In March 2026, Google’s security team announced that by 2029 it will have completed its post-quantum cryptography (PQC) migration. The US National Security Agency’s CNSA 2.0 suite treats 2030 as the meaningful horizon for national security systems. Since then, those dates have become the de facto industry clock. Procurement teams cite them, consultancies build roadmaps around them, and endless vendors use them to create urgency in the sales cycle.
I just don’t believe those dates are the product of engineering, scientific or even industry consensus. They are risk-management choices made by particular organisations with specific incentives and treating them as a hard deadline for the whole economy is pushing companies towards rushed, badly tested migrations that introduce more near-term risk than they remove.
So, what do the actual experts think?
If you want the closest thing this field has to a consensus view, it isn’t found in a hyperscaler’s blog post. It’s the Global Risk Institute’s Quantum Threat Timeline Report, an annual expert-elicitation survey now in its seventh year, led by Dr Michele Mosca and Dr Marco Piani of evolutionQ.
The 2025 edition surveyed 26 international specialists across academia and industry and asked them to estimate the probability of a cryptographically relevant quantum computer (CRQC), one capable of breaking RSA-2048 or equivalent, existing within the given timeframes.
The experts weighed in and provided the average estimates for a CRQC within 10 years ranged from 28-49%. That’s the highest this figure has been in the survey’s history, and it’s still comfortably under a coin flip. Roughly half the respondents put the 10-year probability at 50% or higher. The other half didn’t. Stretch the window to 15 years and a clear majority (69%) cross the 50% threshold. Stretch it even further to 20 years and the field converges on something close to consensus (92% rate it 50% or above).
That’s not a group of experts telling you 2029 is when this happens. They’re saying that the likelihood of a CRQC existing by roughly 2035 is still a matter of genuine, significant disagreement among the people who study this for a living.
Compare that to the official deadlines already on the table:
- The UK’s NCSC has organisations completing discovery by 2028 and full migration by 2035
- The EU’s coordinated roadmap runs to 2030 for critical infrastructure and 2035 for everything else
No one serious in the policy world is actually converging on 2029. Google is.
None of this dismisses the real threat of “harvest now, decrypt later.” Data intercepted and stored today can be decrypted retroactively once a CRQC exists, so anything with a confidentiality requirement extending past 2035 is already exposed, even under the more conservative estimates.
That’s not a genuine argument for treating one hyperscaler’s internal risk tolerance as the industry’s operating deadline.
Rushing has already produced real vulnerabilities, not hypothetical ones
One part of this argument that I feel is often overlooked is that many organisations are racing to deploy today’s post-quantum standards, which carries its own, immediate, measurable risk. Those standards are still young. They’re imperfectly implemented, and the people writing the reference code are still actively debugging.
Let’s take KyberSlash for instance, a pair of timing vulnerabilities discovered in implementations of Kyber (now standardised as ML-KEM), including the official reference code maintained by the algorithm’s own designers.
The bug exploited secret-dependent division timings on certain processors, letting an attacker infer key material through careful timing analysis. In December 2023, it was patched in the reference repository, formally documented in a June 2024 paper, and a follow-up paper, with a working exploit, won the Best Paper award at CHES 2025.
More than a year passed between the first patch and the cryptographic community fully understanding what had shipped, in the reference implementation every government roadmap now recommends.
If the world’s leading PQC cryptographers can ship an exploitable side channel in the code everyone else copies, what makes anyone confident that enterprise IT teams, under pressure to hit an artificial 2029 deadline, will implement ML-KEM and ML-DSA correctly on the first attempt, across every TLS stack, VPN appliance and HSM in their estate?
The same logic applies to hybrid deployments. Which, let’s be honest, most guidance (including mine, in earlier pieces on this exact subject) recommends as the sensible transitional architecture.
Hybrid schemes combine a classical algorithm with a post-quantum one, so a flaw in either doesn’t break the connection. But a system that supports ML-KEM while still permitting a classical-only handshake is one negotiation away from exactly where it started.
A downgrade attack renders the “quantum safe” label meaningless. A checkbox that says “ML-KEM: enabled” tells you nothing about whether the implementation enforces it. Rushed deployments, built to satisfy a deadline rather than tested against adversarial negotiation, are exactly where this kind of gap shows up.
The market is already voting with its feet, and it’s voting for caution, not panic
If the 2029 narrative genuinely reflected engineering consensus, deployment numbers would be rising sharply as the date approaches. They aren’t.
DigiCert’s Quantum Readiness Outlook, based on a July 2026 survey of 1,001 IT and security decision makers across the US, UK and Australia, found that while 87% or organisations report they’re planning, testing or implementing PQC initiatives. Only 7% have more than half of their digital certificates on quantum-safe or hybrid cryptography. That’s up from just 5% a year earlier, a two-point increase in a year that included both the US’s Executive Order 14412 and Google’s headline-grabbing 2029 announcement. If those events were driving real urgency, the deployment number would have moved more than that.
Separate research from Axiad, surveying security leaders on the gap between confidence and readiness, found 67% consider PQC an active organisation priority. However, 46% couldn’t identify a single person responsible for leading their PQC migration, and 51% had never formally tested their public-facing infrastructure for post-quantum key exchange.
As Axiad’s CEO David Canellos put it: “PQC readiness cannot be based on what an organisation believes it has under control. It has to be based on what it can actually see, verify and act on.”
I read that data a bit differently to most of the commentary around it. It isn’t just evidence of organisational failure, but also that, perhaps unconsciously, most security leaders already believe the real deadline is further out than 2029. If they genuinely believed a CRQC was three years away, a 7% deployment rate wouldn’t be a mildly disappointing survey statistic. It would be institutional negligence.
So, what does this actually mean for your migration plan?
This is certainly not an argument for inaction. In fact, it’s an argument for pacing your migration to the actual shape of the risk, rather than to whichever vendor or hyperscaler shouts the earliest date.
In practice, that means three things:
- Prioritise by data longevity, not by calendar year. Anything that needs to stay confidential past 2035 should be moving to hybrid cryptography now, regardless of what any single company’s roadmap says.
- Treat your first-generation PQC implementations as exactly that: first-generation, likely to have undiscovered flaws like KyberSlash, and worth testing rather than deploying and forgetting.
- Be honest that a downgrade-capable hybrid deployment is not the same thing as a secure one. Test the negotiation path, not just the presence of the algorithm.
The quantum threat is real enough to justify serious, well-resourced preparation. It is not so imminent, on the best available expert evidence, that it justifies treating 2029 as gospel and shipping whatever gets you there fastest.