not escape it. A quantum computer bought today from a full-stack vendor is, in most respects, still that vendor’s machine: the processor was fabricated abroad, the control electronics and cryogenics came from abroad, and calibration and firmware updates are performed by the vendor’s own engineers under the service contract, which makes the firmware-update policy a form of remote control. The buyer had a quantum computer. It did not have control of one.

The full piece covers the two-ways-to-read-it framing, why Paris couldn’t stop talking about sovereignty at the Q-Day Summit last week, and what I tell the Americans in the room. Read it on PostQuantum.com. The short version: “trust us, we will not turn it off” stopped being a sufficient answer the moment the world watched the United States turn it off, on its own flagship company, over a finding the vendor calls minor.

For a year I have argued this case to American founders and officials without an example clean enough to land it, and I keep a careful distance from the quantum panic industry that inflates exactly this kind of fear. So let me be precise about the claim. I am not saying a quantum computer will break your encryption next year, or that every firm needs quantum access today, or that American technology is a trap. The claim is narrow: the dependency is coming for specific industries on a knowable path, and the mechanism for revoking it already exists and was just used in public. You only need to believe that some industries will come to need quantum compute, and that the supplier’s government can switch it off. Both halves of that sentence are now demonstrated.

A Note From Below the Qubit: The Helium-3 Question

Before Friday, the sovereignty conversation I kept having in recent weeks was about something far less abstract than export law: a gas. Helium-3 has been a live topic in quantum circles since Bluefors signed a $300 million contract to buy it mined from the Moon, and it is worth a short detour here because it shows how deep the dependency Friday exposed actually reaches, down to a single isotope that a large class of quantum computers cannot run without.

The physics is unforgiving. Superconducting and silicon spin qubits operate near 10 millikelvin, and only a dilution refrigerator gets them there, a process that depends on helium-3 specifically, since ordinary helium-4 cannot do the job. Helium-3 is barely present in nature; almost every gram is a decay product of tritium recovered from nuclear weapons stockpiles, which puts the supply in the hands of a few governments (the US, Canada, and Russia until 2022) and leaves global production running well short of demand. That is a sovereignty exposure two layers below the processor. The scarcity is real, which is the half of the story worth taking seriously. The other half, the projections that justify mining the Moon, rests on two errors I take apart in the full explainer: a dilution refrigerator recirculates its helium-3 in a sealed loop rather than burning it, so demand is a one-time charge per machine, not an annual rate, and only some modalities need it at all (trapped-ion, neutral-atom, and photonic systems largely don’t). The real pressure on helium-3 comes not from the Moon but from magnetic cooling, which is advancing fast. The reason it belongs in this edition: when even the coolant in your fridge traces back to a handful of national nuclear programs, architectural control means accounting for layers most buyers never think to ask about.

From an Empty Lab to a Working Machine

If Friday made the case for architectural control, the question becomes how you actually achieve it. That is the subject of the two build deep dives I recently published on PostQuantum.com.

How to Build a Quantum Computer walks the full journey from empty lab to first qubit signal across every major modality, with companion articles on the parts that determine whether you control the machine or merely host it: cryogenic infrastructure and the He-3 supply, control systems, the quantum OS and orchestration layer, HPC integration, and supply chain concentration risk. The companion piece, What It Takes to Build a Quantum Computer, covers the strategic and economic side: what each layer costs, where the chokepoints sit, and what the build-versus-buy decision actually involves.

Read together, they make a sovereignty argument by construction. A nation does not need to fabricate every layer itself; what it needs is architectural freedom. The stack can be sourced in layers, a QPU from one supplier, cryogenics from another, control electronics from a third, then integrated in-house or by a neutral systems integrator. This is the same shift from sealed mainframe to open, modular machine that handed sovereignty from the producer to the user in classical computing, and I laid out the case for it in my older Quantum Sovereignty and Self-Reliance deep dive.

The Componentized Supply Chain Is Already Forming

The good news for any sovereignty-minded buyer is that the modular alternative is not theoretical. It is being built right now, and the clearest signal is where the money is going.

QuantWare, a Dutch QPU manufacturer, closed a $178 million Series B backed by Intel Capital and In-Q-Tel. Its entire business model is selling quantum processors as off-the-shelf products to customers who integrate them into their own systems with their own cryostats and control electronics. That is the open-architecture model in commercial form, and as I argued back in edition #8, the $14 billion now flowing into quantum is building a QPU component supply chain rather than monolithic machines. A buyer who wants architectural control no longer has to build every layer from a national-lab cleanroom. The components are becoming products, the integrators are emerging, and the multi-vendor machine is becoming a procurement option rather than a research project. Friday is the argument for choosing it.

Two Books, Out This Week

I’ve spent a long stretch of my working life on this dynamic, how critical industries come to depend on concentrated quantum supply chains and what it costs to climb back out. It is the subject of my book Quantum Sovereignty, out in a few days. I did not expect the cleanest illustration of the thesis to arrive from Washington the week before it published.

Its engineering companion is Quantum Systems Integration, the practical guide to the open-architecture alternative this edition describes: how to source each layer of the quantum stack, how to manage the multi-vendor integration, and what it costs at three different tiers. If Quantum Sovereignty makes the case for why architectural control matters, Quantum Systems Integration is how you build it. Sign up at both sites to be notified at launch.

A disclosure: my company, Applied Quantum, is a quantum systems integrator. We assemble quantum computers from modular components for clients who want architectural control, and most come to us because of sovereignty concerns. On Saturday morning, less than eighteen hours after the directive, a prospective client called to ask for a proposal. Friday did not create the demand. It removed the last hesitation. I have a commercial interest in this argument and I am being direct about it, because the analysis should be evaluated on its evidence, not on whether the person making it also builds the alternative.

The next time someone asks me why the rest of the world wants its own quantum stack, I won’t reach for a hypothetical about a distant Q-Day. I’ll point to a Friday evening in June, a letter that took effect by dinner, and two of the most advanced AI models on the planet going dark for everyone at once because a government decided they should. The quantum version of that letter has not been written yet. The countries and companies building their own machines are making sure that, when it is, they are not the ones waiting by the inbox.

If you found this edition useful, forward it to someone weighing a quantum procurement decision. If I got something wrong, hit reply. I read everything and correct publicly.

— Marin

Subscribe now

In this edition: On June 9 I spoke at the inaugural Q-Day Summit in Paris and gave a field report from inside the PQC migration programs I've been leading for governments and large enterprises. One of them grew past 120,000 tasks. This edition is the extended version for the people who weren't in the room: why discovery never finishes and no tool sees everything, how to get budget when nobody knows the cost, why the SHA-1 analogy misleads, and why your vendors' roadmaps are your critical path. Alongside it, I'm announcing the biggest update to the PQC Migration Framework since its release: v2.0 and v2.1 ship together, with the Universal Framework and all six sector extensions now on a single aligned baseline, plus the first SOC and GRC implementation guidance any PQC framework has specified. I also cover what your SOC and GRC functions actually need to do about quantum, Let's Encrypt's commitment to Merkle Tree Certificates, the FIPS validation gap that constrains every regulated deployment, and a Flapdoodle on the five vendors who pitched me "mathematically proven unbreakable" cryptography before I finished my coffee. My book Quantum Ready ships in the next few days.

What No One Tells You Until You’re Already in It

On June 9, I spoke at the inaugural Q-Day Summit in Paris, in a room of CISOs, government officials, defense leaders, and cryptographers. Most of the program covered standards, QKD, and sovereignty. My session covered different ground: a field report from inside the PQC migration programs I’ve been leading for governments and large enterprises. One of those programs grew past 120,000 tasks in its integrated master schedule. It was not the only one.

The response in the room confirmed what I already knew. The gap between PQC advice and PQC execution is enormous, and most organizations preparing to start have no idea what they’re walking into. I wrote up the full field report on PostQuantum.com. Here are the points that landed hardest.

The scale is unlike anything most security teams have attempted. Of those 120,000 tasks, fewer than 30,000 were direct cryptographic remediation. The rest, 60 to 85% of the effort, was the enablement system: discovery, governance, vendor management, training, testing infrastructure, and audit evidence. People reach for the SHA-1 to SHA-2 transition as the analogy, but that was a hash swap inside one mathematical family using the same libraries. PQC changes the mathematics, the key sizes (sometimes by 50x), the signature sizes, and the performance of every protocol touching asymmetric cryptography, multiplied across every server, device, OT controller, and container you run.

Discovery never finishes, and no single tool sees everything. Network scanning misses embedded crypto, agent-based discovery is blind to OT and IoT, and external scanning sees less than 10% of your real cryptographic surface. The inventory drifts the moment you build it. The programs I lead run discovery and migration in parallel and treat the cryptographic inventory like vulnerability management: continuous and fed into the SOC. The ones that try to finish discovery first are still building spreadsheets when the deadlines arrive.

On budget, the argument that works has nothing to do with quantum computers. Discovery finds the broken cryptography you already have: SHA-1 in production, weak TLS, expired certificates, 1024-bit RSA. It pays for itself in immediate risk reduction, and the inventory it produces is compliance evidence that NIS2, DORA, and CNSA 2.0 all require. On governance, the lesson is blunt: programs with shared ownership produce PowerPoints, programs with one accountable executive produce results. And your vendors’ roadmaps are your real critical path. IBM’s readiness survey found 62% of organizations expect vendors to handle PQC migration. Ask your top 20 whether they have it on a shipped roadmap with dates; fewer than a quarter will.

The point I most wanted the room to take home: PQC breaks real infrastructure. It works on a vendor’s bench and then fails in production, where ML-KEM-768 key shares run 38x larger than X25519 and ML-DSA-65 signatures run 51x larger than ECDSA. Firewalls drop oversized ClientHello messages, middleboxes break on larger extension fields, and OT devices on 8- or 16-bit microcontrollers simply cannot run the algorithms. When those devices control power grids or hospital equipment, a failed migration carries physical consequences. You cannot spreadsheet your way through this, and most organizations will discover it for the first time in the next two to three years. I would rather they hear it now.

PQC Migration Framework v2.1 Released — Now With SOC, GRC, and All Six Sector Extensions

Everything I covered in Paris, and considerably more, is in the Applied Quantum PQC Migration Framework, which is open-source and free under CC BY 4.0. I just completed its biggest update since release, shipping v2.0 and then v2.1 within the same month. For the first time, the Universal Framework and all six sector extensions sit on a single aligned baseline.

Three structural changes drove the major version. Migration sequencing is now explicitly two-track: Track A (key exchange, driven by HNDL) can deploy hybrid today, while Track B (signatures and PKI, driven by TNFL) depends on PKI architecture decisions and FIPS validation that remain unresolved. Treating them as one sequence causes organizations to under-invest in whichever track isn’t their starting point. The PKI model has forked, with Merkle Tree Certificates for public Web PKI and X.509-with-PQC for internal enterprise PKI. And a four-tier deployment environment classification (unrestricted, FIPS-aware, FIPS-required, CNSA 2.0) determines when each system can actually enter production.

v2.1 then takes positions inside those structures. It adds explicit guidance on hybrid and composite signatures, algorithm-specific vulnerability weighting in risk scoring (ECC is not a safe harbor: estates heavy in elliptic curve cryptography score differently than RSA-era assumptions suggest), a full SOC and GRC implementation specification, and a program closure methodology covering migration verification and the evidence dossier. A migration you cannot prove is a claim, not a control. The sector extensions for government and defense, critical infrastructure, telecommunications, financial services, payments, and digital assets each gained sector-specific positions. I also updated the Getting Started with Quantum Security guide and the Quantum Security Reference.

The Part No One Specifies: What Your SOC and GRC Actually Do About Quantum

Most CISOs I talk to ask “what should my SOC be doing about quantum?” and get vague answers. No published PQC migration framework specified SOC detection capabilities or quantum-specific incident response before this year, which is exactly why v2.1 adds them. So let me be specific, because this is the operational gap that turns a migration into a liability.

Your SOC needs cryptographic detection capabilities that don’t exist in any standard playbook today. Hybrid downgrade detection: alert when a connection that should be hybrid negotiates classical-only, which is the PQC equivalent of SSL stripping. Cryptographic drift monitoring: flag systems that revert to classical crypto through configuration changes or vendor updates. And it needs four incident response playbooks that no SOC currently has: PQC algorithm vulnerability disclosure, confirmed hybrid downgrade attack, credible CRQC capability announcement, and emergency algorithm rotation. All of this must be operational before your first production PQC deployment. Deploying PQC without the ability to detect attacks against it is flying blind. I detailed the five detection use cases and the three-horizon threat intelligence model separately, because the SOC’s role in this transition has gone almost entirely unexamined.

On the GRC side, your board will ask for quantum readiness metrics your team cannot yet produce. The instrument that works is a three-tier KRI structure: board-level quarterly risk posture, CISO-level monthly migration progress, and operational real-time drift detection. You also need a quantum risk appetite statement with explicit tolerances for HNDL exposure, TNFL exposure, and regulatory compliance buffer, the same discipline you apply to any other material risk. Build audit evidence from day one: retrofitting two years of undocumented decisions into an audit trail takes ten times the work and produces ten times less credible documentation.

Let’s Encrypt Commits to Merkle Tree Certificates

Let’s Encrypt, the nonprofit CA that secures over 700 million websites and issues 54% of all public TLS certificates, committed to Merkle Tree Certificates as its path to post-quantum web authentication. Staging in late 2026, production in 2027.

This is the commitment that makes MTCs viable for the majority of the encrypted web. The reason the architecture exists is the PQC signature size problem from the field report above: ML-DSA-65 signatures run about 3,300 bytes against 64 for ECDSA, and a PQC X.509 certificate chain can exceed 10KB of handshake overhead. MTCs batch certificates into a Merkle tree and amortize a single post-quantum signature across thousands of them, dropping authentication overhead to as little as 736 bytes. Post-quantum HTTPS could end up smaller than today’s classical chains.

The practical guidance: public-facing web PKI is heading toward MTCs, while internal enterprise PKI stays on X.509 with PQC algorithms. Invest in certificate lifecycle automation now. You need it for the CA/Browser Forum’s 47-day certificate lifetimes by March 2029 regardless of PQC, and it’s the same infrastructure that makes MTC adoption manageable.

The FIPS Gap That Constrains Every Regulated Deployment

Here’s a constraint that almost no PQC coverage mentions and that determines the deployment timeline for every regulated organization: as of June 2026, no cryptographic module has achieved FIPS 140-3 validation with PQC algorithm support. Multiple vendors are in the CMVP queue, but the process averages 18+ months. The earliest realistic validated PQC software modules arrive mid-2027. HSM modules will lag further.

This collides with CNSA 2.0‘s January 2027 procurement gate. National security systems must support quantum-resistant algorithms in new acquisitions from that date, using modules that won’t be validated until after it passes. Meanwhile FIPS 140-2 certificates move to the Historical list on September 21, 2026, forcing a parallel transition to FIPS 140-3 even before PQC validation exists. For unrestricted environments, none of this applies and you can deploy hybrid TLS today. For FIPS-required environments, plan pilots and staging now and target production after validation. The gap is the binding constraint, not your technical readiness, which is exactly why the framework’s deployment environment classification exists.

Coming Soon: Quantum Ready

My book Quantum Ready ships in the next few days, and it’s the book-length companion to everything above. Where the framework gives you the 8-phase methodology, the book gives you the reasoning behind each phase, extended case examples, and guidance for leading the program from the first board conversation through closure: executive mandate, budget strategy, discovery, CBOM architecture, hybrid deployment, vendor governance, testing, and building crypto-agility as a permanent capability rather than a one-time project. If the field report in this edition described problems you recognize, the book is the structured way through them. Sign up at quantumready.com to be notified at launch.

Quantum Flapdoodle: “Mathematically Proven Unbreakable Cryptography”

Five PQC companies pitched me partnership deals in a single morning recently. Four of the five promised some version of the same thing: mathematically proven unbreakable cryptography. I’ve spent three decades around cryptography and the phrase still stops me, because no such thing exists.

Every one of these pitches was for a proprietary algorithm with no NIST standardization and no national-agency approval. The history here is a graveyard. Proprietary cryptography that vendors swore was unbreakable has been broken, repeatedly, often within months of someone competent looking at it. The whole point of the NIST process was to subject candidate algorithms to years of public cryptanalysis by the global research community, which is the only thing that earns confidence in a cryptographic primitive. A vendor’s private assurance is worth nothing against that standard.

There’s a one-afternoon verification test. Ask the vendor: is your algorithm NIST-standardized or approved by a national cryptographic authority? Is the specification public? Has it survived independent peer review? If the answers are no, no, and no, you’re looking at the same con that produced every broken proprietary cipher in the historical record, just wearing post-quantum vocabulary. The connection to my field report above is direct: the “comprehensive quantum vulnerability assessment” built on external scanning alone and the “mathematically proven unbreakable” algorithm are the same thing, confidence that hasn’t been earned.

If you found this edition useful, forward it to a colleague who’s about to start a PQC program and doesn’t yet know what they’re walking into. If I got something wrong, hit reply. I read everything and correct publicly. The full PostQuantum.com resource library is at postquantum.com, and the open-source migration framework is at pqcframework.com.

— Marin

Subscribe now

In this edition: Over $14 billion in quantum manufacturing commitments landed in the past few weeks. IBM pledged $10 billion and launched America's first quantum chip foundry. The U.S. government took equity stakes in nine quantum companies through $2 billion in CHIPS Act incentives that fund fabs, not research. France added €1.55 billion for quantum and semiconductor manufacturing one day later. QuantWare, a Dutch QPU manufacturer, closed a $178 million Series B. I trace the pattern: this money is building a quantum component industry, not monolithic machines, and the critical gap it reveals is systems integration. OQC closed Europe's largest private quantum round at £260 million, betting on a vertically integrated model that runs against this grain. Microsoft unveiled Majorana 2, claiming 20-second qubit lifetimes on a fabrication path no one else can use. D-Wave published a gate-model roadmap. I also launch the Quantum Snake Oil Dictionary and announce a new Deep Dive series on how quantum computers are actually built, alongside my forthcoming book Quantum Systems Integration.

The Quantum Factory Buildout: $14 Billion and Counting

The headlines read like a funding arms race: IBM commits $10 billion. Washington distributes $2 billion in CHIPS Act incentives.France adds €1 billion for quantum plus €550 million for semiconductor industrialization (€1.55 billion announced in a single speech), bringing its total quantum commitment to €3.3 billion, with NVIDIA backing Alice & Bob's cat qubit program the same day. QuantWare closes a $178 million Series B backed by Intel Capital and In-Q-Tel. The press release version of this story is about big numbers and national ambition. Look at what the money is actually buying and a different picture emerges.

It is buying factories. Not research grants, not algorithm development, not application pilots. Factories.

IBM’s Anderon is a 300mm quantum wafer foundry in Albany, New York. GlobalFoundries received $375 million to build cryo-CMOS, advanced packaging, and superconducting interconnect manufacturing capabilities. France’s latest tranche is explicitly manufacturing-focused. QuantWare’s entire business model is selling QPU chips as standalone products to customers who integrate them into their own systems.

QPUs, Not Monoliths

Here’s the pattern most coverage misses: none of this money is building complete quantum computers. It is building quantum processing units and the supply chain components around them. QPU wafers. Cryo-CMOS control chips. Interconnects. Packaging. Dilution refrigerators. The industry is componentizing.

This is the classical semiconductor model playing out in quantum. Anderon wants to be the TSMC of quantum: fabricate chips for anyone, not just IBM. QuantWare already operates this way; its Contralto-series processors ship as off-the-shelf QPUs that customers mount in their own cryostats with their own control electronics. The Denver consortium I profiled assembled a working quantum computer from five different vendors’ components in five months, for under $8 million: a Dutch QPU, Dutch control electronics, an American cryostat, Australian calibration software, and a global supply chain partner.

When QPUs become products rather than one-off laboratory artifacts, the bottleneck shifts. Manufacturing is being solved. What is not solved is the integration layer: who takes a QPU from QuantWare, a cryostat from Bluefors, control electronics from Qblox, calibration software from Q-CTRL, and HPC interconnects from NVIDIA, and turns them into a working quantum computer? This is the quantum systems integration problem, and it is the least-funded, least-discussed, and most consequential gap in the quantum stack.

Parsing IBM’s $10 Billion

IBM’s headline number deserves evidence-based scrutiny. The $10 billion is a five-year commitment spanning R&D, capex, manufacturing, ecosystem partnerships, and M&A, capturing spending IBM would have made regardless. For comparison, IBM’s total R&D spending was approximately $7.4 billion in 2025 across all business lines. And $2 billion of the headline is Anderon (including the $1 billion CHIPS Act incentive). Still a very large number. But it lands differently than a $10 billion research investment.

The Anderon foundry itself is the most concrete piece. The shift from 200mm to 300mm wafer processing produces device output 30 times faster, according to IBM Research Director Jay Gambetta. For superconducting quantum companies running small-batch fabrication in university cleanrooms, access to dedicated 300mm production could compress development timelines by years. But the TSMC analogy has limits: Google fabricates its own chips, Quantinuum and IonQ use trapped ions, Microsoft sits on a different fabrication path entirely. Anderon’s near-term customer base is a handful of other superconducting companies, who’ll need to weigh production access against sharing process knowledge with their largest competitor.

Government as Quantum Shareholder

Washington’s $2 billion CHIPS quantum package represents a portfolio bet across modalities: superconducting (IBM, Rigetti), trapped ion (Quantinuum, Infleqtion), neutral atom (Atom Computing), photonic (PsiQuantum), annealing plus gate-model (D-Wave), and silicon spin (Diraq). In exchange, the government takes minority, non-controlling equity stakes in all nine companies. As I noted in my sovereignty analysis, when a government starts building purpose-built quantum fabrication facilities, it is no longer asking whether the technology works. It is preparing to produce it at scale.

Wall Street’s reaction was telling. D-Wave, Rigetti, and Infleqtion each surged over 30% on CHIPS Act day, collectively adding nearly $5 billion in market capitalization on $300 million in proposed awards. D-Wave reported $2.9 million in Q1 2026 revenue.

What Starling Means for the CRQC Path

IBM Quantum Starling targets 200 logical qubits executing 100 million gates by 2029, using qLDPC codes that IBM claims reduce physical qubit overhead by up to 90% compared to surface codes. If delivered, Starling would validate several CRQC Capability Framework dimensions simultaneously: QEC at scale, below-threshold operation, magic state production across modules, and real-time decoding. None of those has been demonstrated at the scale IBM is targeting. Two hundred logical qubits remains far from the amount required for cryptographic attacks on RSA-2048 or ECC-256. But the manufacturing infrastructure now being built is what would produce the hardware if and when the engineering milestones are met. The money arrives before the capability.

OQC’s £260 Million Bet Against the Grain

Oxford Quantum Circuits just closed £260 million ($350 million) in Series C funding, Europe’s largest private quantum round. The British Business Bank committed £100 million; J.P. Morgan acted as placement agent. Total funding now stands at roughly $490 million.

The money is for TITAN, OQC’s planned 2028 system: 200 logical qubits within 2,000 physical lattice sites on a single 100mm wafer, running at 1 MHz clock speed with a target logical error rate of 10⁻⁶. Between TITAN and OQC’s current 32-qubit Toshiko system sits GENESIS, a 16-logical-qubit stepping stone using dual-rail Dimon qubits.

Here’s what makes OQC worth watching in the context of this edition’s manufacturing theme: OQC is doing the opposite of what everyone else is doing. While IBM builds an open foundry, QuantWare sells QPUs as standalone products, and the Denver consortium assembles machines from five vendors’ components, OQC is pursuing a monolithic, vertically integrated architecture. One company, one chip, one wafer, one system.

The bull case: vertical integration lets OQC optimize across the full stack, avoid interface losses between separately manufactured components, and potentially deliver a more coherent system. The bear case: OQC is fabless (its Coaxmon QPUs are manufactured by external partners), which means it gets the supply chain dependency of a component buyer without the flexibility of the open architecture approach. The TITAN roadmap asks investors to believe OQC can go from 32 physical qubits to 200 logical qubits in two years, a jump that would require error correction breakthroughs no one in the industry has demonstrated at scale. IBM is targeting the same 200 logical qubits but gives itself until 2029, has $10 billion behind the effort, and owns its own foundry.

OQC’s investor mix also catches the eye. The round was led by a TMT investment bank, not a deep-tech VC or semiconductor-industry strategic. No Breakthrough Energy, no Intel Capital, no DARPA validation. The British Business Bank’s £100 million carries a sovereign industrial policy signal, but it is government money backing a UK national champion, which is a different kind of due diligence than commercial investors applying.

I will be tracking OQC’s GENESIS milestones closely. If dual-rail Dimon qubits deliver the error rates OQC claims, the TITAN timeline becomes more credible. If GENESIS slips, £260 million starts to look like a very expensive bet on a roadmap that hasn’t earned its next milestone.

Microsoft Majorana 2: 20-Second Qubits, Same Questions

At its Build conference, Microsoft unveiled Majorana 2, its second-generation topological quantum chip. Z-parity lifetimes exceeding 20 seconds, a 1,000x improvement over Majorana 1, achieved by swapping aluminum for lead as the superconducting material. Microsoft accelerated its timeline from 2033 to 2029.

The materials engineering is genuine. Several prominent physicists responded within hours, and their objections are: the Majorana zero mode has never been unambiguously demonstrated. Microsoft’s 2018 Nature paper claiming Majorana signatures was retracted in 2021 after data-processing errors. Majorana 2 reports parity lifetimes and topological gap measurements consistent with a topological qubit, but also potentially consistent with trivially gapped Andreev bound states. What the paper does not show: a logical qubit operation, a two-qubit gate, entanglement between topological qubits, or error correction using topological protection.

For the CRQC timeline: nothing changes. Microsoft’s topological approach still scores at the earliest stages of the CRQC Capability Framework. I will update the CRQC Scorecard when the peer-reviewed paper is available.

What makes Majorana 2 worth pairing with this edition’s manufacturing story: topological qubits require InAs/Pb heterostructures on GaSb substrates, entirely different materials and processes from superconducting transmon qubits. Microsoft cannot use Anderon. It cannot use QuantWare’s QPUs. Its supply chain is entirely bespoke. The $14 billion flowing into superconducting and multi-modality fabs is a bet on the established path. Microsoft’s bet is on its own. If topological qubits work, that isolation could become a moat. If they don’t, Microsoft will have built a manufacturing pipeline for a product category that doesn’t exist.

D-Wave Joins the Gate-Model Race

D-Wave, the company that spent two decades on quantum annealing, published a gate-model roadmap targeting 100 logical qubits by 2032, built on dual-rail superconducting qubits acquired through its $550 million purchase of QCI. D-Wave claims Lambda = 10 for error suppression; independent verification is needed. When the one company that had a principled alternative to gate-model computing decides it needs gate-model capabilities, that tells you where the industry consensus has settled. CRQC implications: none.

The Builder’s Guide: A New Deep Dive and a New Book

Every announcement above raises the same question: what does it actually take to build a quantum computer? Not a press release. Not a roadmap. A physical machine, assembled from real components, that produces useful qubit operations.

I published the most engineering-heavy Deep Dive series on PostQuantum.com to date: from empty lab to first qubit signal across every major modality (superconducting, trapped ion, neutral atom, photonic, silicon spin), plus companion articles on cryogenic infrastructure, control systems, supply chain concentration, and cost and procurement. When IBM launches a foundry, this series explains what it fabricates. When QuantWare ships a QPU, it explains what else you need to make it compute.

My book Quantum Systems Integration is coming in the coming days. It covers the full integration framework from site survey through HPC integration, and makes the case that quantum computing is following the classical computing model: components from specialist manufacturers, assembled by integrators. Applied Quantum is doing this work, helping governments and enterprises assemble quantum computers from best-of-breed components rather than depending on a single vendor’s stack. Sign up at quantumsystemsintegration.com to be notified when the book is available. Get in touch if you need help with quantum compute strategy.

Quantum Flapdoodle: The Snake Oil Dictionary Is Live

In an edition about where quantum money actually goes, a new tool for spotting claims where the money should not.

I launched the Quantum Snake Oil Dictionary on PostQuantum.com: a term-by-term field guide to misleading quantum marketing. Nine fabricated red-flag terms. Seven legitimate physics concepts routinely stripped of their qualifying assumptions by vendors. And a companion guide to the 16 deflection tactics questionable vendors deploy when you ask hard questions.

Two entries worth highlighting. “Quantum Financial System“ is an ADL-classified conspiracy theory exploiting quantum vocabulary to defraud retail investors through advance-fee fraud. “Unhackable quantum encryption“ repackages legitimate QKD science into marketing claims that misrepresent what the technology provides. QKD secures a key exchange channel under specific physical conditions; it does not make your network unhackable.

If you found this edition useful, forward it to a colleague who’s evaluating quantum investments, vendor claims, or national quantum strategies. If I got something wrong, hit reply. I read everything and correct publicly. The full PostQuantum.com resource library is at postquantum.com. Start with the How to Build a Quantum Computer Deep Dive.

— Marin

Subscribe now

A quick note: you may have noticed a new name. The Quantum Observer is now Quantum Unfiltered. The change is partly practical — a new quantum media property is launching at quantumobserver.com in the coming days, and I wanted a clean separation — but it is also editorial. The new name better reflects what this newsletter actually does: unfiltered analysis, no vendor cheerleading, no doomsaying. Now, back to work.

In this edition: I spent quite a few weeks mapping every peer-reviewed fault-tolerant quantum algorithm to its real-world application, hardware requirements, and timeline. The result, my seven-part Quantum Utility Map Deep Dive, reveals a utility ladder where some industries reach quantum advantage at hardware levels that are almost here, while others need machines further down the roadmap. Crucially, the cryptographic threshold sits near the bottom of that ladder, not the top. This edition unpacks that thesis and examines why a cluster of recent results from Q-CTRL, IBM, QuEra, IonQ, and others is validating exactly the pattern the research predicted. Plus: Cisco builds quantum networking infrastructure, the error correction revolution keeps compressing timelines, and a Bitcoin conference presents pseudoscience claiming quantum computers are ontologically impossible. That last one earns this edition's Quantum Flapdoodle.

The Quantum Utility Ladder — and Where Your Industry Sits on It

I published one of the most ambitious project I’ve attempted on PostQuantum.com: The Quantum Utility Map, a seven-part Deep Dive mapping every major fault-tolerant quantum algorithm resource estimate to the real-world problem it solves. Hundreds of papers, weeks of research, over 20,000 words across seven articles. The picture that emerges is more nuanced than either the optimists or the pessimists want to hear.

The utility picture is a ladder, not a switch. Some industries will reach clear quantum advantage at hardware levels that are close. Others will need to wait a few years longer for the return on investment to materialize. A common assumption, that you can wait for fault-tolerant quantum computers to start reshaping industries before worrying about the cryptographic threat, turns out to be exactly backwards.

At the lower rungs, condensed-matter physics and quantum chemistry reach utility first. Useful simulations of photosensitizer molecules (relevant to cancer therapy) become tractable at around 180 logical qubits. Battery material simulation works at fewer than 500. The hardware for these applications is coming in the next few years, and the Fermi-Hubbard model (the workhorse of condensed matter physics) is already being demonstrated at meaningful scale on today’s noisy hardware. More on that below.

In the middle, the grand challenge chemistry problems occupy the 1,000–5,000 logical qubit range. FeMoco (nitrogen fixation), cytochrome P450 (drug metabolism), ruthenium catalysts (CO₂ conversion). These are the applications that will reshape pharmaceutical R&D, chemicals, and advanced materials — but they need larger, more mature fault-tolerant machines that are further out on the roadmap.

For finance, logistics, and machine learning, the picture is different (but “different” does not mean “disengage.”) The proposed quantum speedups in these sectors are typically quadratic, which means error correction overhead eats the advantage when competing against highly optimized, massively parallelizable classical systems. The math does not close today, and closing it will take larger machines, better algorithms, or both, which puts these sectors a few rungs higher on the ladder. Algorithmic discovery is unpredictable; a genuine breakthrough in quantum optimization would rewrite the analysis. These sectors should continue developing their capabilities, maintain a monitoring capability and track the signals that would change the assessment, rather than either betting the strategy on quantum or walking away.

Here is the finding that should reframe the conversation for many CISOs: the CRQC threshold, the point at which a quantum computer can break today’s public-key cryptography, sits near the bottom of the utility ladder. Breaking RSA-2048 requires roughly 1,399 logical qubits. Breaking 256-bit elliptic curve cryptography requires roughly 1,200. Most of the grand challenge chemistry applications require more. The CRQC arrives before the transformative science, not after. If you are waiting to see quantum computers deliver industrial value before starting your PQC migration, the science tells you that by the time they do, your encryption will already be vulnerable.

The Evidence Is Arriving

Within days of publishing the initial version of the Utility Map, three results landed that read like a controlled experiment validating the thesis. (And then I updated my Utility Map)

Q-CTRL’s Fermi-Hubbard simulation is the strongest. Two minutes and forty-six seconds of QPU time on IBM’s 156-qubit Heron processor to simulate 60 interacting electrons across a one-dimensional chain, using 120 qubits and over 9,000 two-qubit gates. The best classical alternative (ITensor’s TDVP solver) needed over 100 hours. A 3,000-fold wall-clock speedup.

This is the largest and most accurate gate-based digital simulation of the Fermi-Hubbard model reported to date, and Q-CTRL’s compilation pipeline is the unsung enabler. By reducing circuit depth by over 80% and gate count by over 60%, they ran the widest simulation at 9,057 two-qubit gates across 152 layers. Separately, the study's deepest circuits used 62 qubits with 13,829 two-qubit gates across 452 layers. Whether you call it “quantum advantage” depends on where you draw the definitional line: Q-CTRL compared against the best available tool, not the best tool that could theoretically exist. That debate will play out in the literature. What matters for the Utility Map is the application: Fermi-Hubbard is one of the strongest near-term candidates for useful quantum computation that my research identified. Q-CTRL just demonstrated it at scale on commercial hardware.

On the chemistry side, Cleveland Clinic, RIKEN, and IBM simulated the electronic structure of a 12,635-atom protein-ligand complex, a 40-fold increase in system size over a simulation performed just four months earlier. Two Heron r2 processors, up to 94 qubits, 9,200 circuits, 1.3 billion measurement outcomes. This doesn’t yet outperform classical methods for protein chemistry. But the trajectory (303 atoms to 12,635 atoms in four months, with a 210-fold accuracy improvement on a key step) tracks the kind of exponential scaling that precedes competitive advantage. The quantum processor handles the electron correlation clusters, which is exactly the quantum-hard part of the problem that the Utility Ladder identifies as the natural domain for quantum advantage.

IBM’s CEO put a timeline on it. Arvind Krishna told investors in early May that partners will demonstrate the first examples of quantum advantage this year. This is one of IBM's clearest public timelines yet for quantum advantage, and the Q-CTRL and Cleveland Clinic results explain why they are willing to make it. The quantum-centric supercomputing pipeline, pairing Heron QPUs with Fugaku, is delivering real results on real problems.

Notice the pattern. Every result that holds up to scrutiny is a physics or chemistry simulation. None is a finance optimization or a logistics routing problem. The utility ladder thesis is playing out in real time.

Why the Timelines Are Compressing

The other major finding from the Utility Map is that error correction is advancing faster than hardware. Three advances in particular are compressing the physical-to-logical qubit ratio by an order of magnitude or more: qLDPC codes, magic state cultivation, and algorithmic fault tolerance. Recent results push this even further.

QuEra, Harvard, and MIT published a preprint demonstrating in circuit-level noise simulations that ultra-high-rate qLDPC codes can achieve a 2:1 physical-to-logical qubit ratio. The standard surface code requires roughly 1,000 physical qubits per logical qubit. A 2:1 ratio enters territory where the overhead almost vanishes. QuEra’s neutral-atom architecture has the native long-range connectivity that qLDPC codes demand, which makes this more than a theoretical exercise. If realized on hardware, applications I estimated would need tens of thousands of physical qubits might need a fraction of that.

IonQ is pursuing the same opportunity from a different modality. Their 110-page “Walking Cat” fault-tolerant blueprint claims 110 logical qubits from 2,514 physical qubits using qLDPC codes on trapped ions. Trapped ions have native all-to-all connectivity within a trap zone, which is exactly what qLDPC’s non-local stabilizer checks require. Combined with IonQ’s recent photonic interconnect demonstration linking two systems via entangled photons, the building blocks for modular fault-tolerant computing are being assembled in parallel.

Meanwhile, Harvard’s cascade neural decoder achieves 10⁻¹⁰ logical error rates on qLDPC codes, addressing one of the practical barriers to their adoption: decoding fast enough for real-time correction.

Every order-of-magnitude improvement in encoding efficiency pulls the entire utility ladder closer. The first rung, useful quantum chemistry at ~180 logical qubits, could arrive much earlier than current roadmaps suggest. And since the CRQC threshold sits near the bottom of that same ladder, the security implication is clear: the preparation window for PQC migration is shorter than most organizations assume.

Cisco Builds the Quantum Plumbing

One item that doesn’t fit neatly into the advantage or error correction narratives but matters for the long game: Cisco introduced a universal quantum switch that routes qubits across different modalities at room temperature over standard telecom fiber, with roughly 4% fidelity loss.

When the largest networking company on the planet builds a working prototype for quantum routing, it signals where the infrastructure investment is headed. Scaling to the logical qubit counts needed for industrial chemistry and the CRQC threshold will likely require modular, networked architectures. Cisco just built a piece of that puzzle.

Quantum Flapdoodle: When a Bitcoin Conference Tries to Abolish Quantum Mechanics

At Bitcoin 2026 in Las Vegas, the world’s largest Bitcoin conference gave its main stage to Jeff Booth, a venture capitalist with no background in physics, to present a thesis drawn from a roughly 220-page unreferenced paper. The argument: Bitcoin’s 10-minute block interval constitutes empirical proof that time itself is discrete rather than continuous. Because quantum mechanics assumes continuous time, quantum mechanics must be wrong. Therefore quantum computers cannot threaten Bitcoin. The presentation was delivered with absolute confidence to an audience of roughly 30,000.

Let that sink in. A payment network’s engineering parameter, is being presented as a discovery about the fundamental nature of reality that falsifies a century of physics. I read the paper. Bitcoin's own internals contradict the premise. Block discovery is modeled as a stochastic Poisson process with exponentially distributed waiting times, not as a deterministic ten-minute tick. Block timestamps are integer Unix-epoch fields constrained by consensus rules, not evidence for a fundamental chronon. The difficulty adjustment recalculates every 2,016 blocks to keep average production near ten minutes. None of this says anything about the ontology of time. Bitcoin runs on the very continuous-time mathematics the paper claims to have disproven. The paper contains no bibliography and no peer review. Its treatment of Shor’s algorithm amounts to arguing that if Shor’s worked, you could “run it on Bitcoin” by creating contradictory transactions in the mempool, confusing ECDSA private key recovery with the consensus mechanism.

It gets better. A follow-up “Declaration of Chronology” renames quantum mechanics to “Block-Wave Dynamics,” declares Bitcoin “the only logical and principled quantum computer,” and issues a “Call to the Miners” arguing that if global hash rate approaches 10⁴³ per second, Bitcoin would be “probing the substrate of time itself.”

This would be merely entertaining if the stakes were lower. Some fraction of those 30,000 attendees left believing the quantum threat is a philosophical error. That fraction represents real money in addresses with exposed public keys and real organizations delaying migration decisions. For the full analysis, see The Anatomy of Quantum Denial on PostQuantum.com.

From the Applied Quantum Desk

The Quantum Utility Map series represents the kind of research-driven analysis Applied Quantum brings to its advisory work. If you are evaluating which quantum use cases matter for your sector, building a readiness strategy, or navigating the PQC migration timeline, my team and I can help. We provide board briefings, quantum readiness assessments, vendor due diligence, and hands-on migration support.

If this was useful, forward it to a colleague who should be paying attention to quantum. If you spotted an error, hit reply — I read everything and correct publicly. And if you have thoughts on the new name, I’d like to hear those too.

— Marin

Subscribe now

In this edition: After last edition's coverage of three papers that rewrote the resource estimation math, I jokingly asked quantum researchers to give me a few days to catch up before publishing the next breakthrough. They did not listen, and this edition may be even more consequential. This week's lead is a paper I consider more strategically important than any of March's blockbusters: Q-CTRL published a heterogeneous architecture design that cuts RSA-2048 to 190,000–381,000 physical qubits — not by inventing a new algorithm, but by organizing the hardware like a classical computer. Architecture is now the third independent lever compressing CRQC resource estimates, alongside algorithmic and QEC code innovation. Cloudflare joined Google in setting 2029 as its PQC migration deadline, explicitly citing last month's papers as the catalyst. Two companies that collectively operate much of the internet's infrastructure now agree on the timeline. QuiX Quantum put photonics on the board with the first below-threshold error mitigation result, one day after my CRQC Scorecard said photonics had scored zero on every metric. I also completed one of my most ambitious projects yet: a 10-article Deep Dive series examining every dimension of China's quantum program, with a capstone arguing that if current trends hold, China will win the quantum race. The PQC Migration Framework crossed 10,000 downloads, and the most common feedback revealed something troubling about how organizations are approaching migration. And in the "quantum flapdoodle" department: the physics of Ghost Murmur don't survive contact with a calculator.

The Paper Nobody Is Talking About Enough: Architecture as the Third Lever

Last month’s parade of resource estimation papers (Google’s 500,000-qubit Bitcoin result, Oratomic’s 10,000-qubit Shor’s, the INRIA ECC optimization pipeline) all shared a common lever: making the algorithm more efficient. A second line of work, qLDPC codes and similar constructions, attacks the error correction overhead. Both are important, and I spent the last newsletter unpacking them.

This week, Q-CTRL published a paper that demonstrates a third independent lever: architecture. Not a new algorithm. Not exotic error correction codes. Just a smarter way to organize the same computation across specialized hardware with the result of a reduction to 190,000–381,000 physical qubits for RSA-2048, with a runtime of under 10 days.

The core insight is almost embarrassingly simple: in Gidney’s efficient implementation of Shor’s algorithm, each qubit sits idle for roughly 97% of all clock cycles. In a monolithic quantum computer, those idle qubits occupy the same expensive, actively error-corrected hardware as the working qubits. They accumulate errors, consume cryogenic cooling, and demand dense wiring, all while doing nothing. Q-CTRL’s Q-NEXUS architecture fixes this by separating processing from storage: a tiny superconducting QPU (three logical qubits per core) handles the fast gates, while idle qubits get shipped to quantum memory, connected via a quantum bus.

I’ve been arguing for years that the most likely path to a CRQC is a heterogeneous system rather than a monolithic chip. Q-CTRL’s paper is the most rigorous validation of this thesis on a real cryptographic benchmark.

Why Three Levers Matter More Than Any Single Paper

What I want security planners to internalize: these three levers — algorithms, QEC codes, and architecture — are largely independent. They multiply rather than add. The RSA-2048 trajectory tells the story: 20 million qubits (2021) → ~1 million (2025) → ~100,000 with qLDPC codes (2026) → 190,000–381,000 with architecture alone on surface codes (2026) → potentially well under 100,000 combining all three. That last number is starting to overlap with industry roadmaps for the late 2020s to early 2030s.

Q-CTRL also introduces the concept of the Application-Specific QPU — the quantum equivalent of a GPU or ASIC. They found that 70% of the RSA-2048 runtime is consumed by a single subroutine, the Adder. A dedicated 37-logical-qubit accelerator for that operation cuts runtime by 46% for a 13% hardware increase. An adversary building a CRQC wouldn’t construct a general-purpose quantum mainframe — they’d build a purpose-optimized system, just as Bitcoin miners use ASICs rather than CPUs.

The caveats are real: the quantum bus (high-fidelity Bell-pair transfer between modules) hasn’t been demonstrated at scale, the memory technologies are early-stage, and the compiler is simulated. I document all of them in my full analysis. But these are engineering gaps, not physics barriers.

The strategic implication: the race to Q-Day may now be fundamentally a quantum interconnect race. The traditional threat indicator has been “how many qubits can platform X fabricate?” The new one should be “who has demonstrated high-fidelity quantum state transfer between a fast-clock QPU and a slow-clock memory?” I’ll be updating my CRQC Scorecard to add quantum interconnect maturity as a new tracking metric.

Cloudflare Joins Google: The 2029 Consensus Is Forming

Two weeks ago, Google set 2029 as its deadline for completing PQC migration. I wrote at the time that the question was whether this would remain an outlier or become the benchmark.

We got our answer in thirteen days.

Cloudflare announced it is accelerating its post-quantum roadmap to match Google’s 2029 target, explicitly citing last month’s Google ECC paper and Oratomic’s 10,000-qubit result as the catalysts. This isn’t a marketing gesture. Cloudflare handles DNS, CDN, DDoS protection, and reverse-proxy services for a substantial fraction of global web traffic. Between Google and Cloudflare, the companies that actually operate the internet’s plumbing have converged on the same number.

Three details in Cloudflare’s announcement deserve attention.

First, Cloudflare reports that over 65% of human-initiated traffic to its network already uses post-quantum encryption. But the new roadmap targets the harder problem: post-quantum authentication. Digital signatures, certificates, identity infrastructure. This is the domain of Trust Now, Forge Later (TNFL), a threat I first described in 2018 that’s finally getting the attention it warrants.

Second, the announcement quotes Scott Aaronson’s warning that researchers working on Shor’s algorithm resource estimates may have already stopped publishing their findings. If the world’s top quantum algorithm researchers are sitting on optimizations that make the published numbers even worse, the public resource estimates are an upper bound on difficulty, not a best estimate. That should concern anyone using published qubit counts for threat planning.

Third, this is exactly the dynamic I described in Q-Day Predictions Are Irrelevant — Deadlines Are Set. The reason to act on PQC isn’t a specific Q-Day prediction — it’s that the ecosystem is setting deadlines regardless of when a CRQC arrives. If your cryptographic infrastructure interfaces with Google’s or Cloudflare’s, and whose doesn’t?, you now have a deadline whether you set one or not.

Photonics Puts Its First Points on the Board

I published my CRQC Scorecard on April 1st. The photonic section was the starkest: zero demonstrated logical qubits, zero logical gates, effectively the entire journey remaining on every metric.

That lasted exactly one day.

QuiX Quantum demonstrated below-threshold error mitigation on a photonic quantum computer — the first time any photonic platform has shown it can remove more errors than it introduces. The work, in collaboration with NASA, the University of Twente, and Freie Universität Berlin, used a 20-mode silicon-nitride processor to perform photon distillation: a technique that cleans up individual photons through quantum interference before computation.

Let me be precise about what this is and isn’t. Photon distillation is not quantum error correction. It is not a logical qubit. It doesn’t demonstrate syndrome extraction, magic state production, or any of the system-level capabilities in my CRQC Quantum Capability Framework. Photonics still has the largest gap to a CRQC of any modality I track.

But it’s the first time photonics has put points on the board. The modeling suggests photon distillation could reduce photon source requirements per logical qubit by up to 4×, directly attacking photonics’ biggest scalability bottleneck, since photon sources constitute the vast majority of components in a photonic quantum computer.

There’s also a detail worth noting: the project was partially funded by the Netherlands Ministry of Defense through a project called QSHOR. The name tells you what the defense establishment is interested in: photonic paths toward running Shor’s algorithm.

Full analysis in my QuiX deep dive.

China’s Quantum Ambition: The Deep Dive Is Complete

I’ve just completed one of the most ambitious research projects I’ve undertaken on PostQuantum.com: a 10-article Deep Dive series that took months of investigation and runs to roughly 80,000 words across industrial policy, investment architecture, the Hefei National Laboratory, talent pipelines, quantum networking and QKD, computing hardware, quantum sensing, supply chain self-sufficiency, and a capstone synthesis.

The capstone, Underestimating China: Why Beijing Could Win the Quantum Race, makes a case I expect will be contested: if nothing changes in current trend lines, China will win the quantum cold war.

That isn’t because China’s quantum hardware is better today. It isn’t — the error correction gap is real, and the private sector ecosystem is weaker. The case rests on something more structural. Across EVs, 5G, drones, robotics, solar, and shipbuilding, China has executed the same playbook: massive coordinated investment, long-horizon industrial policy, rapid talent scaling, and systematic conversion of Western export controls into accelerants for domestic self-sufficiency. That playbook is now pointed at quantum computing. China leads in 69 of 74 critical technologies tracked by ASPI. It operates the world’s only carrier-grade quantum network. It has exported its first quantum computer.

What makes this particularly dangerous is the asymmetry of institutional response. While China mobilizes government, military, state enterprises, and academia as a single coordinated system, the U.S. proposed cutting NSF quantum research funding by 37%. Scientists are leaving U.S. institutions for Chinese universities. Over 1,000 U.S. faculty signed a letter warning that America’s own policies have been more effective at driving talent to China than any recruitment program Beijing ever ran.

I documented China’s weaknesses honestly — the growing scientific isolation, the dependence on Western cryogenic components, the weak translation from research to commercial products. But the series also shows how systematically those weaknesses are being addressed, often with timelines measured in years rather than decades.

I lived and worked in China for years. I’ve watched industry after industry where Western executives dismissed Chinese competition, confident that quality gaps and IP challenges would hold. They were wrong every time. The full series is at postquantum.com/chinas-quantum-ambition, and the geopolitical dimensions are explored further in my forthcoming book, Quantum Sovereignty.

10,000 Downloads — and a Pattern in the Feedback

The PQC Migration Framework crossed 10,000 downloads this week. What people told me about it was more interesting than the number itself.

The most common response wasn’t gratitude or even disagreement — it was some version of alarm. Teams that thought they had a handle on PQC migration discovered that their internal approach was missing entire categories of work: cryptographic discovery beyond certificate inventories, vendor dependency analysis that typically defines the real critical path, hybrid deployment patterns that don’t break interoperability, governance structures for a multi-year program rather than a one-off project.

That pattern in the feedback confirmed something I’d suspected: many organizations that started thinking about PQC migration this year are working from a mental model of the problem that’s an order of magnitude too simple. The complexity isn’t in swapping one algorithm for another. It’s in finding every place cryptography lives in your environment — hardcoded keys, embedded protocols, third-party dependencies buried four layers deep in your supply chain — and managing a migration across thousands of systems with different vendor timelines, different regulatory requirements, and different tolerance for disruption.

The framework is free, open-source (CC BY 4.0), requires no registration, and is available at pqcframework.com. If you’ve started your quantum readiness journey, or think you have, stress-test your approach against it. The teams that had to restart weren’t behind — they’d been solving a simpler problem than the one they actually face. For a comprehensive guide to the organizational strategy behind all of this, my forthcoming book Quantum Ready covers the full picture.

Quantum Flapdoodle: Ghost Murmur and the Limits of Journalism

Every edition needs a reminder that the word “quantum” doesn’t make a claim true. This week delivered a spectacular example.

The New York Post reported that the CIA used a system called “Ghost Murmur”, described as a quantum magnetometer built by Lockheed Martin’s Skunk Works, to detect a downed American airman’s heartbeat from 40 miles away in the Iranian desert. The story went viral across defense blogs, investment sites, and cable news. Lockheed Martin’s stock ticked up. Nobody called a physicist.

The problem isn’t that quantum magnetometry is fake — it’s genuinely impressive science. The problem is arithmetic. The heart produces a magnetic field of roughly 25 picotesla at chest contact which is already two million times weaker than Earth’s background field. That signal decays as the cube of distance. At 40 miles, you’re looking at a signal roughly 190 quadrillion times weaker than it is at the chest. This isn’t below the noise floor. It’s below the Heisenberg limit — the absolute measurement floor that quantum mechanics permits for any sensor, built by anyone, using any technology, now or in the future.

Scientific American has since published a thorough debunking, quoting physicists who range from diplomatic (”may overstate the maturity of the technology”) to blunt (”somebody yanking a reporter’s chain”). Ghost Murmur is most likely either deliberate disinformation designed to project capability to adversaries, or the intelligence community’s idea of an inside joke.

The actual quantum sensing research happening around the world is remarkable and worth covering seriously.

The Signal Through the Noise

Take a step back and look at what’s happened since the last newsletter.

Resource estimates for breaking cryptography gained a third compression lever — architecture — that’s independent of and multiplies with algorithmic and QEC code improvements. A second internet infrastructure giant converged on 2029 as the PQC migration deadline, explicitly because the research scared them. A quantum modality that had scored zero on every CRQC metric put its first points on the board. And a comprehensive 10-article analysis of China’s quantum program suggests the West’s biggest competitor is executing a more coordinated strategy than most observers realize.

How many signals does one need?

The arguments for inaction are running out. The PQC Migration Framework is free. The Q-Day Estimator can help you model the timeline. The Practical Steps to Quantum Readiness guide will walk you through where to start. And if your leadership still thinks this is a problem for next year, remind them: the deadlines are already set.

If you found this edition useful, forward it to a colleague who’s still on the fence about quantum risk. If I got something wrong, hit reply — I read everything and correct publicly. And if you’re new here, the full PostQuantum.com resource library is at postquantum.com for the deep dives behind every topic covered above.

— Marin

Subscribe now

In this edition: The biggest week in quantum resource estimation just happened, and I don’t think most people have processed what it means. Google Quantum AI published a landmark paper showing fewer than 500,000 superconducting qubits could break Bitcoin’s ECC-256 cryptography in under nine minutes. On the same day, Oratomic and Caltech showed the same attack could work with just 10,000 neutral atom qubits — at the cost of months of runtime. Weeks earlier, the same French team behind last year’s RSA breakthrough turned their optimization pipeline on elliptic curves. I unpack all three papers and explain why the convergence matters more than any single result. I also introduce my new CRQC Scorecard — a modality-by-modality assessment of how close each quantum platform actually is to cryptographic relevance — and the updated Q-Day Estimator tool. On the policy front, the U.S. intelligence community just elevated quantum to the same threat tier as AI, and Google drew a hard line: full PQC migration by 2029. To help with that migration, I’ve released the complete Applied Quantum PQC Migration Framework under Creative Commons — freely available at PQCframework.com. Then in the second half, I cover the story that nobody noticed: silicon quantum computing just ticked its last box on the fault-tolerance checklist, and it happened in Shenzhen.

The Resource Estimation Revolution: Three Papers That Redrew the Map

For years, the standard answer to “how many qubits to break encryption?” was a comfortably large number. Gidney and Ekerå’s 2021 estimate put RSA-2048 at roughly 20 million physical qubits. That figure became a security blanket for organizations that wanted to delay action — 20 million qubits felt safely impossible.

In the span of a few weeks this March, three separate research teams tore that security blanket to shreds. Not by building bigger quantum computers, but by finding dramatically more efficient ways to use smaller ones. And critically, the three papers aren’t independent — they build on and reference each other, forming a coherent body of evidence that the algorithmic side of the CRQC problem is advancing far faster than most threat models assume.

Google’s Bitcoin Paper: 500,000 Qubits, Nine Minutes

The headline-grabber landed on March 31. Google Quantum AI published what I consider the most significant quantum cryptanalysis resource estimate since Gidney’s 2021 RSA paper. The target: the elliptic curve discrete logarithm problem on 256-bit curves — the cryptography that protects Bitcoin, Ethereum, and the overwhelming majority of TLS sessions on the internet.

The core numbers: fewer than 500,000 superconducting physical qubits to solve ECDLP-256 in under nine minutes on a fast-clock architecture. That’s roughly a 10x reduction over the best prior estimates for this problem.

How? The improvements aren’t a single trick but an entire pipeline of optimizations — more efficient windowed arithmetic, better modular inversion circuits, tighter Toffoli-to-T compilations, and crucially, a compressed spacetime volume that shifts difficulty from qubit count to circuit depth. The paper also includes something genuinely novel: a zero-knowledge proof that the published circuits are correct, allowing independent verification without revealing proprietary compilation details.

But here’s the nuance that matters for CISOs reading this: a 9-minute attack window against ECC-256 has very different implications depending on the protocol. For harvest-now-decrypt-later (HNDL) attacks against stored data, runtime barely matters — an attacker with a CRQC can take as long as they need. For real-time attacks against Bitcoin transactions, the 9-minute window is operationally significant. Bitcoin’s confirmation time is roughly 10 minutes, meaning a sufficiently powerful quantum computer could theoretically forge a transaction before it’s confirmed. The full analysis is in my deep dive on the Google paper.

Oratomic’s Bombshell: 10,000 Qubits (But Read the Fine Print)

On the same day, and this is not a coincidence, a team from Oratomic, Caltech, and UC Berkeley published a paper claiming that Shor’s algorithm can be executed with as few as 10,000 reconfigurable neutral atom qubits. The names on the paper are a who’s-who of quantum error correction: Dolev Bluvstein (who led Harvard’s landmark neutral atom experiments), John Preskill (one of the founders of quantum error correction theory), and Hsin-Yuan Huang (Caltech).

The qubit reduction is staggering: 50x lower than Google’s superconducting estimate for the same ECC-256 attack, and roughly 100x lower than Gidney’s updated RSA-2048 estimate of roughly 1 million qubits. The key innovation is high-rate quantum low-density parity-check (qLDPC) codes with approximately 30% encoding rate, compared to the roughly 4% achieved by the surface codes Google and Gidney used. In practical terms, each physical qubit does far more useful work.

But, and this is critical, the paper trades qubits for time. The 10,000-qubit architecture would take days to months to complete the computation, depending on the target and parallelism configuration. For RSA-2048 in the space-efficient regime, the runtime stretches into months. This is not a 9-minute attack. It’s a different point on the space-time tradeoff curve — fewer qubits, vastly more time.

Does that make it less threatening? Not necessarily. An adversary running a months-long computation against harvested encrypted traffic doesn’t care about speed. And the paper’s balanced architecture — roughly 13,000 qubits with more parallelism — brings the ECC-256 attack down to days rather than months. These are still hypothetical machines. But “hypothetical machine with 13,000 qubits” is a very different planning target than “hypothetical machine with 20 million qubits.” My full analysis of the Oratomic paper covers the runtime tradeoffs, the qLDPC code innovations, and what this means for threat timeline assessment.

The INRIA Optimization Pipeline: ECC Gets the Same Treatment as RSA

These two papers didn’t emerge from nowhere. Weeks earlier, the same French team at INRIA Rennes (Clémence Chevignard, Pierre-Alain Fouque, and André Schrottenloher) published a new algorithm that further shrinks the quantum attack surface for elliptic curve cryptography. This is the same team whose CRYPTO 2025 paper on RSA factoring optimizations was subsequently used by Google’s Craig Gidney to bring RSA-2048 estimates from 20 million down to roughly 1 million physical qubits.

Now they’ve turned the same optimization pipeline on the elliptic curve discrete logarithm problem. The gate count reductions are significant, and the work, submitted to EUROCRYPT 2026, feeds directly into the resource estimates that Google and Oratomic subsequently published. This is the pattern I keep emphasizing: algorithmic improvements compound. Each optimization at the circuit level cascades through every subsequent resource estimate.

The Big Picture: Convergence, Not Individual Breakthroughs

Any one of these papers alone would be notable. Together, they represent something more important: a convergence of independent research groups arriving at dramatically lower resource estimates through different approaches.

The resource estimate trajectory tells the story. For RSA-2048: 20 million physical qubits (Gidney & Ekerå, 2021) → roughly 1 million (Gidney, 2025) → under 100,000 with the Pinnacle architecture (February 2026) → as low as 11,000–13,000 neutral atom qubits with qLDPC codes (Oratomic, March 2026). For ECC-256: millions of qubits in prior estimates → under 500,000 (Google, March 2026) → as low as 10,000 (Oratomic, March 2026). Different targets, different architectures, different tradeoffs — but the same direction. The cost of breaking today’s cryptography has dropped by orders of magnitude in five years, and the algorithmic pipeline shows no signs of slowing.

This is why the argument that Q-Day is safely decades away needs constant re-examination. The hardware gap is real: nobody has a machine with 500,000 physical qubits, and nobody has a 10,000-qubit neutral atom machine with the error correction quality these papers assume. But the algorithmic side of the equation is compressing faster than most forecasters assumed. And the algorithmic improvements don’t require building anything — they’re available to anyone with a good idea and a preprint server.

The CRQC Scorecard: Measuring the Gap That Actually Matters

To make sense of this rapidly shifting landscape, I’ve published what I think is the most comprehensive modality-by-modality assessment of how close each quantum computing platform is to cryptographic relevance: The CRQC Scorecard.

The scorecard evaluates five major quantum modalities (superconducting, trapped-ion, neutral-atom, photonic, and silicon spin) against three metrics that define the CRQC threat: Logical Qubit Capacity (LQC), Logical Operations Budget (LOB), and Quantum Operations Throughput (QOT). These map directly to the CRQC Capability Framework I developed years ago, but compressed into three executive-level levers that non-specialists can track.

The key finding: no modality is close to CRQC capability today. But the rate of progress varies enormously across platforms, and the new resource estimates change the goalposts significantly. When the target was 20 million qubits, every platform was equally far away. When the target drops to 500,000, or 10,000 for architectures that support qLDPC codes, the relative positions shift dramatically.

I’ve also updated the CRQC Readiness Benchmark (Q-Day Estimator) tool on PostQuantum.com. The tool now incorporates the latest resource estimates from all three papers and lets you model different scenarios: pick a resource estimation paper, select a quantum modality, set your own growth assumptions, and see the projected Q-Day timeline. Conservative, median, and aggressive presets are available, or you can plug in vendor roadmap claims and see whether they hold up against historical delivery rates.

Try it yourself: CRQC Readiness Benchmark (Q-Day Estimator). I think it’s the most rigorous public tool for scenario-based Q-Day forecasting, and I welcome challenges to the methodology.

The Intelligence Community Gets It: Quantum Is Now a Tier-1 Threat

If you needed a signal that the quantum threat has graduated from theoretical curiosity to active national security concern, the U.S. intelligence community just provided one. In the 2026 Annual Threat Assessment, quantum computing received its own dedicated section — alongside AI, not buried under a generic “cyber” heading.

This matters more than it might seem. The ATA is the single most-read intelligence product in the U.S. government. It shapes budgets, policy priorities, and attention at the highest levels. Previous editions mentioned quantum in passing. This year, quantum got equal billing with artificial intelligence as a transformative technology threat.

Perhaps more significantly, the ATA expanded the quantum threat definition beyond cryptographic attack. It explicitly acknowledges quantum sensing, quantum networking, and the broader implications of quantum advantage across intelligence collection, defense, and economic competition. This tracks with the argument I’ve been making on PostQuantum.com: the quantum threat isn’t just about Q-Day. It’s about a fundamental shift in what’s computationally possible. My full analysis of the ATA’s quantum sections is here.

Google’s 2029 Deadline: The Ecosystem Argument in Action

And speaking of deadlines being set: Google has now publicly committed to completing PQC migration across all its products and infrastructure by 2029. Not started. Completed.

This is exactly the dynamic I described in my Q-Day Deadlines Are Set analysis. The reason to act on post-quantum cryptography isn’t a specific Q-Day prediction — it’s that the ecosystem is setting deadlines regardless of when a CRQC arrives. When Google, the company that arguably understands the quantum threat better than any other (it’s simultaneously building the quantum computers and defending against them), sets a 2029 completion target for PQC migration, that becomes a de facto standard for every organization in its supply chain.

If your cryptographic infrastructure interfaces with Google’s (and whose doesn’t?) you now have a deadline whether you set one or not.

The PQC Migration Framework: Now Open and Free

Speaking of migration: I’ve published an update to something I’ve been working on for a long time. The complete Applied Quantum PQC Migration Framework — the full methodology for migrating enterprise cryptography to post-quantum standards — is now freely available under Creative Commons (CC BY 4.0).

This is not another repackaging of NIST guidance or a theoretical migration model. It’s an 8-phase lifecycle covering everything from executive mandate and business case through discovery, CBOM, risk scoring, roadmap, pilots, infrastructure modernization, and vendor governance. It includes cross-cutting sections on crypto-agility architecture, maturity models, metrics, and regulatory mapping. And it comes with four sector-specific extensions: Financial Services, Telecommunications, Government & Defense, and Critical Infrastructure / OT.

I embedded some hard-earned lessons into it. The framework deliberately diverges from conventional industry approaches where practical experience has shown they don’t work — minimum-viable CBOM instead of exhaustive inventories, risk-driven discovery scoping instead of boil-the-ocean audits, vendor governance first rather than as an afterthought. Where I take these more pragmatic positions, I defend each one with evidence, and we’ve worked with regulators who have accepted and in some cases adopted these approaches.

If you’re a CISO figuring out how to start, a program manager staring at a multi-year migration, a security architect navigating hybrid deployment, or a consultant helping clients get quantum-ready — this is for you. Publishing under CC BY 4.0 means anyone can use it, including commercially, with attribution. The full framework is at pqcframework.com.

Silicon Just Ticked Its Last Box — and Nobody Noticed

While Google’s cryptocurrency paper and the neutral atom hype cycle dominated headlines this month, a team in Shenzhen quietly demonstrated something that no silicon quantum processor had ever done: universal logical operations.

The SZIQA team at Southern University of Science and Technology used five phosphorus nuclear spins in isotopically purified silicon to encode two logical qubits, implement the complete universal gate set, including the notoriously difficult T gate, and run a variational quantum eigensolver on those encoded qubits, computing the ground-state energy of a water molecule. They also prepared magic states above the Bravyi-Kitaev distillation threshold, which is the gateway to fault-tolerant universal computation. Published in Nature Nanotechnology, and coming from China rather than the Australian groups that have led donor silicon work for two decades.

On its own, this is a nice result with modest fidelities. Two logical qubits isn’t going to threaten anyone’s cryptography.

But here’s why I think it matters far more than the headlines suggest: this was the last fundamental capability that silicon hadn’t demonstrated. I went back through the record and realized that over the past four years, silicon spin qubits have systematically checked every single box on the fault-tolerance checklist — gates above threshold (2022), error correction protocols (2022), multi-qubit algorithms above threshold (2025), modular multi-register scaling (2025), stabilizer-based error detection (2026), and now universal logical operations with distillable magic states (2026). No single result was a blockbuster. But the aggregate is remarkable.

So I wrote what a comprehensive analysis of silicon’s position in the quantum computing race: The Dark Horse: How Silicon Quietly Assembled Every Building Block for Fault-Tolerant Quantum Computing.

The Manufacturing Argument Nobody Else Is Making

The thesis: silicon is the platform everyone underestimates because it’s always a step behind the leaders on scale — superconducting qubits have more qubits, neutral atoms have demonstrated error correction at larger distances. But silicon is the only platform where every demonstrated capability has a credible path to industrial-scale manufacturing. The same EUV scanners, CVD chambers, and cleanroom protocols that produce today’s processors can, with targeted modifications, produce quantum chips. No other qubit platform can say this.

Though as I note in the article, “targeted modifications” is doing some heavy lifting — you need isotopically purified ²⁸Si, ultra-clean gate oxides, and fabrication precision beyond standard CMOS. The bridge from classical to quantum silicon is real, but it’s an engineering bridge, not a flat road.

The Biased Noise Finding the Security Community Missed

There’s also a finding from the SZIQA experiments that I think the security community has completely missed: silicon donor qubits exhibit strongly biased noise — phase-flip errors dominate while bit-flip errors are essentially absent. Theoretical work shows this can push fault-tolerance thresholds from ~1% to over 5%, which means silicon could need significantly fewer physical qubits per logical qubit than standard CRQC resource estimates assume. I wrote a separate deep dive on the biased noise advantage because I think it deserves its own analysis.

What This Means for Your Threat Model

What does this mean for your quantum threat planning? It doesn’t change near-term timelines. But it adds another credible pathway to a CRQC — and silicon is classified as a “fast-clock” architecture alongside superconducting and photonic qubits, meaning a silicon-based quantum computer would execute cryptographic attacks in minutes, not hours. If your risk model has been quietly discounting silicon as “too far behind,” the dark horse article lays out why that assumption needs updating.

The full analysis, with five things to watch for and a comparison against every other platform, is here. It’s the anchor of a ten-article series covering the complete progression of silicon quantum computing. Individual milestone papers are linked from this one.

The Bottom Line

Take a step back and look at what happened in March 2026 alone. Resource estimates dropped by another order of magnitude. A new quantum modality (neutral atoms with qLDPC codes) entered the cryptanalytic conversation at shockingly low qubit counts. Silicon, the platform most analysts ignore, completed its fault-tolerance checklist. The U.S. intelligence community elevated quantum to a Tier-1 threat. And Google set a 2029 migration deadline.

None of these developments individually mean Q-Day is imminent. But collectively, they demolish the case for inaction. The algorithmic walls are closing in from one side. The hardware is advancing from the other. And the ecosystem of regulators, insurers, supply chains, the intelligence community, isn’t waiting for the two to meet.

If you haven’t started your PQC migration planning, the question is no longer “when should we start?” It’s “how do we explain why we haven’t?” The PQC Migration Framework is free, comprehensive, and ready to use. The Q-Day Estimator can help you model the timeline. The excuses are running out.

If you found this edition useful, forward it to a colleague who’s still on the fence about quantum risk. If I got something wrong, hit reply — I read everything and correct publicly. And if you’re new here, you can browse the full PostQuantum.com resource library at postquantum.com for the deep dives behind every topic covered above.

— Marin

Subscribe now

In this edition: I’m back after a pause - apologies and thank you for the messages asking when the next edition would arrive. A lot has happened since November. Today’s lead story is one I think most people have missed entirely: the quantum computing industry is quietly entering its “PC moment,” with modular, open-architecture systems replacing sealed black boxes - and China just released the world’s first freely downloadable quantum operating system. I also share highlights from my discussion with QuantWare’s CEO about their plan to reach 10,000 qubits by 2028 using a radical 3D chiplet architecture. We cover the Pinnacle architecture’s dramatic claim about breaking RSA-2048 with only ~100,000 physical qubits, the surprisingly nuanced debate about ECC falling before RSA, Google’s Merkle Tree approach to quantum-proofing HTTPS (which is not what many think it is), why PQC migration turned out to be a 120,000-task monster that became my most-read article ever, and a new snake-oil vendor claiming they’ve cracked RSA-4096. Plus: free quantum security webinars and a new SANS course.

A Note on the Return (and the New Format)

First things first: I owe you an apology. The Quantum Observer went quiet after edition #3 in November, and many of you reached out asking what happened. The honest answer is that I was dealing with some personal matters that took me away from work for a while. When I came back, the volume of news on PostQuantum.com had grown to a point where the newsletter drew the short straw. That was a mistake - I’ve heard from enough of you to know it matters.

So we’re back. But with a small format change: I’m dropping the strict weekly cadence. Instead, expect one or two editions per week - sometimes one focused on quantum computing developments, another on quantum security. And if major news breaks, I’ll cover it in a special edition. Quality over calendar.

Now, let’s get into it. And I want to start with something I believe is one of the most underappreciated stories in quantum computing right now.

The Story Most People Missed: Quantum Computing’s “PC Moment”

In 1981, IBM released the IBM PC. The machine itself was unremarkable. What made it revolutionary was what it wasn’t: a sealed, proprietary box that only IBM could build or extend. By publishing the architecture and using off-the-shelf components, IBM inadvertently created an entire industry. Within years, hundreds of companies were building IBM-compatible PCs from interchangeable parts. The personal computer revolution wasn’t about any single machine - it was about the moment computing moved from vertical integration to an open, modular ecosystem.

Something remarkably similar is happening in quantum computing right now, and almost nobody is talking about it.

From Black Boxes to Building Blocks

For most of its commercial existence, a quantum computer has been something you bought as a complete, sealed system from a single vendor - IBM, Google, IonQ, Quantinuum. Qubits, control electronics, cryogenics, software stack, cloud interface - all from one source. This vertical integration made sense early on, just as it made sense for DEC to sell complete minicomputers.

But the economics and geopolitics of quantum computing are pushing the industry toward a fundamentally different model. In my deep dive on Quantum Open Architecture, I traced how this transition is unfolding across six converging drivers: the sheer technical complexity of building every layer in-house, the economics of specialization, the speed advantages of modular innovation, the need for customization across different use cases, the geopolitical imperative of quantum sovereignty, and the growing community push for democratized access.

The results are already visible. Last year, the University of Naples Federico II assembled Italy’s largest quantum computer by sourcing a Dutch-made quantum processor, pairing it with third-party control electronics, and integrating the whole system in-house. The Israeli Quantum Computing Center built an open facility from best-of-breed components. The Netherlands’ Tuna-5 project did the same. In late 2025, a coalition in Colorado announced the first QOA-based quantum computer in the U.S., integrating components from QuantWare, Qblox, Q-CTRL, and Maybell Quantum into a cloud-accessible platform. These aren’t science projects - they’re the first “PC clones” of the quantum era.

The “Intel of Quantum” and the Hardware Scaling Problem

To understand what’s driving QOA, it helps to talk to someone who’s building the components. I recently sat down with Matt Rijlaarsdam, CEO of QuantWare - the Dutch startup that supplied the quantum processor for the Naples system - for an in-depth discussion about the modular revolution. Rijlaarsdam’s framing is blunt: QuantWare wants to be the Intel of quantum computing. The company doesn’t build complete quantum computers - it designs and fabricates superconducting quantum processors and sells them to anyone who wants to build one. They now ship QPUs and components to customers in over 22 countries, and the customer base has shifted from predominantly academic to majority commercial.

The Intel analogy is more than marketing. As devices get exponentially more complex, no single organization can afford to be world-class at every layer of the stack. By focusing narrowly on processors and selling at volume, QuantWare drives down unit costs through the same amortization logic that made Intel dominant - higher volume, lower costs, better yield, more customers, in a virtuous cycle that mirrors exactly how the semiconductor industry matured.

But the most technically fascinating part of our conversation was about QuantWare’s VIO-40K architecture - their plan to reach 10,000 qubits by 2028. The core insight is that today’s superconducting chips have an I/O bottleneck: as much as 90% of chip area gets consumed by wiring and routing infrastructure, leaving only about 10% for the qubits themselves. Beyond a few hundred qubits, you simply can’t snake all the control lines across a 2D plane without causing interference. QuantWare’s solution goes vertical - a 3D stack of chiplets that delivers control signals from above rather than sprawling outward across the chip surface. The design supports up to 40,000 I/O connections, theoretically enabling 10,000 qubits with about four lines each. And counterintuitively, Rijlaarsdam argues that fidelity could actually improve in the vertical architecture because signals are better shielded in the 3D channels than in a crowded planar layout.

To be clear: 10,000 physical qubits in 2028 would not break RSA or trigger Q-Day. Rijlaarsdam himself estimates such a device would yield on the order of 10 to 100 logical qubits - modest but enormously valuable as the first platforms for real fault-tolerant computation. The full interview covers the scaling economics, the geopolitics of quantum sovereignty, QuantWare’s upcoming KiloFab (Europe’s first dedicated quantum chip factory), and why he thinks the key problems are solved and what remains is mostly engineering. Read the full discussion here.

But There’s a Missing Piece - And China Just Filled It

Here’s where it gets interesting, and where the story gets uncomfortable for Western observers.

Every PC clone needed an operating system. You could assemble a motherboard, a CPU, RAM, and a hard drive from different vendors, but without an OS to tie them together, you had an expensive paperweight. The PC revolution didn’t truly ignite until software - first CP/M, then DOS, then Windows - provided the integration layer that made the hardware ecosystem work.

The quantum open-architecture movement has exactly the same problem. You can buy a quantum processor from one company, control electronics from another, and cryogenic systems from a third. But who provides the software layer that makes them all work together? Who handles the calibration, the error mitigation, the job scheduling, the classical-quantum orchestration? This is what I call platform-level quantum systems integration - assembling a working quantum computer from modular components - and it’s distinct from enterprise-level integration, which is about connecting a quantum computer into existing HPC, cloud, and IT environments. Both are essential; neither is solved. I examined the full picture in my article on Quantum Systems Integration - and at the platform level, the answer until this week was essentially “nobody, you figure it out yourself.”

This week, China’s Origin Quantum made the world’s first quantum operating system freely available for download. Origin Pilot isn’t a programming framework like Qiskit or Cirq - it’s a full systems integration layer. It handles hardware abstraction across multiple qubit types, provides calibration and error mitigation, manages job scheduling, and orchestrates the classical-quantum boundary. It’s the missing piece that turns a collection of quantum components into a working quantum computer.

As I analyzed in my detailed assessment of Origin Pilot and China’s quantum OS strategy, this move isn’t competing with Qiskit. It’s competing with the absence of any Western equivalent - and that’s a much bigger problem. The Western quantum ecosystem has no freely available, hardware-agnostic systems integration layer. Every open-source framework (Qiskit, Cirq, PennyLane) operates at the SDK/application level, assuming someone else has already solved the messy integration work underneath. Nobody has.

Why This Matters for You

The DeepSeek parallel is real - and the stakes may be higher. Just as China’s release of competitive open-source AI models reshaped assumptions about the AI race, Origin Pilot’s free release could reshape the quantum computing landscape. Countries pursuing quantum sovereignty now have a ready-made integration layer to build upon. And if that layer is free and Chinese-built, the ecosystem that grows around it will naturally tend toward Chinese standards and interfaces.

The Western quantum industry isn’t asleep - companies like Qblox, Zurich Instruments, and Quantinuum are building excellent components, and as the QuantWare interview shows, the hardware side of QOA is advancing rapidly. But nobody is building the equivalent of DOS for quantum computing. In the PC revolution, the company that controlled the OS eventually captured more value than any hardware maker.

The quantum industry’s architecture is being defined right now. If you’re not paying attention to QOA and quantum systems integration, I’d strongly recommend the full QOA analysis, the QuantWare CEO discussion, and the Origin Pilot deep dive.

Pinnacle Architecture: 100,000 Qubits to Break RSA-2048 - But Read the Fine Print

A new paper from Iceberg Quantum introduced the “Pinnacle” architecture, claiming that RSA-2048 could be broken with approximately 100,000 physical qubits - a dramatic reduction from the millions typically cited. The key innovation is aggressive use of quantum low-density parity-check (qLDPC) codes, which encode logical qubits far more efficiently than surface codes.

The reaction was appropriately mixed. Craig Gidney - Google’s top quantum error correction researcher - offered measured criticism of the spacetime volume claims. Scott Aaronson endorsed the direction with caveats.

Here’s what matters for planning: the 100,000-qubit figure didn’t make Q-Day closer. What Pinnacle did is shift the difficulty from one part of the stack to another. The qubit count dropped dramatically, but the paper relies on qLDPC codes whose practical decoding at scale remains an unsolved problem - a point I unpack in my detailed analysis of the Pinnacle architecture and a companion piece on qLDPC codes. The hardware requirements went down; the algorithmic and engineering requirements went up by a comparable amount. This is valuable research that advances the field, but it’s not a reason to panic - and it’s not a reason to relax either.

The broader pattern is worth watching: resource estimates for breaking RSA-2048 continue moving in only one direction - down. Each breakthrough doesn’t eliminate the hard problems but relocates them. The margin of safety you thought you had is shrinking, even if Q-Day itself hasn’t meaningfully moved.

The ECC Debate: Why RSA Timelines Don’t Apply to Bitcoin

There was a notable stir recently when Scott Aaronson pointed out something cryptographers have known for years but that hasn’t penetrated mainstream quantum-threat planning: under certain conditions, ECC would fall to a quantum computer before RSA.

This matters enormously for systems that rely on ECC - most prominently Bitcoin, which uses ECDSA for all transaction signing. As I explain in my updated deep dive on how Shor’s algorithm affects RSA, ECC, and Diffie-Hellman differently the quantum resource requirements depend on which mathematical problem is being attacked. For equivalent classical security levels, breaking ECC generally requires fewer logical qubits than breaking RSA. The exact ratio depends on error correction assumptions, but the directional conclusion is robust.

My Bitcoin-specific analysis became discussed because it makes the implication explicit: if you’re using RSA-2048 resource estimates to plan your quantum security timeline for ECC-based systems (including Bitcoin, Ethereum, and many TLS implementations using ECDHE), you’re likely overestimating how much time you have.

The bottom line: don’t use RSA timelines for ECC-based decisions.

Google’s Merkle Tree HTTPS Gambit: What People Got Wrong

Google recently announced Merkle Tree Certificates (MTC) for HTTPS authentication in Chrome, and I saw widespread confusion online. Several commentators interpreted it as Google bypassing NIST’s post-quantum cryptography standards. That’s wrong.

As I explain in my analysis of Google’s MTC approach, this is an architectural optimization, not a cryptographic one. Post-quantum signatures (ML-DSA, SLH-DSA) are significantly larger than classical ones, adding latency to the TLS handshake - noticeable at Google’s scale of billions of daily connections. MTC reduces per-connection overhead by batching certificate validations into a tree structure. The underlying primitives remain NIST PQC standards. Google isn’t replacing post-quantum crypto - they’re redesigning the plumbing to handle larger payloads efficiently.

This is exactly the pragmatic engineering the PQC transition needs more of. Anyone dismissing it as Google “going its own way” is missing the point.

120,000 Tasks: The Article That Hit a Nerve

My most-visited article over the past few months wasn’t about a hardware breakthrough or a threat timeline. It was about project management.

120,000 Tasks: Why Post-Quantum (PQC) Migration Is Enormous walked through a realistic program plan for PQC migration at a large enterprise - and the numbers shocked people. For the example organization I modeled, the migration generated approximately 120,000 individual tasks spanning cryptographic discovery, algorithm replacement, testing, deployment, vendor coordination, compliance, and operational changes.

Some readers found the number galvanizing. Others pushed back - their organization wouldn’t face 120,000 tasks. Fair enough: yours may face 30,000 or 60,000. The specific number isn’t the point. PQC migration is not a “swap some libraries” exercise. It is a multi-year, enterprise-wide transformation program that touches every system using public-key cryptography - which is, effectively, every system. If your leadership still thinks this is a quarter-long sprint, share this with them.

Quantum Flapdoodle: The “We Broke RSA-4096” Scam

A new company has been making the rounds claiming they’ve broken RSA-4096 - and selling PQC solutions on the strength of this supposed achievement. The claims are bold, but the technical substance is zero.

In No One Has Secretly Broken RSA-2048 or RSA-4096 — Here’s the Science, I walk through why this is physically impossible with any quantum hardware that exists or is known to be in development. If someone had actually achieved this, it wouldn’t be a marketing pitch for a consulting or a product firm - it would be the most consequential technological development of the century.

The tell is always the same: fabricate a dramatic, unverifiable claim to create urgency, then sell solutions to “protect” against the threat you just invented. If a vendor tells you they’ve broken RSA-4096, ask for the peer-reviewed paper. You’ll hear crickets. There are real quantum threats that justify real urgency. You don’t need fake ones.

From the Applied Quantum Desk

A few updates from Applied Quantum:

Quantum Systems Integration Services: Speaking of QOA and the modular revolution - Applied Quantum is now offering quantum computer systems integration services, helping organizations assemble, deploy, and operate quantum systems from best-of-breed components. If the QOA story above resonated and you’re wondering how to get started, get in touch.

Free Webinars: We’ve launched a series of free quantum security webinars covering PQC migration fundamentals to advanced threat assessment. Full schedule at appliedquantum.com/events.

SANS Quantum Security Course - Now Live: The first quantum security course we developed with SANS Institute - Quantum Security Readiness for Executives - is open for registration. First session: March 18. Practical, hands-on, designed for security leaders who need decision-making fluency, not a physics PhD. Register at sans.org.

Resource Update: Getting Started With Quantum Readiness

One more thing - I’ve significantly updated my curated guide on Getting Started With Quantum Readiness and PQC Migration. If you need a structured reading path to bring yourself or your team up to speed, this is the best place to start — organized by topic and experience level.

That’s it for Quantum Observer #4. If this was useful, forward it to a colleague who should be paying attention. If I got something wrong, hit reply - I read everything and correct publicly.

And one ask: I’d love to hear how I can make this newsletter more useful for you. More depth on fewer topics, or keep the broad survey? Too long? Too short? Different topics? Hit reply - your feedback directly shapes what comes next.

See you in the next edition.

— Marin

Subscribe now

In this edition: Another busy period in quantum: Quantinuum launched Helios, claimed a new form of quantum advantage, and added more evidence that error-corrected quantum computing is finally moving from theory to practice. Google, IonQ, and IBM all dropped major updates in the same two-week window, and IBM continues hitting its roadmap milestones ahead of schedule. Meanwhile, neutral-atom platforms - especially Harvard/QuEra - delivered stunning below-threshold results, joining superconducting and trapped-ion qubits as serious contenders for fault-tolerant quantum computing. Beyond the lab, governments and investors poured billions into quantum programs worldwide, from DARPA to California, the UK, the EU, and an $800M mega-round for Quantinuum. We also saw notable progress in QKD, coherence times, and city-scale quantum networking. And yes… this week’s Quantum Flapdoodle features a new wave of “quantum” pendants and stickers claiming to heal, block radiation, and manifest abundance. Spoiler: they don’t. Enjoy the tour.

In this edition, we highlight key recent news in quantum computing – and, this time, try to connect them to prior breakthroughs over the last few months to keep the big picture in focus.

The firehose of amazing achievements is flowing faster than ever, making it hard to track what’s going on! Let’s break it down.

Helios and the Quantum Advantage Relay

Quantinuum’s Helios Launch: The big news of the week was Quantinuum’s release of Helios, a new 98-qubit trapped-ion quantum computer. Billed as “the world’s most accurate” commercial quantum system, Helios achieves record two-qubit gate fidelity (~99.921%) and introduces an innovative architecture using barium ion qubits. It’s designed for hybrid quantum-classical processing with a real-time control engine and even a new programming language (Guppy) for seamlessly mixing classical and quantum code. Helios also marks Quantinuum’s first deployment outside the US (planned for Singapore), underscoring the company’s global ambitions. My in-depth analysis of the Helios architecture (including its use of QCCD ion transport for all-to-all connectivity and memory/logic separation) is available for those wanting a deep dive. In short, Helios nearly doubles Quantinuum’s qubit count (98 vs. 56 in H2) while improving fidelity – a major leap in scaling without noise penalty.

Demonstrating Quantum Advantage: Beyond the shiny hardware, the real story is that Helios has now demonstrated quantum advantage – twice over. (Please note that there are as many definitions of quantum advantage, and opinions about whether it was achieved in these examples, as there are quantum technology observers.) As I unpack in this article on Quantinuum’s Helios quantum advantage, the system first pushes deep random-circuit sampling to a regime where even exascale supercomputers would need absurd resources (think “longer than the age of the universe” and “more power than all visible stars”) to keep up. Then it goes further and tackles a Fermi–Hubbard simulation of high-temperature superconductivity on a 6×6 lattice – a task that is effectively out of reach for classical methods. This latest claim lands just two weeks after Google’s new verifiable quantum advantage result and shortly after IonQ’s record-setting trapped-ion experiment, and only days before IBM unveiled its Nighthawk and Loon chips as key waypoints on their advantage-to-fault-tolerance roadmap. Quantum advantage is starting to look less like a one-off headline and more like a relay race.

Fully Error-Corrected Gates Arrive: Stepping back to June, Quantinuum also made waves by declaring it’s the first to demonstrate a fully error-corrected universal gate set. What does that mean? Essentially, they performed all types of quantum logic operations (Clifford and non-Clifford gates) on logical qubits with errors detected and corrected in real-time. This was achieved by generating high-fidelity “magic” states and using them to implement a non-Clifford T-gate fault-tolerantly. It closed a long-standing gap – previously, error-corrected qubits could handle the easier Clifford gates, but the hardest gate (T) was too error-prone. Quantinuum’s result showed a path to incorporate every gate needed for universal computing under error correction. In other words, they claim all the ingredients for at-scale fault-tolerance are now on the table, giving them a “de-risked” roadmap to a full fault-tolerant machine by 2029. This achievement set the stage for the flurry of quantum advantage claims that followed in this latest period – it’s as if once error correction started working, useful quantum computations quickly began popping up.

IBM’s Roadmap Discipline: Speaking of fault-tolerance, IBM has been hitting its own milestones. In October, IBM announced it ran quantum error-correction algorithms on off-the-shelf AMD hardware – and did so 10× faster than required. This was a test of their classical control system for error correction, and running it on standard FPGAs a year ahead of schedule shows IBM’s engineering discipline. In fact, it’s the third roadmap milestone IBM delivered significantly early (others include previous processor releases and software stack updates). IBM’s latest Nov 12 update introduced the 120-qubit Nighthawk chip aimed at quantum advantage by 2026, and the Loon test chip to lay groundwork for fault tolerance by 2029. With each milestone met or exceeded, my confidence (and frankly, concern!) grows that IBM will hit a commercially viable fault-tolerant quantum computer within the next few years. The pace and engineering discipline are remarkable – they’re making a very complex effort look almost routine.

Bottom line for this section: We’ve seen a cascade of achievements – error-corrected gates, back-to-back quantum advantage experiments, new high-qubit chips – all within a matter of months. The acceleration of quantum tech progress is accelerating 🙂, and it’s genuinely hard to keep up. Now let’s turn to a dark horse in the race that’s suddenly looking like a front-runner: neutral atoms.

Neutral Atoms Level Up

If superconducting qubits and trapped ions have dominated the spotlight, neutral-atom quantum computers just dramatically elbowed their way into contention. I’m particularly bullish about a massive result from Harvard/QuEra (Mikhail Lukin’s team) that achieved a fault-tolerance milestone with neutral atoms. This is the same group that in late 2023 demonstrated a logical qubit on a neutral-atom processor with performance improving as code distance increased – one of the most consequential results of that year. Just two months ago, in September, they also kept a 3,000+ qubit neutral atom array running continuously for over 2 hours, swapping out atoms to overcome loss and essentially achieving an “infinite” runtime quantum simulator. These achievements were already remarkable, but the latest news goes even further.

Below-Threshold Error Correction: The new Harvard-led experiment (reported in Nature) used a 448-atom array to implement a small surface code and showed it operating below the error threshold – meaning adding more qubits in the code actually suppressed errors instead of amplifying them. In practice, they did repeated rounds of error correction and observed that a distance-5 code had lower logical error rates than a distance-3 code, a clear signature of true error-correcting behavior. This is huge: it’s proof that neutral atom qubits can be scaled into the error-correcting regime needed for fault-tolerant quantum computing. Combined with their 2023 logical qubit work, it signals that neutral-atom platforms are no longer just “science experiments” but serious competitors on the fault-tolerance path. The Harvard/QuEra team essentially achieved with 448 optical tweezed atoms what Google did with 72 superconducting qubits – a below-threshold logical qubit – but with a very different technology. This result caught many off guard and is forcing a recalculation of modality race rankings.

Recent Neutral-Atom Milestones: Let’s not forget other neutral-atom feats in recent weeks. Caltech set a record with a 6,100-qubit optical tweezer array. They held thousands of cesium atoms in superposition for 13 seconds and achieved 99.98% single-qubit control fidelity. That demonstrated not just scale, but quality at scale, which is vital for error correction. And in China, a startup unveiled Hǎnyuán-1, a 100-qubit neutral-atom quantum computer that’s fully operational at room temperature (qubits inside are still laser-cooled). It’s already been delivered to customers (including China Mobile) and marks one of the first commercial sales of a Chinese quantum computer. Notably, Hǎnyuán-1 fits in standard server racks and uses locally sourced lasers and optics – an impressive engineering feat emphasizing compact design and domestic supply chains.

All this positions neutral atoms as a serious contender alongside superconducting and trapped-ion qubits. With the Harvard result showing below-threshold error rates, neutral-atom systems might achieve multiple logical qubits sooner than many expected. They also offer unique advantages: huge qubit counts (thousands of atoms), 3D connectivity (via moving atoms or connecting arrays with light), and operation at higher temperatures (even room temp for some designs).

The field is now extremely exciting – we effectively have three horse breeds in the race to scale: the long-favored superconducting circuits, the steady and high-fidelity trapped ions, and now these dark-horse neutral atoms proving their mettle. Competition usually breeds progress, so having three viable modalities can only accelerate the roadmap to large-scale quantum computers.

Why “Below Threshold” Matters So Much

When you hear “below threshold” for quantum error correction, that’s really important. It refers to achieving physical qubit error rates low enough that adding more qubits in an error-correcting code actually reduces the logical error. This was a theoretical must-have for decades, and it’s finally being demonstrated in practice – first by Google earlier in 2023, and now by Harvard on a different platform. In my framework for predicting CRQC (cryptographically relevant quantum computers), reaching below-threshold QEC is a critical capability, because it’s the turning point where we can start scaling up logical qubits without the error burden blowing up.

Google’s Milestone: Back in early 2023, Google Quantum AI showed the first “bigger code beats smaller code” result on a superconducting chip – the experiment covered in my piece Google Claims Breakthrough in Quantum Error Correction. They compared a distance-5 surface code (49 qubits) to a distance-3 code (17 qubits) and found that the larger code had a slightly lower logical error rate (~2.9% vs 3.0% per cycle). On paper that’s only a ~0.1% improvement, but it was historic: it was the first clear sign that their hardware had effectively crossed the surface-code threshold, so adding more qubits to the code actually reduced logical errors instead of amplifying them. That experiment was the original “key signature of QEC” moment. Fast-forward to the end of 2024, and Google pushed this much further with the Willow processors, described in Google AI’s Surface Code Breaks the Quantum Error Threshold. This time they ran distance-5 and distance-7 surface codes on 72- and 105-qubit Willow chips and saw the logical error drop from ~0.3% to ~0.143% per cycle as they increased the code size. Crucially, the distance-7 logical memory outlived the best physical qubit on the chip and operated as a sustained below-threshold quantum memory with real-time decoding over up to a million QEC cycles. So you can think of 2023 as the first “crossover” demonstration and the Willow result as the full-blown, below-threshold quantum memory milestone.

Harvard’s Leap: Fast-forward to now – the Harvard neutral atom experiment achieved a similar below-threshold feat in a very different system. Two independent demonstrations (and rumors of others in the works) give confidence that below-threshold QEC is not a one-off. It appears multiple platforms are entering an era where logical qubits can retain information longer than the best physical qubits, by using redundancy and smart encoding. This is the transition point from the NISQ era to the dawn of fault tolerance.

These latest below-threshold results motivated me to compila a dedicated piece collecting and examining the recent QEC experiments across platforms. If you’re into the nuts and bolts of error correction, check out my article on the spate of “QEC below threshold” experiments and what they imply for timelines. The upshot is that quantum computing now has a clear foothold on the mountain of scalability. We’re not at the summit, but we can finally see a route up.

And That’s Not All… More Tech Breakthroughs

You’d think the above was plenty for a week – but there’s even more happening in quantum tech development:

• Longer-Lived Qubits: A team at Princeton built a superconducting qubit with a coherence time over 1 millisecond – 3× longer than the previous record. This is the largest single leap in qubit lifetime in over a decade. A millisecond may not sound like much, but for quantum it’s huge – longer coherence directly means fewer errors. One of the researchers noted that if you simply swapped these tantalum qubits into Google or IBM’s processors, error rates could drop 1000×. That could cut the overhead for error correction dramatically. Even better, the new qubit design is compatible with existing transmon tech, so industry could adopt it relatively quickly.

• Quantum Networks & QKD: On the communications front, researchers demonstrated quantum key distribution (QKD) over 120 km of standard optical fiber, while that fiber carried regular internet traffic. This broke distance records for continuous-variable QKD in a real-world scenario. They managed to send quantum encrypted keys and classical data simultaneously by clever filtering and use of a “built-in” wavelength that minimized interference. Why does that matter? It shows quantum-secure links can be integrated into existing telecom infrastructure over metropolitan-scale distances (120 km could cover a large city and suburbs). It’s a step toward a practical quantum internet. On a related note, IonQ and a Swiss consortium launched a city-scale quantum network in Geneva connecting CERN, the University of Geneva, and even a luxury watch company via optical fiber. The network (Geneva Quantum Network) uses ID Quantique’s QKD devices (IonQ acquired a stake in IDQ) to enable secure quantum key exchange across town, and it’s testing entanglement distribution between nodes. They even synchronize the network with atomic clocks from Rolex for ultra-precise timing. It’s one of the first city-wide quantum networks that isn’t just a lab demo – it involves real institutions and is a template for future secure communications infrastructure.

These developments show that quantum coherence, communication, and computing are all advancing in parallel. We’re extending how long qubits can last, how far quantum signals can travel, and how well quantum algorithms can outperform classical ones. Hard problems remain, but the pieces of the puzzle are falling into place, one breakthrough at a time.

Business & Policy News Roundup

It’s not just technical milestones – the past week also saw significant business, funding, and policy news in quantum:

• DARPA QBI Stage B: The U.S. DARPA advanced 11 companies to Stage B of its Quantum Benchmarking Initiative. This means firms like IBM, Quantinuum, Atom Computing, and others showed plausible plans for a utility-scale quantum computer in Stage A, and now get funding to develop detailed R&D roadmaps. The fact that 11 companies made the cut shows how many serious efforts are underway. DARPA will rigorously evaluate their plans – and those that impress could receive even bigger support (and bragging rights).

• “Quantum California” Initiative: California launched a state-backed quantum technology program, aptly named Quantum California. Governor Newsom announced an initial $4 million (in the 2025–26 budget) to kickstart it, along with new legislation (Assembly Bill 940) to coordinate academia, industry, and government efforts.

• UK’s Quantum Showcase: Over in the UK, the government used its National Quantum Technologies Showcase event in London to unveil a slate of new investments. They branded the coming years the “Quantum Decade” and backed it up with fresh funding and collaborations.

• Quantinuum’s $800M Mega-Round: On the corporate side, Quantinuum raised an eye-popping $800 million in a funding round valuing the company at ~$10 billion. This is one of the largest investments ever in a quantum startup. Notably, the same week, Canada’s photonics QC startup Xanadu announced plans to go public via SPAC at a ~$3.6B valuation. Big financings and exits like these signal that quantum tech is maturing from lab research to a commercial industry – and that capital markets see enough progress to justify multi-billion-dollar bets.

• US National Quantum Centers Renewed: The U.S. Department of Energy committed $625 million to renew its five National Quantum Information Science Centers for another five years. These centers (originally launched in 2020 with roughly $115M each) are major multi-institution hubs pushing research in areas from quantum computing to materials to networking. The renewal ensures these centers will continue their work into the late 2020s. It’s basically a vote of confidence that the initial five years went well, and now the feds are doubling down with another half-billion+ to keep the momentum.

• EU’s Quantum Act Plans: Not to be outdone, the EU announced plans for a comprehensive “Quantum Act” at the European level. The European Commission opened a public consultation to shape this legislation, which is slated for 2026. The Act’s goals mirror other big initiatives (think EU Chips Act but for quantum): boost R&D funding across member states, scale up industrial capacity (like establishing pilot production lines and a quantum chip design facility in Europe), and ensure supply chain resilience and governance (since quantum is dual-use tech). It’s a space to watch, especially for companies operating in Europe – support and requirements may ramp up significantly.

As you can see, governments and investors worldwide are investing big in quantum right now. We’re in that phase where policy is catching up to technology, and money is starting to flow at scale. It’s a strong indicator that people in power believe quantum tech will be strategically important in the near future – not some 20-year-away sci-fi. For those of us tracking “Q-Day” (the day quantum breaks crypto), these developments on both tech and funding fronts suggest the timeline is steadily firming up.

Personal Note – Podcast Appearance

On a personal note, I had the pleasure of chatting on the SANS “Cyber Leaders” podcast this week alongside my colleague Kawin. We discussed “Quantum’s Leap – how cyber leaders are preparing for the post-encryption era.” It was a great conversation about the practical steps organizations should take now to get ready for quantum risks (like doing crypto inventories, prioritizing data migration to PQC, etc.), as well as the opportunities quantum tech offers. If you’re interested in cybersecurity strategy in this quantum-transition period, you might enjoy that episode. It’s now out on the SANS Cyber Leaders podcast feed (Episode 21). I won’t self-promote too hard here, but I figured I’d mention it since many of you are on the cyber side of the house and these topics tie directly into what we discuss in this newsletter.

Quantum Flapdoodle of the Week

Not all quantum quackery comes in the form of multi-million dollar scams – some of it is peddled as cheap trinkets and wellness gadgets targeted at the general public. Lately, there’s been an uptick of products like “quantum energy” stickers for phones (claiming to block 5G or EMF radiation) and pendants or bracelets “infused with quantum resonance” to relieve pain or “harmonize your body’s frequency.” These products love to sprinkle real scientific terms like frequency, energy, quantum – but in a completely nonsensical context. For example, one vendor advertises “quantum jewelry” that will “optimize your health, protect from EMFs, manifest success, and evolve your energy” via bioresonance technology. Phrases like “powered by quantum technology” abound, but there’s no actual quantum mechanism at work – it’s technobabble dressed up to sound high-tech.

Let’s be very clear: no sticker, pendant, or bracelet can harness quantum physics to heal you or block cell signals. Zero. Zilch. There is no reputable scientific evidence that sticking a so-called quantum patch on your phone does anything except perhaps make your wallet lighter. Physicists and medical experts are unequivocal: these are at best placebo devices. And there’s a darker side – if people rely on them for protection (say, thinking a necklace will cure their ailments or shield them from radiation), they might neglect real medical treatments or safety measures, which is dangerous. In some cases, the “quantum” gimmick products have proven to be literally dangerous: certain negative-ion “quantum pendants” were found to contain radioactive material and emit low levels of ionizing radiation. (Yes, ironically the anti-5G pendants were mildly radioactive – you can’t make this stuff up!) Regulators have since banned those, but it shows how snake oil can sometimes bite back.

The bottom line is, slapping the word “quantum” on age-old snake oil doesn’t make it science – it makes it suspect. As quantum tech becomes more famous, marketers will keep abusing the buzzword. So, if you see a miracle gadget promising health, protection, or cosmic enlightenment based on “quantum” mumbo-jumbo, bring a healthy dose of skepticism. Save your money for real innovations (like a nice quantum computing textbook 😁) and enjoy the fact that knowledge is the best defense against this kind of flapdoodle.

New on PostQuantum.com – Company DB Updates & Due Diligence Guide

In website news, I’ve updated my database of quantum computing hardware companies and their roadmaps (2025 edition). This is a resource where you can filter and compare major players by modality, track record, etc., with summaries of their milestones and plans. This week I added several new companies to the list, including Silicon Quantum Computing (Australia), Quantum Motion (UK), and Photonic Inc. (Canada). These are startups pursuing silicon-based qubits (Silicon QC and Quantum Motion) and distributed photonic+spin architectures (Photonic Inc.), respectively. All three have interesting approaches (e.g. Silicon Quantum Computing is literally making atomic-scale silicon qubits using scanning tunneling microscopes; Quantum Motion is leveraging CMOS fabrication for spins; Photonic Inc. is networking small silicon spin processors with photonic links). With these additions, the database covers an even wider spectrum of the quantum landscape – now 30+ companies from superconducting to topological to neutral atoms. Feel free to explore it; I hope it’s useful for getting a snapshot of who’s doing what, and how close they are to the coveted fault-tolerant CRQC threshold.

I also wrote a timely piece on quantum computing due diligence – essentially a field guide for evaluating quantum startups, technologies, and claims. With so many companies touting breakthroughs (and now big funding rounds and SPACs in the mix), it’s important to be able to discern hype versus reality. In the article, I share my personal toolkit of questions and red flags when I assess a quantum company: from examining their error rates and roadmaps, to checking for independent validations, to judging whether they’re over-claiming about “revolutionary” physics. The goal is to avoid both extreme ends – neither dismiss real progress nor fall for hand-wavy mystique. I thought this was timely given the influx of new entrants and the marketing that inevitably accompanies investment. If you’re an investor, customer, or just an enthusiast who wants to sharpen your BS-detector in the quantum space, give it a read. It might save you from wasting money or time on something that sounds too good to be true (or conversely, help you spot a gem that others underrated).

That’s it for this week’s whirlwind tour! We covered a lot, from cutting-edge hardware launches and error-correction feats to policy moves and yes, even quantum-adjacent craziness. The quantum world is moving fast on all fronts.

Even if you don’t click the many links, I hope this gave you a sense of the momentum – and maybe a couple of chuckles (or eye-rolls) regarding the quackery.

As always, feel free to reach out with questions or topics you’d like to hear more about.

Until next time, stay curious and watch out for those “quantum” snake oil salesmen!

First, an apology and an explanation.

This newsletter is supposed to arrive in your inbox every Sunday morning with your coffee. I missed last Sunday. And here I am, breaking the pattern again – sending you a Thursday edition instead.

Here’s why: The quantum computing world just experienced another super exciting few days. Two announcements dropped back-to-back this week that generated a flood of questions from many of you, and I couldn’t in good conscience wait until Sunday to talk about them.

When Google claims its first “verifiable quantum advantage” and IonQ shatters world records for quantum gate accuracy in the same week, you don’t stick to the publishing schedule – you hit send.

So consider this your emergency broadcast from the quantum frontlines. The regular Sunday newsletter will resume this weekend, but what happened demands immediate attention. These breakthroughs impact the timeline to Q-Day (the moment quantum computers can crack our encryption), and if you’re responsible for your organization’s security posture, you need to understand what just changed.

Let’s dive in.

Google’s Willow: The First “Verifiable” Quantum Advantage

TL;DR: Google Quantum AI unveiled its Willow chip running a new algorithm called Quantum Echoes that achieved the first-ever verifiable quantum advantage – producing results in seconds that would take the world’s fastest supercomputer over 3 years per data point. Unlike Google’s controversial 2019 “quantum supremacy” claim, this one produces repeatable, checkable results that actually relate to real physics problems.

What Happened

On October 22nd, Google announced that its 105-qubit Willow superconducting processor ran an algorithm that no classical computer can feasibly match. The experiment used 65 qubits to probe quantum chaos through something called “out-of-time-order correlators” (OTOCs) – essentially quantum echo signals that reveal how information scrambles in quantum systems.

The headline number? Google’s Quantum Echoes algorithm ran approximately 13,000× faster than the best classical simulation on Frontier, one of the world’s most powerful supercomputers. Some individual measurements would take Frontier over 3 years to compute; Willow generated them in seconds.

But here’s what makes this different from the 2019 Sycamore “quantum supremacy” controversy: the results are verifiable and reproducible. Instead of sampling random bits with no way to check the answer, Quantum Echoes produces a stable, deterministic observable that can be cross-checked by running the experiment again. It’s a quantum computation you can actually verify – hence Google’s careful framing as “verifiable quantum advantage.”

Even more intriguing: Google didn’t just run a physics experiment. In collaboration with UC Berkeley, they applied the same technique to molecular structure determination via NMR spectroscopy. They simulated molecules with 15 and 28 atoms, matching laboratory NMR data while extracting structural information that traditional NMR alone can’t easily provide. It’s an early glimpse of quantum computers augmenting real chemistry and materials science workflows.

Why It Matters

This addresses the biggest criticism of quantum supremacy demos: “Sure, your quantum computer can do something classical computers can’t – but who cares if it’s a useless task?”

Quantum Echoes isn’t Shor’s algorithm, and it won’t balance anyone’s checkbook. But measuring OTOCs is actually valuable for Hamiltonian learning – figuring out the internal interactions of quantum systems like molecules or novel materials. Scientists care about this. It’s a step toward quantum computers doing things that matter in physics, chemistry, and drug discovery.

From a hardware perspective, running a 65-qubit algorithm with enough precision to get verifiable results shows that superconducting quantum processors are maturing. Willow achieved gate error rates around 0.1% or better – good enough to run complex circuits and see real quantum effects emerge above the noise.

The experiment also required collecting approximately one trillion measurements over the course of the project. That’s not a typo. It shows how demanding these experiments are, but also that Google’s hardware is stable enough to accumulate that much data without falling apart.

Q-Day Impact: Not Immediate, But Validated Progress

Let’s be clear: This doesn’t break encryption. This doesn’t run Shor’s algorithm. This doesn’t make Q-Day imminent.

However, it does validate that quantum computing is advancing along the roadmap toward cryptographically relevant machines. Google’s own roadmap lists milestones from basic quantum advantage (2019) through error-corrected qubits (2023) to eventually building large-scale error-corrected systems. Willow’s verifiable advantage is progress along that path.

The gap between “interesting physics experiment on 65 qubits” and “breaking RSA-2048 with a million error-corrected qubits” remains vast. Google’s team openly acknowledges that reaching a useful CRQC (Cryptographically Relevant Quantum Computer) will require “orders-of-magnitude improvement in system performance and scale, with millions of components to be developed and matured.”

But every time a quantum vendor delivers on a milestone – especially one involving verifiable results on real problems – it strengthens confidence that those future milestones are achievable. It’s not that Q-Day moved; it’s that we have another data point confirming early 2030s remains plausible.

My Deep dive: Google’s Quantum Advantage: What “Verifiable” Really Means and Why It Matters

IonQ’s Four-Nines Breakthrough: The Scaling Wall Just Crumbled

TL;DR: IonQ achieved >99.99% accuracy on two-qubit gates – crossing the long-awaited “four-nines” threshold – and did it without the slow cooling step that usually bottlenecks trapped-ion systems. This isn’t just a record; it’s a fundamental shift in how scalable quantum computers can be built.

What Happened

On October 21st (yes, the day before Google’s announcement), IonQ revealed that its team (including the recently acquired Oxford Ionics group) demonstrated two-qubit gate fidelity above 99.99% on trapped-ion hardware. That’s an error rate below 1 in 10,000 operations – a milestone the quantum computing community has been anticipating for years.

But the real breakthrough isn’t just the number. It’s how they achieved it.

Normally, trapped-ion quantum computers need to cool their ions to near-absolute-zero (ground-state cooling) before running operations – a time-consuming step that can dominate 98-99% of total runtime. IonQ’s new “smooth gate” technique bypasses this cooling requirement entirely while maintaining four-nines accuracy. They demonstrated error rates as low as 0.0084% per gate (0.000084 infidelity) across sequences of 432 two-qubit gates, and the gates remained accurate even when they deliberately heated the ions.

Think about what this means: You can run high-quality quantum operations without waiting for your quantum computer to cool down between steps. It’s like going from a high-performance race car that needs to cool its engine for an hour between laps to one that can run lap after lap at full speed.

The technical mechanism is elegant: instead of precisely timing strong laser pulses (the usual approach), IonQ’s “smooth gate” slowly ramps the gate’s frequency during operation. This adiabatic approach suppresses the motion-related errors that normally get worse when ions are warmer, meaning the system stays accurate at “normal” temperatures (well, normal for quantum computers – still a frosty 1 Kelvin, but 100× warmer than typical superconducting qubits).

Why It Matters: The Math Changes Everything

Moving from 99.9% to 99.99% fidelity isn’t a “10% improvement” – it’s a thousand-fold reduction in effective error rates once you stack quantum error correction.

Here’s the exponential reality: If you want to run a 1,000-gate quantum circuit, at 99% per-gate fidelity you’ll get a clean run only 0.004% of the time (about 1 in 23,000 attempts). Bump that to 99.9% and you get clean runs ~36.8% of the time. But at 99.99% fidelity, you get clean 1,000-gate circuits ~90.5% of the time.

In other words, four-nines moves you from toy-scale circuits to being able to run thousands of gates before error correction meaningfully kicks in. That’s the threshold where surface codes and other error-correction schemes become practical rather than theoretical.

Combined with eliminating the cooling bottleneck, IonQ just removed two major obstacles to scaling trapped-ion quantum computers: quality and speed. They can now run high-fidelity operations much faster than before, which means more gates per second and less time to complete complex quantum algorithms.

Q-Day Impact: The Timeline Just Got More Concrete

This is where things get real for cybersecurity and cryptography professionals.

Earlier this year, Craig Gidney’s updated analysis suggested that fewer than 1 million physical qubits could factor RSA-2048 in under a week using optimized error correction – down from the canonical “20 million qubits” estimate. That analysis assumed gate error rates around 0.1% (99.9% fidelity) and 1-microsecond cycle times.

IonQ just demonstrated 10× better fidelity than those assumptions. Higher fidelity means lower error-correction overhead, which means fewer physical qubits per logical qubit. While IonQ’s gates are slower than the 1-microsecond assumption (currently ~226 microseconds), eliminating cooling overhead could compensate by speeding up real-world circuit execution.

IonQ is openly messaging a roadmap to 256-qubit systems in 2026 and “millions of qubits by 2030” via their Electronic Qubit Control (EQC) approach. Many were skeptical of those timelines. This breakthrough lends them credibility.

So I ran the numbers through my Q-Day estimator with updated assumptions reflecting IonQ’s progress:

• Mid-case scenario (256 logical qubits, 10¹¹ operations budget, 10⁶ ops/sec, 2.3× yearly improvement): Crosses the CRQC threshold in approximately 2030

• Conservative scenario (slower scale-up): ~2033-2034

• Aggressive scenario (IonQ hits its roadmap targets): 2027-2028

Most likely, reality lands between conservative and mid-case. But even the conservative estimate puts a cryptographically relevant quantum computer within this decade.

Here’s the bottom line: A credible vendor just crossed a pivotal quality threshold in a way that also speeds up quantum operations. This is the kind of technical milestone that should trigger escalation from “quantum preparedness planning” to “active cryptographic migration.”

My Deep dive: IonQ Crosses Four-Nines: What It Means for Quantum Computing Timelines

What This Week Means: The Quantum Threat Timeline Just Solidified

It’s not every week (or even every year) that we see leaps like these in quantum computing. Two different milestones – one in computational ability (Google) and one in hardware performance (IonQ) – arrived practically back-to-back.

• Google showed that quantum computers can now perform verifiable, beyond-classical computations that relate to real scientific problems. It’s not just random circuit sampling anymore; it’s actual physics and chemistry where quantum hardware outperforms classical supercomputers in measurable, reproducible ways.

• IonQ demonstrated the quality and speed breakthroughs needed to make large-scale quantum computers practical. Four-nines fidelity without slow cooling removes two of the biggest obstacles to building million-qubit machines.

This speaks to the rapid momentum in the field. For those of us watching the quantum landscape, it’s a thrilling validation that the technology is progressing on multiple fronts: we’re solving harder problems and building better machines.

But it also underscores why staying on top of these developments is critical, especially for security and policy professionals. Quantum advantage experiments are inching from lab curiosities toward practical uses, and hardware improvements are shrinking the timeline to powerful, cryptography-breaking computers.

(Quick plug: This is exactly where my team at Applied Quantum can help.) If you’re unsure how these quantum advancements might impact your organization, or how to start preparing, reach out to us. We specialize in helping companies and government agencies navigate the quantum era – from quantum risk assessments and crypto-agility roadmaps to hands-on PQC migration and quantum security training. In short, we can help you turn quantum uncertainty into strategic advantage, and ensure you’re ready for whatever comes next.

Thank you for reading this special edition of the Quantum Observer newsletter. We’ll return to our regular Sunday schedule, but I couldn’t stay quiet on these exciting developments! Feel free to reply with your thoughts or questions – and as always, stay curious and stay prepared.

Subscribe now

In this edition: A Nobel Prize that honors the roots of today’s qubits, a spirited debate on HSBC & IBM’s quantum experiment, major business moves from Rigetti and Pasqal, new breakthroughs from labs that are literally heating up quantum computing, global policies accelerating readiness, and a new recurring section - Quantum Flapdoodle of the Week - to keep your baloney detector sharp.

If last month felt like quantum tech was sprinting, the past two weeks made it clear we’ve hit another gear. The 2025 Nobel Prize in Physics crowned the pioneers who turned quantum circuits into artificial atoms - the foundation of modern superconducting qubits.

At the same time, quantum business headlines multiplied, governments rolled out fresh readiness initiatives, and researchers dropped results that make the path to large-scale, fault-tolerant quantum systems look a bit shorter - and hotter.

Even the hype machine joined the action, from media overreacting to the HSBC-IBM experiment to the wild world of “quantum medbeds.”

Amid all this noise, one signal stands out: quantum has left the theoretical stage. It’s now an industry, a policy agenda, and - thanks to The Quantum Minute - apparently an award-winning podcast, too.

Nobel Prize in Physics 2025 goes to quantum (and the roots of today’s qubits)

TL;DR: The 2025 Nobel Prize in Physics went to the pioneers who proved that quantum effects can exist in macroscopic circuits - a discovery that paved the way for today’s superconducting qubits and the modern quantum computer.

The Royal Swedish Academy of Sciences awarded the 2025 Physics Nobel to John Clarke, Michel H. Devoret, and John M. Martinis “for the discovery of macroscopic quantum mechanical tunnelling and energy quantisation in an electric circuit.” In the 1980s-90s, their Josephson-junction and superconducting-circuit experiments showed that circuits you can hold in your hand behave like artificial atoms - tunnelling between quantized energy states - establishing the platform that later became today’s superconducting qubits (e.g., transmons) and readout methods. In short: they proved quantum weirdness scales up, and that insight underpins much of modern quantum computing, sensing, and measurement.

I wrote a brief reaction here: Quantum Tunnelling on a Chip: Why the 2025 Nobel Prize in Physics Matters for Quantum Tech. I also predicted this would be a “quantum year” - but didn’t guess the exact laureates - here: Predicting Quantum Computing Winning 2025 Nobel Physics Prize?

For background on the winners and their impact, see the Nobel press material and roundups.

A Different Take on the HSBC–IBM Experiment

TL;DR: HSBC and IBM’s bond-pricing experiment showed a surprising 34% boost from quantum noise - intriguing, but not “quantum advantage.” Scott Aaronson’s critique is a sharp reality-check against hype.

In the last newsletter I covered HSBC and IBM’s quantum finance experiment, where their team observed a 34% improvement in bond-pricing predictions using a hybrid quantum-classical model. As I noted then, neither HSBC nor IBM ever claimed “quantum advantage.” They simply ran a thoughtful experiment and, somewhat mysteriously, found that quantum noise seemed to help the model generalize better. I found that fascinating - not proof of advantage, but a hint of new physics-inspired behavior worth studying. If it sparks more research and investment in quantum finance, all the better.

Scott Aaronson, however, offered a sharply different view in his recent blog post. He argues that media headlines stretched a modest result into hype and that we should resist celebrating “advantage” claims until the mechanisms, and reproducibility, are rigorously proven. His perspective matters because Aaronson has long served as the field’s most credible reality-check between genuine progress and marketing spin. So you should check it out.

In truth, both views can coexist: experiments like HSBC-IBM’s show how curiosity and commercial exploration drive discovery, while voices like Aaronson’s remind us to keep the science disciplined. Quantum needs both the explorers and the skeptics - they’re what keep the field honest and moving forward.

The Business of Quantum: Commercial Signals Strengthen Across Finance and Industry

The quantum computing industry saw key signs of maturation over the past two weeks, from large sales to mainstream finance experiments. Rigetti Computing, for instance, announced $5.7 million in purchase orders for two on-premise quantum systems (9-qubit Novera processors) – a milestone that shifts quantum access from the cloud to the hands of more researchers.

In finance, quantum is increasingly on the agenda: at the Sibos 2025 banking conference, experts highlighted quantum’s emerging use cases in asset management and fraud detection while urging preparation for future encryption-breaking threats. Around the same time, IBM and Vanguard revealed a successful test of a 109-qubit quantum-classical workflow for portfolio optimization, hinting that hybrid quantum algorithms could accelerate complex financial computations in the near future.

Investors have taken note of these advances – quantum computing stocks have surged in recent weeks as breakthroughs move the tech “out of the lab and into the real world,” sparking bullish sentiment.

And in a transatlantic expansion, French startup Pasqal is investing $65 million to establish its first U.S. headquarters in Chicago, building a neutral-atom quantum computer at the new Illinois Quantum & Microelectronics Park and creating at least 50 jobs. Illinois’ governor hailed Pasqal’s move as “another major step forward” in the state’s quest to become a leading U.S. quantum hub.

All these developments signal that quantum computing’s momentum in the business world is stronger than ever.

Quantum Tech Breakthroughs: Scaling Faster, Running Hotter, Thinking Smarter

“Above 1 K Qubits” – 100× Higher Temperature Quantum Operation

TL;DR: EeroQ’s new electron-on-helium qubits work at 1.1 K - 100× hotter than typical superconducting qubits. By easing the extreme-cooling bottleneck, this breakthrough could make large-scale quantum computers far more practical - and potentially accelerate the road to Q-Day.

Quantum startup EeroQ has smashed the milli-Kelvin barrier in a new hardware breakthrough. In a paper published in Physical Review X, EeroQ’s team showed they can trap and control individual electron-based qubits on superfluid helium at 1.1 kelvin. That’s more than 100× hotter than the ~10 millikelvin temperatures at which superconducting qubits typically operate. Using on-chip microwave circuits, they detected single electrons dancing on a helium film, loading and moving them one by one while maintaining quantum coherence. This validates a long-standing theory: electrons on helium can serve as stable, long-lived qubits even at elevated temps. As EeroQ’s co-founder Johannes Pollanen put it, this “reduces a key barrier to scalable quantum computing” by showing qubits that work in a far less cryogenic environment.

Why it matters: Cooling is one of the toughest engineering challenges in quantum computing. Today’s quantum processors sit in expensive dilution refrigerators colder than outer space, and heat dissipation is a major limit on scaling up. EeroQ’s result suggests we can build qubits that run at 1 K or above, where cooling power is orders of magnitude higher and refrigeration is much easier. In practical terms, this could let quantum computers pack in many more qubits and even integrate some control electronics inside the fridge without overheating. By easing the cryogenic bottleneck, high-temperature electron-on-helium qubits might pave the way for larger, more practical quantum machines that don’t require a football-field of cooling infrastructure.

Q-Day impact: Potentially huge. A cryptographically relevant quantum computer (able to break RSA/ECC) will likely require millions of physical qubits – which is nearly impossible with today’s ultra-cold, delicate setups. If qubits can operate reliably at around 1 kelvin, scaling to massive qubit counts becomes much more feasible. That means the timeline to a true crypto-breaking quantum computer could speed up, since one key hurdle (extreme cooling requirements) might be overcome sooner than expected. In short, this “hot qubit” breakthrough brings the prospect of an at-scale quantum computer closer to reality, increasing urgency to move to quantum-safe encryption before Q-Day arrives.

My analysis: Above 1K Qubits

Original paper: Sensing and Control of Single Trapped Electrons above 1 K

“Quantum Lattice Attack Speedup” - SVP Exponent Shaved (~0.309→0.285)

TL;DR: Dutch researchers cut the quantum attack time on lattice cryptography’s core problem (SVP) from an exponent of 0.309 to 0.285 - an ~8% drop that translates to ~30–60 million x faster theoretical cracking for large lattices. PQC remains safe for now, but a reminder that smarter algorithms, not just bigger quantum machines, could still nudge Q-Day closer.

A team of researchers in the Netherlands has found a significant cryptanalytic improvement against lattice-based encryption – the class of schemes underpinning leading post-quantum algorithms like Kyber and Dilithium. The security of those schemes relies on the hardness of the Shortest Vector Problem (SVP) on high-dimensional lattices.

The best-known attacks use a technique called lattice sieving, which runs in exponential time 2c·d (c a constant, d = dimension). The new research accelerates the quantum version of 3‑tuple sieving by reducing its time constant from 0.3098 to 0.2846 (an ~8% drop). In concrete terms, for a large lattice of dimension 1000, that’s like cutting the attack time exponent from 309.8 to 284.6 - a massive speedup (on the order of 2²⁵–2²⁶ ≈ 30–60 million times faster for d=1000!).

They achieved this by using a two-level quantum amplitude amplification strategy focused on local “center points” in the lattice, which guides the search more efficiently. The trade-off is a memory cost of about 20.1887·d bits (QRAM) for the algorithm. Overall, this gives the fastest known quantum attack on SVP for a wide range of practical memory limits.

Why it matters: Any improvement in attacking the underlying hard problems of post-quantum cryptography (PQC) is big news. This result doesn’t break lattice cryptography outright – the runtime is still exponential – but it significantly lowers the bar for a quantum cryptanalyst. In essence, lattice-based schemes might need larger dimensions (and keys) to maintain the same security margin, because quantum attackers just got a theoretical speed boost. It’s also a striking reminder that progress in quantum computing isn’t only about hardware – better algorithms can suddenly make our classical assumptions much weaker. Cryptographers will be scrutinizing whether parameters for schemes like Kyber should be adjusted in light of these kinds of advances.

Q-Day impact: Marginal but not negligible. This attack is still exponential-time, so it doesn’t enable near-term decryption of lattice-encrypted data. However, any reduction in exponent is a meaningful shortening of the timeframe required for a quantum computer to crack cryptography. Today’s recommended lattice parameters stay secure, but if quantum algorithms keep improving (just as Craig Gidney’s 2025 paper slashed the qubit requirements for factoring RSA ), the “effective strength” of PQC can erode faster than expected. The takeaway: we must stay agile. Q-Day could arrive not just via new machines, but via smarter math. This latest speedup in lattice-cracking, while not a direct threat yet, underlines the importance of ongoing cryptanalysis and perhaps a healthy safety margin in our post-quantum standards.

My analysis: Quantum Sieving Breakthrough: Lattice Attack Exponent Slashed by 8%

Original paper: An Improved Quantum Algorithm for 3-Tuple Lattice Sieving

Ultrafast Squeezed Light Captures Quantum Uncertainty in Real Time

TL;DR: Scientists captured and controlled quantum uncertainty in real time using ultrafast squeezed light - watching noise shift between amplitude and phase on attosecond scales. It doesn’t speed up code-breaking, but it opens a new frontier in ultrafast quantum optics that could drive advances in quantum communication, sensing, and control.

Researchers demonstrated the first ultrafast squeezed-light pulses that let them measure and control quantum uncertainty on femto/attosecond timescales. Using a nonlinear optical setup (four-wave mixing in glass) and carefully phased laser pulses, they dynamically “dialed” noise between amplitude and phase - essentially watching the uncertainty ellipse evolve in real time - and even showed a petahertz-rate secure-communication demo based on the squeezed states.

Why it matters: Squeezed light has long improved precision sensing (e.g., LIGO), but doing it ultrafast turns a static quantum limit into a tunable resource. That opens a new lane - ultrafast quantum optics - with implications for high-bandwidth quantum comms, lower-noise metrology, and potentially faster quantum control techniques that piggyback on engineered quantum noise.

Q-Day impact: Not directly. But I still find it super interesting. This doesn’t make factoring or cryptanalysis faster. However, it could strengthen quantum communications and sensing ecosystems (and investment), indirectly accelerating quantum-tech maturity while reminding security teams that “quantum-secure” networking will also evolve quickly.

My analysis: Capturing Uncertainty

Original paper: Attosecond quantum uncertainty dynamics and ultrafast squeezed light for quantum communication

Policy & Readiness

Policymakers and standards bodies worldwide are stepping up quantum readiness efforts. In the U.S., California just enacted a law (Assembly Bill 940) to create the state’s first comprehensive quantum technology strategy by 2026 – making quantum tech a top economic priority and even committing $4 million to new quantum research funding.

Over in Europe, the telecom standards organization ETSI launched a new Quantum Technologies committee to develop standards for quantum communications and networks, supporting initiatives like the EuroQCI and Europe’s Quantum Act.

And the UK’s National Cyber Security Centre reopened its Post-Quantum Cryptography (PQC) pilot scheme, aiming to certify consulting firms that help businesses migrate to quantum-safe encryption – a move to ensure companies are prepared for large-scale PQC adoption.

Financial regulators are also gearing up for the quantum era. The UK Financial Conduct Authority (FCA) published a research note examining where quantum computing could impact financial services first and how firms should prepare, framing 2025 as a critical moment to engage early with the technology while managing risks.

Similarly in Singapore, the Monetary Authority of Singapore (MAS) – alongside DBS, HSBC, OCBC and UOB banks – completed a pioneering trial of quantum key distribution in banking networks. The newly released technical report shows QKD can successfully secure data links between financial institutions, but also highlights integration challenges (like the need for interoperability standards and secure relay nodes) before such quantum-safe tech can be rolled out broadly.

Together, these policy moves underscore a global push to proactively prepare for the coming quantum age.

Quantum Flapdoodle of the Week

Welcome to a new (and probably endless) series where we explore the stranger corners of the “quantum” universe - the bold, the bizarre, and the beautifully implausible. Because when “quantum” becomes the seasoning sprinkled on every half-baked idea or a scam, someone needs to taste-test the soup.

This week’s specimen: Quantum Medbeds - a supposedly miraculous healing device powered by quantum entanglement, photon resonance, and, depending on the sales pitch, divine frequency alignment. The claim: it can diagnose, treat, and regenerate your body by “reprogramming cells through quantum vibration.” The reality: it’s pure science fiction, wrapped in technobabble and sold as salvation.

As I wrote, there’s no physics, no data, and no actual “quantum” - just the same old pseudoscientific promises with shinier buzzwords.

But here’s the silver lining: each new wave of quantum nonsense gives us another reason to sharpen our baloney detectors (see the Quantum Baloney Detection Toolkit) - and to laugh about it with tools like the Quantum Technobabble Generator. Because sometimes the best way to debunk quantum snake oil is simply to out-absurd it.

New on PostQuantum.com

There’s a new post on PostQuantum.com at least weekly - research, analysis, or practical guidance on quantum readiness. But this week I’d like to highlight something different: the new Getting Started With Quantum Readiness page.

It’s designed as a structured guide for anyone beginning a quantum-safe journey. The page organizes key articles and tools by phase - from executive briefings and cryptographic inventory to risk prioritization, migration planning, and long-term operations. Think of it as a living roadmap: a place to orient yourself, follow the right sequence, and return to as your program evolves. Even if you’ve already started, it’s worth a look - it connects all the moving parts of quantum readiness into one clear path forward.

The page: Getting Started With Quantum Readiness

From the PostQuantum.com Archive

This week I’m launching a new section, “Quantum Flapdoodle of the Week,” to spotlight the more… imaginative corners of the quantum world.

To set the stage, it’s worth revisiting the Quantum Baloney Detection Toolkit - my tongue-in-cheek but practical guide to spotting pseudoscience dressed in qubits.

And if you’d rather laugh than rage, try the Quantum Technobabble Generator, which churns out perfectly plausible-sounding nonsense for your amusement. Because while quantum hype isn’t going away anytime soon, a good sense of humor (and a sharp BS detector) keeps us all a little saner.

The article: Quantum Baloney Detection Toolkit

AI Nonsense Generator: Quantum Technobabble Generator

🎙 Applied Quantum’s The Quantum Minute wins “Best Podcast Series of 2025”

Big win: our micro-briefing, The Quantum Minute, was named Best Podcast Series of 2025 by Cybercrime Magazine’s awards program. For a quantum-focused show to top a cybersecurity media slate says a lot about where the industry’s attention is headed: quantum risk, readiness, and opportunity are now mainstream security topics - not niche science.

Why it matters: Recognition from a leading cyber outlet validates the editorial mission behind The Quantum Minute - fast, accurate signal on breakthroughs, policy, and PQC that security leaders can actually use. It also marks the growing convergence of quantum tech and enterprise security.

Read my thoughts about this on PostQuantum: The Quantum Minute Wins Best Podcast Series of 2025 – and What That Really Means for Cybersecurity

Catch up & subscribe: Quantum Minute On The Cybercrime Radio Podcast

That’s a wrap for another remarkable stretch in quantum tech - a week when Nobel committees, investors, researchers, and regulators all seemed to align on one message: quantum is real, relevant, and accelerating.

From foundational recognition in Stockholm to policy moves in California, from “hot” qubits in Michigan to corporate trials in New York and Singapore, the field is advancing faster and more coherently than ever before. And while hype will always trail behind progress (and occasionally lap it), it’s clear that quantum technology is no longer a future to anticipate - it’s a present to manage.

Stay curious, stay skeptical, and stay quantum-ready.

Subscribe now

This week has been one for the quantum history books. On a single day (Sept 25), a cascade of breakthroughs had me literally jumping out of my seat! From governments issuing calls to action, to standards bodies pushing out new guidelines, to jaw-dropping leaps in quantum hardware and algorithms - the developments came fast and furious.

It’s the perfect week to re-launch this weekly newsletter, which will now hit your inbox every weekend, distilling the biggest quantum tech news. And what a relaunch:

• Government & industry leaders are shouting “the time to move on post-quantum security is NOW,” backed by new White House priorities, international guidance, and fresh standards (NIST, etc.).

• Meanwhile, quantum researchers delivered not incremental improvements but giant leaps: a startup achieved in 2025 more than what they thought might happen in 2030, a university scaled qubit arrays by 5× to 6× overnight, a new algorithmic method sped up error-corrected computing by 50×, and a photonic experiment slashed a learning task from 20 million years to 15 minutes. Even in finance, HSBC and IBM showed a 34% performance boost from quantum - an unheard-of gain in an industry where even 3.4% would turn heads. (Four breakthroughs in just this one week have a potential impact on the Q-Day arrival!).

In short, this week’s news wasn’t business-as-usual - it was more like quantum technology hitting the turbo boost.

Strap in as I break it down by category below! Each item highlights what happened, why it matters, and whether it brings us closer to “Q-Day” - the day quantum computers can crack our encryption.

Enjoy the deep dive!

Quantum Tech Breakthroughs: Giant Leaps, Not Baby Steps

“Transversal Algorithmic Fault Tolerance” - 10×-100× Speedup in Quantum Error Correction

Harvard, Yale and QuEra researchers unveiled a new framework called Transversal Algorithmic Fault Tolerance (AFT) that massively reduces the time overhead of error-corrected quantum computation.

In essence, their approach uses clever transversal gates and one-round error syndrome extraction to correct errors “on the fly” at the algorithm level rather than doing many slow cycles after each gate.

The result? They project 10× to 100× faster execution of algorithms on a fully error-corrected quantum computer. For example, applying AFT to Shor’s algorithm showed that factoring a 2048-bit RSA number could theoretically drop from months to 5.6 days on a future million-qubit machine - about 50× faster than prior estimates.

Why it matters: This is a big deal because even if we have enough qubits, the time to run algorithms was another barrier (imagine a code-breaking run taking months - still impractical). AFT tackles that by slashing the runtime penalty of error correction (they only do 1 syndrome round vs d rounds per operation). It’s a fundamentally new way to run quantum circuits more efficiently.

Q-Day impact: Absolutely yes. By cutting the time (with the same qubit count), the threshold for a cryptographically relevant quantum computer comes much closer. One could break RSA in under a week instead of several months - meaning the moment a million-qubit machine exists, it’s immediately a serious threat, not a slow science project. As my analysis concluded, this breakthrough could move up Q-Day and certainly ups the urgency for deploying quantum-safe encryption.

My analysis: New Paper Alert: “Low‑Overhead Transversal Fault Tolerance for Universal Quantum Computation”

Original paper: Low-overhead transversal fault tolerance for universal quantum computation

Caltech’s 6,100-Qubit Neutral Atom Array - Largest Ever

Caltech physicists blew past previous records by creating an array of 6,100 neutral-atom qubits held in optical tweezers. (The prior state-of-art in neutral atoms was on the order of a few hundred qubits.)

They achieved this by splitting a laser into 12,000 traps to hold cesium atoms, ending up with 6,100 occupied sites. Crucially, even at this scale each qubit stayed coherent (superposition) for ~13 seconds and single-qubit operations reached 99.98% accuracy - maintaining quality at quantity. They could even shuttle atoms around within the array without losing coherence.

Why it matters: This is the largest quantum register ever assembled by a huge margin (≈5-6× bigger than previous). It demonstrates neutral-atom platforms can combine high qubit counts with high fidelity, a combo needed for error correction on thousands of qubits. As one researcher put it, “quantity and quality” together. This paves the way toward thousands of physical qubits being manipulated for, say, a surface code.

Q-Day impact: Yes, potentially - we’ll likely need a million of physical qubits for breaking RSA, but jumping from ~1k to 6k in one go is a dramatic step toward that regime. It suggests that with neutral atoms, scaling isn’t the bottleneck some feared. If such leaps continue (and error correction is implemented on these thousands), a cryptographically relevant quantum computer comes into view sooner.

My analysis: Caltech’s 6,100-Qubit Optical Tweezer Array: A Quantum Leap in Scale and Coherence

Original paper: A tweezer array with 6100 highly coherent atomic qubits

Alice & Bob’s 1-Hour “Cat Qubit” - Fault-Tolerance Ahead of Schedule

Quantum startup Alice & Bob achieved a stunner - their novel superconducting “cat qubit” remained stable (no bit-flip errors) for about one hour (!!!) That’s a new world record for any superconducting qubit, obliterating the previous ~7-minute coherence record from last year. In fact, they only expected to hit ~13 minutes by 2030, but hit 60 minutes now!

Why it matters: An hour-long coherence means error rates millions of times lower than usual. In practical terms, error correction overhead could drop from needing thousands of physical qubits per logical qubit to maybe just tens. Alice & Bob themselves note this could make their machines “hundreds of times more hardware-efficient” - think quantum computers that might fit in a room instead of a warehouse. It basically fast-tracks the timeline for a fault-tolerant quantum computer.

Q-Day impact: Definitely yes - by reducing errors, a future code-breaking quantum computer would require far fewer qubits than previously feared. As my analysis notes, this breakthrough could accelerate Q-Day, since a stable, error-corrected quantum machine now looks closer at hand.

My analysis: Alice & Bob’s One-Hour”Cat Qubit” Breakthrough – What It Means for Quantum Computing and Q-Day

Original blog post: Just Out of the Lab: A Cat Qubit That Jumps Every Hour

Silicon Spin Qubits Hit 99%+ Fidelity in a 300 mm Chip Fab

A research team from Diraq (Australia) and imec (Belgium) showed that silicon-based spin qubits can be fabricated using standard 300 mm semiconductor manufacturing - and achieve better than 99% gate fidelity on every operation.

They made four two-qubit test chips on one wafer, all with error rates <1% for both single- and two-qubit gates. Even state prep and measurement were 99.9%. This basically proves you can mass-produce quantum chips in a regular CMOS fab with quality high enough for error correction.

Why it matters: Scalability, scalability, scalability! Unlike exotic qubit tech that needs handmade devices, these qubits piggyback on industry-standard processes - think “Intel Inside” for quantum. It opens a path to millions of qubits by leveraging existing chip factories. Also, hitting the 99% fidelity threshold means these qubits are at the brink of being usable for fault-tolerant logic (they’re approaching surface-code error thresholds).

Q-Day impact: Absolutely yes - as my analysis puts it, every hurdle overcome (like scalable fab and high fidelity) shortens the road to a crypto-breaking quantum computer. If we can build large arrays of qubits using silicon fabs, the “engineering challenge” of Q-Day becomes much easier. This result suggests the timeline to a large-scale quantum machine is contracting.

My analysis: Silicon Spin Qubits Achieve >99% Fidelity in 300‑mm Foundry Fabrication

Original paper: Industry-compatible silicon spin-qubit unit cells exceeding 99% fidelity

Quantum Learning Advantage - 15 Minutes vs 20 Million Years

In an incredible experiment, researchers from DTU (Denmark) and collaborators demonstrated a provable quantum advantage in a machine learning task using a photonic quantum setup.

By entangling light and using a special optical measurement scheme, they learned the “noise pattern” of a system in just 15 minutes, whereas the best classical approach would take an estimated 20 million years!

This result, published in Science, is dubbed “Quantum learning advantage on a scalable photonic platform.” It’s the first-ever quantum advantage shown for a photonic system.

Why it matters: This isn’t a mere supremacy demo on a contrived math problem - it’s a practical learning task (noise characterization) with clear implications for sensing and engineering. It shows quantum entanglement can extract information exponentially faster than classical methods in certain scenarios. It’s also done with fairly straightforward optical tech, suggesting such advantages might be implementable in real-world sensing devices.

Q-Day impact: Not directly - this experiment doesn’t factor numbers or break encryption, and it doesn’t make our general-purpose quantum computers more powerful overnight. So it likely doesn’t move the Q-Day timeline. However, it proves quantum systems can vastly outperform classical for real tasks, which will only spur more investment and interest in quantum tech broadly. (In other words, it’s a morale boost for the field.) The techniques here might even inspire new quantum algorithms.

My analysis: Researchers Demonstrate Quantum Entanglement Can Slash a 20-Million-Year Learning Task Down to Minutes

Original paper: Quantum learning advantage on a scalable photonic platform

HSBC & IBM’s 34% Quantum Boost in Trading - First Financial Quantum Boost

Banking giant HSBC, working with IBM, announced the first-ever quantum-enabled improvement in live financial trading analytics. In a bond trading pilot, they used a hybrid quantum-classical algorithm to predict fill rates for bond orders, and it delivered up to a 34% improvement in accuracy over the best classical method. (Traders, pick your jaws off the floor - a 34% edge is enormous in markets!) This was run on IBM’s Quantum systems (the Heron processors), generating quantum-derived features that improved a machine learning model.

Why it matters: It’s tangible proof of quantum computing’s commercial value - not in some distant future, but today. Financial firms have been cautiously watching quantum; now HSBC has shown it can confer a real competitive edge (better pricing predictions = better trading outcomes). This could trigger a domino effect of banks investing in quantum tech. It’s also a milestone for quantum machine learning in a real dataset with business impact.

Q-Day impact: No direct impact on the timeline for breaking encryption - this was about optimization/prediction, not cryptography. So it doesn’t make quantum computers more dangerous to RSA, etc., in any immediate sense. However, by validating the utility of quantum computing, it likely accelerates industry investment into bigger and better quantum computers. And more investment + competition does indirectly hasten the arrival of more powerful devices (including those that could be turned to cryptanalysis). So one could argue it indirectly inches up the pace. But for now, Q-Day isn’t nearer because of this - what’s nearer is the day your financial firm starts using quantum for an edge.

My analysis: HSBC and IBM’s Quantum-Enabled Bond Trading Breakthrough

Original paper (preprint): Enhanced fill probability estimates in institutional algorithmic bond trading using statistical learning algorithms with quantum computers

Press release: HSBC demonstrates world’s first-known quantum-enabled algorithmic trading with IBM

Policy & Readiness: Calls to Get Post-Quantum Ready Now

White House Puts Quantum at Top of FY2027 R&D Priorities

In a new FY27 budget memo, the U.S. administration put quantum science and tech front-and-center alongside AI. Agencies are directed to prioritize quantum R&D, from fundamental science to applied engineering, to ensure American leadership. This shows Washington isn’t treating quantum as sci-fi - it’s a strategic national focus (think “Space Race” vibes, but for qubits).

Why it matters: More federal support means faster progress in quantum computing and post-quantum cryptography.

Q-Day impact: Indirectly yes - boosting quantum research could accelerate breakthroughs that eventually produce encryption-cracking machines.

My analysis: White House FY2027 R&D Memo Puts Quantum Technologies Front and Center

Original memo: M-25-34 I NSTM-2

Australian Government (ACSC) Post-Quantum Plan - “Start Now, Finish by 2030”

Australia’s cyber security agency (ACSC) issued updated guidance titled “Planning for Post-Quantum Cryptography”, warning that cryptographically relevant quantum computers (CRQCs) are coming and could break RSA/ECC. They urge all organizations to begin migrating to PQC immediately, setting milestones: have a transition plan by 2026, begin implementing by 2028, and complete the shift by 2030. The subtext: don’t procrastinate or assume “quantum threats are far-off” - the quantum clock is ticking.

Why it matters: This adds to a global chorus (U.S. NIST, U.K. NCSC, etc.) saying quantum readiness and crypto-agility are now a must, not a maybe.

Q-Day impact: The guidance doesn’t make Q-Day arrive sooner, but it greatly reduces impact - if followed, our data will be safe before quantum hackers arrive.

My analysis: ACSC’s Post-Quantum Plan: Start Now, Plan for Longer Execution

Original guidance: Planning for post-quantum cryptography

FS-ISAC’s Global Call to Coordinate PQC Migration

The Financial Services Information Sharing and Analysis Center (FS-ISAC), a global banking cybersecurity consortium, released a major white paper urging the financial sector worldwide to synchronize their post-quantum migration timelines. It lays out a global transition roadmap with clear milestones and emphasizes the risk of “crypto-procrastination” (delaying until it’s too late). Notably, this paper was co-developed with banks and orgs across US, EU, and Canada - showing a united front.

Why it matters: Finance is arguably the industry most at risk from Q-Day, and if banks coordinate, they can pressure vendors, regulators, and everyone in the supply chain to get quantum-safe. This is basically the financial world saying “We refuse to be caught off-guard by quantum”.

Q-Day impact: Again, doesn’t hasten Q-Day itself, but if banks follow through, a “Q-Day” would be a non-event for them (no broken trades or stolen funds).

My analysis: FS-ISAC’s New Roadmap for Post-Quantum Migration in Finance

Original paper: The Timeline for Post Quantum Cryptographic Migration

Press release: FS-ISAC Urges Global Coordination for Migration to Post-Quantum Cryptography in Financial Services

NIST’s New Standards & Frameworks for PQC

This week NIST dropped two big deliverables in its post-quantum cryptography program. First, NIST Special Publication 800-227 - a finalized standard with recommendations for using Key-Encapsulation Mechanisms (KEMs) in practice. This document is essentially a “how-to” for deploying PQC key exchange, complementing the new algorithms with guidance on implementation, key management, and integration. It ensures that as we roll out lattice-based KEMs (like Kyber’s variant standardized as ML-KEM), we do it right.

Second, NIST released CSWP 48 (Initial Draft), a white paper mapping out how to incorporate PQC migration into the well-known NIST Cybersecurity Framework and NIST controls. This helps organizations slot “crypto-inventory, agility and migration” activities into their existing risk management processes.

Why it matters: These publications give very concrete guidance - moving PQC from theory to real-world deployment checklists. It’s no longer just “pick an algorithm,” but “here’s how you execute a migration.”

Q-Day impact: While standards don’t accelerate the advent of Q-Day, they significantly mitigate its threat - NIST is making sure that by the time a quantum computer can crack crypto, everyone has had both the tools and instructions to switch over.

My analysis of SP 800-227: NIST Releases NIST SP 800-227 Recommendations for Key-Encapsulation Mechanisms

NIST publication: NIST SP 800-227 - Recommendations for Key-Encapsulation Mechanisms

My analysis of CSWP 48 IPD: NIST Releases NIST CSWP 48 IPD – Mapping of Migration to PQC Project to NIST CSF 2.0

NIST publication: NIST CSWP 48 ipd - Mappings of Migration to PQC Project Capabilities to NIST Cybersecurity Framework 2.0 and to Security and Privacy Controls for Information Systems and Organizations

New on PostQuantum.com

This week’s new article from my blog offers an in-depth look at what a full-scale quantum readiness program really entails. Using a large telecom as a case study, it illustrates how preparing for quantum threats is a decade-long marathon touching every layer of technology and operations – far more than a simple “patch”. The telco’s journey illustrated here is meant as a template for any big enterprise starting its post-quantum migration.

The article delivers practical insight into the phases, challenges, and immense scale of becoming quantum-safe, reinforcing that every organization (not just telcos) should be charting this course.

The article: Quantum-Readiness / PQC Full Program Description (Telecom Example)

From the PostQuantum.com Archive

This piece from PostQuantum.com archives is a practical guide for CISOs on how to assemble a quantum readiness team from skills most organizations already have. Instead of hunting for rare quantum cryptographers, it shows how to map existing expertise - cryptography engineers, PKI/HSM specialists, network and application security staff, compliance and vendor management teams - into a coordinated program for post-quantum migration.

The article outlines the key domains (from cryptographic inventory to governance, testing, and data management) and explains who in the enterprise can own each function, and how to upskill them where needed.

The takeaway: the talent to get quantum-ready is likely already in-house - CISOs just need to mobilize it into a structured, crypto-agility playbook.

The article: The Skill Stack a CISO Needs for Crypto‑Agility and Quantum Readiness

That’s a wrap for this breathtaking week! Governments are pressing the accelerator on quantum readiness, and researchers are smashing expectations in quantum computing capability. The message is loud and clear: quantum technology is advancing on all fronts - faster than predicted.

As I restart this newsletter, I couldn’t have asked for a more exhilarating set of stories to cover. Stay tuned for next week’s update - if it’s even a fraction as eventful as this one, you won’t want to miss it. Quantum on!