Draft, not yet released. In stewardship review. Not indexed until the first approved release.

Exponential Technology Report 2026: Cybersecurity and Advanced Cryptography

The first annual edition of the cybersecurity and cryptography report. It fixes the 2026 reference state of cybersecurity and advanced cryptography as infrastructure, and the model, voice and positions, against which the 2027 edition will be read.

Read the executive summaryStart with chapter 1Cite this report
Editor
Saeed Valadbaygi
Desk
GCRI Systems Evidence
Publisher of record
GCRI for the Nexus Consortium
Evidence close
30 September 2026
Status
Draft in stewardship review; not yet released
ReportsXT-10

Exponential Technology

Cybersecurity and Advanced Cryptography 2026

Baseline Edition 2026NR-XTECH-CRYPTO-GLOBAL-2026-BASELINEGCRI for the Nexus Consortium
Findings12each with its status and source
Sources44numbered, editor first
Chapters and annexes11plus the executive summary
Indicators17in the data appendix, with CSV and JSON

01 · Status

Status and boundaries.

This edition governs nothing and confers no certification. It records where the global evidence stood at the 2026 baseline. Every value resolves to its source or to its stated method; where neither exists, the edition says so instead of filling the gap.

Publication ID
NR-XTECH-CRYPTO-GLOBAL-2026-BASELINE-v1.0.0
Series alias
NR-XTC-XT-10-2026-BL
Identifier status
Series alias and evidence cut are provisional until the owner confirms them. No UNI is minted.
Family · class
Exponential Technology Report XT-10 · Baseline Edition (inaugural annual)
Lifecycle state
Exponential Technology Report XT-10 · Baseline Edition (inaugural annual)
Publication date
October 2026
Evidence close
30 September 2026 · cut DC-XTECH-CRYPTO-GLOBAL-2026-B0
Reproducibility
sourced values cited; analytical values reproducible from stated parameters
Access class
PUBLIC-SAFE DERIVATIVE
Review
five passes scheduled before release (in Annex C)
Designed for
strategic planning · technology-risk screening · readiness discussion · research · public communication
Not for
government assessment · official warning · rating · certification · investment advice · underwriting · procurement · operational authorisation
Registry
record NR-XTECH-CRYPTO-GLOBAL-2026-BASELINE · current-version pointer at release
Corrections
registry correction pathway · history in Annex C
Cybersecurity and Cryptography use
disclosed in Annex C
Next edition
NR-XTECH-CRYPTO-GLOBAL-2027-v1.0.0 · 2027 annual
Licence
text CC BY 4.0 · data on the terms of each source
Desk identifier
Collection

02 · Key messages

What the edition finds.

Five of the questions the edition answers, each with its status. The executive summary has all of them, with their sources.

  1. Three NIST standards were finalised in August 2024; HQC is a backup selected in March 2025.

    Are post-quantum standards ready?Reported

  2. The UK NCSC says 2035; the NIST IR 8547 draft of November 2024 proposes disallowing quantum-vulnerable algorithms after 2035.

    When must migration finish?Reported

  3. Vendor and open-source evidence shows wide deployment of hybrid key agreement.

    Is key agreement moving?Reported

  4. Slower. Post-quantum signatures add size, and broad certificate trust is not expected before 2027.

    Are signatures moving?Reported

  5. A 2025 estimate: under a million noisy qubits in under a week, under stated assumptions.

    How many qubits would break RSA-2048?Reported

All key messages and the headline finding

03 · Contents

Eight chapters and three annexes.

  1. ·

    Executive summary

    The edition on a few pages: the abstract, the key messages, the headline finding and what each steward reads in it.

  2. 1

    Chapter 1. Cryptography is infrastructure under change

    Part I describes systems and their couplings.

  3. 2

    Chapter 2. Key findings

    Twelve findings carry the cybersecurity and cryptography baseline.

  4. 3

    Chapter 3. Systems and sectors at baseline

  5. 4

    Chapter 4. Risks and capability

    Four cybersecurity and cryptography risk objects open the portfolio.

  6. 5

    Chapter 5. Signature lag while key agreement migrates

    A conditional statement under stated assumptions, never a prediction.

  7. 6

    Chapter 6. Readings from the other desks

    The cybersecurity and cryptography baseline is read through each steward’s lens, then once as a whole.

  8. 7

    Chapter 7. The 2027 agenda

    Eight bounded questions open the 2027 cybersecurity and cryptography agenda.

  9. 8

    Chapter 8. Systems in depth

    One section per system: its state at evidence close, its exposures and what the operational series will watch.

  10. A

    Annex A. Methodology

    How the edition was made: methods, the model card, the evidence cut and its age, the acceptance record and the glossary.

  11. B

    Annex B. Data appendix

    The indicator set with its sources, the source registers, the licences of every kind of material and the formats of the edition.

  12. C

    Annex C. References and record

    Every source the edition rests on, the publication record, the corrections log and the open record.

List of figures (4)
  1. S.1Standards finalised on 13 August 2024
  2. 1.1How large are ransomware payments on-chain? USD million
  3. 1.2Couplings between the five systems
  4. 2.1Standards finalised on 13 August 2024
List of tables (45)
  1. 1.1Coupling matrix: from the row system to the column system
  2. 3.1Each domain read in words, not scored
  3. 3.2Sectors: baseline evidence and the exposure to watch
  4. 4.1Capabilities on the ladder of evidence: listed, exists, demonstrated, tested
  5. 6.1The quarterly rhythm every edition follows
  6. 6.2Who contributes what each quarter
  7. 6.32027 cybersecurity and cryptography readiness pack
  8. 6.4Standards and regulatory watch
  9. 6.5Peer-reviewed science and preprints
  10. 6.6Institutional flagships
  11. 6.7Standards, policy and strategies
  12. 6.8Threat, cost and field overviews
  13. 7.1Objects proposed for the first operational quarter
  14. 7.2Universe 2027: evidence pack for the cybersecurity and cryptography candidate mission
  15. 7.3Handoffs and routing
  16. 7.4Routing rules by publication class
  17. 7.5Feeds watched from 2027
  18. 7.6Signals at baseline
  19. 8.1State at baseline
  20. 8.2State at baseline
  21. 8.3State at baseline
  22. 8.4State at baseline
  23. 8.5State at baseline
  24. A.1Methods
  25. A.2Coupling strength scale (matrix and model card)
  26. A.3Status grammar
  27. A.4From the baseline cut to the federation cut
  28. A.5Evidence age and coverage
  29. A.6Coverage by system at baseline
  30. A.7Designed empty states: what is not bound, what would fill it and why
  31. A.8Quality dimensions at baseline
  32. A.9Publication acceptance record
  33. A.10The status every value carries
  34. A.11Series terms
  35. A.12Abbreviations used in this edition
  36. A.13Technical annex
  37. B.1Global baseline indicator set
  38. B.2Global baseline indicator set
  39. B.3Global source register
  40. B.4Regional reading, cybersecurity and cryptography across ten clusters
  41. B.5How countries appear in the cybersecurity and cryptography edition
  42. B.6National Baseline Editions in the 2026 programme
  43. B.7Licences of each kind of material
  44. B.8This edition in every format
  45. C.1Release path for this version

04 · GCRI reading

How GCRI reads this edition.

The evidence supports reading cybersecurity and cryptography as protective infrastructure under change. Standards are finalised, key agreement has moved, and signatures and long-life devices have not. Evidence is strongest for standards and official threat records, and weakest for migration progress, cost and workforce.

CRY-001 · GOV-004 · INF-005 · SYS-012

Chapter 6, lenses and readings

05 · Publication record

Version, dates and contributors.

The identity of this edition as its title pages record it. A review copy has no DOI; the DOI is issued at deposit.

Publication ID
NR-XTECH-CRYPTO-GLOBAL-2026-BASELINE-v1.0.0
Version
1.0.0, review copy
Edition date
Evidence close
Status
Draft under stewardship review; not yet released
Editor
Saeed Valadbaygi
Publisher of record
The Global Centre for Risk and Innovation (GCRI)
Licence of the text
CC BY 4.0
DOI
Issued at deposit, on release
Previous edition
none: first edition of the series
Next edition
NR-XTECH-CRYPTO-GLOBAL-2027-v1.0.0

Contributors

RoleContributionBy
ConceptualisationSeries architecture and the cybersecurity and cryptography modelS. Valadbaygi (ed.)
MethodologyBaseline method, dependency scoring and status grammarReports editorial team, GCRI
Investigation · data curationSource review of cybersecurity and cryptography releases, statistics and the peer-reviewed literature to evidence closeReports editorial team, GCRI
Writing, original draftAll chapters; cybersecurity and cryptography-assisted drafting, disclosed belowEditor · editorial team
Writing, review and editingFive review passes before releaseSteward reviewers (scheduled)
VisualisationPages, figures and tables in the Nexus design standardReports editorial team, GCRI
SupervisionEdition governance, registry record and depositS. Valadbaygi (ed.)

Review before release

PassScopeByState
1Scientific and technicalGCRI · key TScheduled
2Reproducibility of analytical valuesGCRI · key TScheduled
3Public meaning and claimsThe Global Risks Forum (GRF) · key MScheduled
4Finance-readiness boundaryThe Global Risks Alliance (GRA) · key FScheduled
5Regional context, safeguards and dual useRegional consortia · key NScheduled

Cybersecurity and Cryptography assistance was used for drafting, consistency checks and page composition. Every number, citation and status label was checked against its source by the editorial team before freeze. No cybersecurity and cryptography system is recorded as an author or a reviewer, and no cybersecurity and cryptography output is printed as fact without a source.

06 · Downloads

Read it in print, take the data.

FormatWhat it isStateGet it
Complete edition, print or PDFA4 or Letter, chosen in the print dialog: cover, contents, every chapter and annex, endnotes and running heads Review copyOpen for print
Indicators, CSV17 indicators with unit, year, status and source On this pageDownload
Indicators, JSONThe same indicators with the edition’s identity and licence On this pageDownload
Findings, CSV12 findings with status, evidence-quality level and references On this pageDownload
Citation, BibTeXFor LaTeX and reference managers On this pageDownload
Citation, RISFor Zotero, EndNote and Mendeley On this pageDownload
PDF, A4 and US LetterPrinted from the edition pack in the Reports print design, with the publication ID, the evidence cut and the pack hash in its metadata; signed with its DOI at release At releaseNot yet issued
Data packageEvery table of the edition as CSV and JSON, with the citation files (CSL-JSON, BibTeX, RIS), built with the site With the editionAnnex B, data

The print and the files are produced from the same edition pack as the web pages, so they always agree. Until release they are review copies.

07 · Cite

Cite this report.

This edition is a draft in stewardship review. Cite it as a draft; the DOI and the UNI are issued at deposit, and the citation then names them.
Catalogue keyNR-XTECH-CRYPTO-GLOBAL-2026-BASELINE

Standards applied to NR-XTECH-CRYPTO-GLOBAL-2026-BASELINE

Cite as

S. Valadbaygi (ed.), Exponential Technology Report 2026: Cybersecurity and Advanced Cryptography. Reports, Baseline Edition 2026. The Global Centre for Risk and Innovation (GCRI) for the Nexus Consortium, Toronto, 2026. NR-XTECH-CRYPTO-GLOBAL-2026-BASELINE. DOI at deposit.

Applied

NS-1 catalogue identity (a UNI is allocated at deposit and resolves to this record), NS-2 citation and attribution, NS-3b dataset metadata, NS-5 figures and maps, NS-12 software and AI disclosure.

Monitoring

Corrections are new versions with a published notice; the earlier version stays resolvable.

An attestation is evidence, not a certificate. Nexus Standards parts are preparatory working drafts (2026).

APA 7
Valadbaygi, S. (Ed.). (2026). Exponential Technology Report 2026: Cybersecurity and Advanced Cryptography (Baseline Edition 2026, Report No. NR-XTECH-CRYPTO-GLOBAL-2026-BASELINE) [Draft under review]. The Global Centre for Risk and Innovation (GCRI). https://therisk.global/nexus-reports/editions/xt-10/
Chicago
Valadbaygi, Saeed, ed. Exponential Technology Report 2026: Cybersecurity and Advanced Cryptography. Baseline Edition 2026. Nexus Reports NR-XTECH-CRYPTO-GLOBAL-2026-BASELINE. Draft under review. Toronto: The Global Centre for Risk and Innovation (GCRI), 2026. https://therisk.global/nexus-reports/editions/xt-10/.
BibTeX
@techreport{NR-XTECH-CRYPTO-GLOBAL-2026-BASELINE,
  editor      = {Valadbaygi, Saeed},
  title       = {{Exponential Technology Report 2026: Cybersecurity and Advanced Cryptography}},
  institution = {The Global Centre for Risk and Innovation (GCRI)},
  address     = {Toronto},
  year        = {2026},
  type        = {Nexus Reports, Baseline Edition 2026},
  number      = {NR-XTECH-CRYPTO-GLOBAL-2026-BASELINE},
  note        = {Draft under stewardship review; not yet released. DOI assigned at deposit},
  url         = {https://therisk.global/nexus-reports/editions/xt-10/}
}
RIS
TY  - RPRT
ED  - Valadbaygi, Saeed
TI  - Exponential Technology Report 2026: Cybersecurity and Advanced Cryptography
T3  - Nexus Reports
ET  - Baseline Edition 2026
PY  - 2026
PB  - The Global Centre for Risk and Innovation (GCRI)
CY  - Toronto
SN  - NR-XTECH-CRYPTO-GLOBAL-2026-BASELINE
UR  - https://therisk.global/nexus-reports/editions/xt-10/
N1  - Draft under stewardship review; not yet released. DOI assigned at deposit.
LA  - en
ER  -
NR-CIT-1 (house style)
S. Valadbaygi (ed.), Exponential Technology Report 2026: Cybersecurity and Advanced Cryptography. Nexus Reports, Baseline Edition 2026. The Global Centre for Risk and Innovation (GCRI) for the Nexus Consortium, Toronto, 2026. NR-XTECH-CRYPTO-GLOBAL-2026-BASELINE. DOI at deposit.
ReportsContribute

Send evidence or a correction on Cybersecurity and Advanced Cryptography.

Reports is the Consortium’s quarterly publication, written by six desks. This page sits with the GCRI Systems Evidence desk. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work. Sent to the wrong desk, it is forwarded, not refused.

GCRI Systems Evidence deskExponential Technology

Never send personal data, sensitive infrastructure detail or anything you have no right to share. A contribution is reviewed before use; sending it confers no authorship or editorial rights, and sponsorship never buys a finding.

Reports · GCRI

Bring evidence to the next edition.

Every quarter closes on a sealed evidence cut. A correction, a source or a method received before the cut is reviewed for that edition.

ContributeCorrections log
  • NR-XTECH-CRYPTO-GLOBAL-2026-BASELINE
  • CC BY 4.0
  • Evidence close 30 September 2026

CC BY 4.0 Free to read. Text and figures: CC BY 4.0. Data: CC0 1.0. Authors keep copyright. Published by GCRI Canada.

The Global Centre for Risk and Innovation

Science · evidence · measurement

Not for profit

Our articles, maps and twins are free to read and free to republish. Readers and partners keep it that way.

Partner with us

Who funds us

GCRI is a not-for-profit institution. To ask who funds a piece of work, use the funding questions form.

Independence

Editors and the expert reviewers named on each article decide what we publish. Funders and partners do not review or approve articles before publication.

Corrections policy

Licence

Articles: CC BY 4.0. Figures, maps, twins and data: CC BY 4.0. Other uses: ask through the permissions form.

Privacy choices