Draft, not yet released. In stewardship review. Not indexed until the first approved release.

The 2027 agenda

Eight bounded questions open the 2027 cybersecurity and cryptography agenda. Each comes from a baseline finding, names the initiative that will carry it and the first output due in the 2027 cybersecurity and cryptography edition.

5 min read0 figures6 tables3 notesNR-XTECH-CRYPTO-GLOBAL-2026-BASELINE

Contents
  1. ·Edition home
  2. ·Executive summary
  3. 1Cryptography is infrastructure under change
  4. 2Key findings
  5. 3Systems and sectors at baseline
  6. 4Risks and capability
  7. 5Signature lag while key agreement migrates
  8. 6Readings from the other desks
  9. 7The 2027 agenda
    1. 7.1 Questions for the operational series
    2. 7.2 Portfolio proposed for the Q1 2027 alignment
    3. 7.3 The pathway
    4. 7.4 Universe 2027: evidence pack for the cybersecurity and cryptography candidate mission
    5. 7.5 Handoffs and routing
    6. 7.6 Feeds and signal register
  10. 8Systems in depth
  11. AMethodology
  12. BData appendix
  13. CReferences and record
  14. ·Complete edition, for print

7.1Questions for the operational series

  1. C-01

    How far has each sector inventoried its cryptography, and how fast is migration to post-quantum methods in each sector?

    INI-XT10-INV-01 · inventory and migration; first output: sector migration register.

  2. C-02

    How many certificates and signatures in deployed systems can move to post-quantum methods, and at what size and cost?

    INI-XT10-SIG-02 · signatures and certificates; first output: deployment table.

  3. C-03

    What share of embedded and long-life devices can receive cryptographic updates?

    INI-XT10-EDG-03 · long-life devices; first output: device update map.

  4. C-04

    How long do exploited vulnerabilities stay open, and how does that compare across sources?

    INI-XT10-KEV-04 · exploitation and patching; first output: time-to-fix series.

  5. C-05

    How can migration progress be measured on a common basis?

    INI-XT10-MSR-05 · migration measurement; first output: indicator table.

  6. C-06

    Which national roadmaps set migration dates, and how do they differ?

    To be admitted in 2027; first output: roadmap overlay.

  7. C-07

    What workforce exists for cryptographic migration and incident response?

    To be admitted in 2027; first output: scoping note.

  8. C-08

    Which readiness capabilities have been tested in real migrations, and which are only planned?

    Readiness capability register; first output: rung evidence for 15 functions.

7.2Portfolio proposed for the Q1 2027 alignment

Five initiatives and one Universe mission candidate are proposed for the 2027 cybersecurity and cryptography portfolio. They are programme objects: no partner, funder or member is attached to them in this edition.

Table 7.1Objects proposed for the first operational quarter
IDObjectKindQuestionState
INI-XT10-INV-01Inventory and migrationInitiativeC-01PROPOSED
INI-XT10-SIG-02Signatures and certificatesInitiativeC-02PROPOSED
INI-XT10-EDG-03Long-life devicesInitiativeC-03PROPOSED
INI-XT10-KEV-04Exploitation and patchingInitiativeC-04PROPOSED
INI-XT10-MSR-05Migration measurementInitiativeC-05PROPOSED
MSN-XT10-2027-01Signature lag Universe missionMissionC-02Candidate

7.3The pathway

The cybersecurity and cryptography edition reads national readiness chapters, the coupled sector reports on cyber and digital systems, and the global edition through one governed evidence graph. At baseline the federation is designed; the global energy and lifeline editions are drafted. This page states what exists today and what comes next.

  1. 01

    National readiness chapters

    cyber and cryptographic readiness in each national edition

    IN PREPARATION · national baselines

  2. 02

    Sector couplings

    GS-13 cyber and digital · XT-02 quantum · SR-10 systemic cyber risk

    GS-13 DRAFTED · sector baselines

  3. 03

    Technology system model

    cryptography, deployment, threat, workforce, governance

    v0 SPECIFIED · v1 with federation evidence

  4. 04

    Strategic links

    SR-02 lifeline systems · SR-13 strategic technology

    PLANNED · strategic baselines

  5. 05

    Universe

    annual proving environment

    CANDIDATE MISSION · mandate in 2027

  6. 06

    XT-10 report

    this series

    BASELINE DRAFT · 2027 annual edition

  7. 07

    Evidence and correction

    one graph, many projections

    OPEN · first correction cycle in 2027

7.4Universe 2027: evidence pack for the cybersecurity and cryptography candidate mission

  1. 01

    Mandate

  2. 02

    Core Build · 1 month

  3. 03

    Action · 1 week

  4. 04

    Evidence seal

  5. 05

    Portfolio correction

  6. 06

    Next mandate

Table 7.2Universe 2027: evidence pack for the cybersecurity and cryptography candidate mission
ItemRecordStateTiming
F1Annual mandate recordPLANNEDafter the Q2 2027 alignment
F2Core Build recordPLANNEDone month before the exercise
F3Exercise evidencePLANNEDduring the Action week
F4Decision packetsPLANNEDexercise state only
F5Proof receiptsPLANNEDscoped to each recorded check
F6After-action reportPLANNEDwithin one quarter
F7Upgrade docketPLANNEDrouted to the Portfolio
F8Portfolio renewalPLANNED2027 global annual edition
F9Public synthesisPLANNEDpublic-safe extracts only

Mission

ID
MSN-XT10-2027-01 · Signature lag Universe mission
Role spine
Leadership sponsor · Institutional anchor · Mission lead: drawn from national pathways
Receiving actors
to be identified with the mandate

7.5Handoffs and routing

Where the baseline’s findings go next. A handoff routes a finding for awareness, review or work; it transfers no authority.

Table 7.3Handoffs and routing
FindingRouted toPurposeClass
CRY-001 · standardsINI-XT10-INV-01inventory and migrationPUBLIC
CRY-002 · HQC backupINI-XT10-INV-01inventory and migrationPUBLIC
GOV-004 · NCSC timelinesregional consortiaroadmap overlayPUBLIC
INF-005 · deploymentINI-XT10-SIG-02signatures and certificatesPUBLIC
INF-006 · protocol defaultsINI-XT10-EDG-03long-life devicesPUBLIC
THR-008 · exploitationINI-XT10-KEV-04exploitation and patchingPUBLIC
FIN-010 · costINI-XT10-MSR-05migration measurementPUBLIC
SYS-012 · compound pathwayMSN-XT10-2027-01Universe candidateCONSORTIUM
Table 7.4Routing rules by publication class
ClassWhere it goesWho can see it
PUBLICthe published edition and its evidence bundleanyone
CONSORTIUMgoverned rooms of the federationconsortium members under agreement
CONTROLLEDneed-to-know channelsnamed competent actors only

7.6Feeds and signal register

Table 7.5Feeds watched from 2027
FeedProducerLatencyFeeds into
NIST post-quantum project pagesNISTper releaseCRY-001
NCSC guidance pagesUK NCSCper releaseGOV-004
CISA KEV catalogue and advisoriesCISAcontinuousTHR-008
FBI IC3 annual reportFBIannualTHR-009
ENISA threat landscapeENISAannualTHR-008
Network and project deployment notesvendors and open-source projectsper eventINF-005
Breach cost and payment reportsvendorsannualFIN-010

Escalation routes

  • none · keep monitoring
  • research question
  • project
  • risk object
  • annual publication
  • signal report
Table 7.6Signals at baseline
IDSignalCorroborationSystemsRoute
SIG-XT10-001NIST IR 8547 draft proposes 2030 and 2035 transition dates44PARTIALDAT · GOVresearch question C-01
SIG-XT10-002Hybrid key agreement on most human traffic to one network23PARTIALINFresearch question C-02
SIG-XT10-003Ransomware payments fell about 8% in 202519PARTIALFIN · INFresearch question C-04

Notes

Numbers are the edition’s reference numbers, so a note reads the same in every chapter. The full list, with every source and its licence, is in Annex C. Annex C, references

  1. 44NIST (ed.), Transition to Post-Quantum Cryptography Standards, NIST IR 8547, initial public draft (draft PDF, November 2024; Tables 2 and 4: for quantum-vulnerable signature and key-establishment schemes at 112 bits of security strength, deprecated after 2030 and disallowed after 2035, and at 128 bits or more, disallowed after 2035; the cover sheet added on withdrawal on 27 October 2026 is not used). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03.back
  2. 23Cloudflare (ed.), The state of the post-quantum Internet in 2025 (blog analysis; late October 2025 majority of human traffic with post-quantum key agreement; 3.7% of origins; 39% of top 100,000 domains in September 2025; ML-DSA-44 about 15 kB; first post-quantum certificates expected in 2026). Cloudflare, San Francisco. Vendor analysis of its own network, weak evidence. Observation year 2025. Accessed 2026-11-03.back
  3. 19Chainalysis (ed.), ransomware analysis (blog page; more than USD 820 million on-chain in 2025, down 8% from an updated USD 892 million for 2024; original 2024 estimate USD 813 million). Chainalysis, New York. Vendor estimate, weak evidence. Observation year 2025. Accessed 2026-11-03.back

Cite this chapter

Valadbaygi, S. (Ed.). (2026). Chapter 7: The 2027 agenda. In Exponential Technology Report 2026: Cybersecurity and Advanced Cryptography (Baseline Edition 2026, Report No. NR-XTECH-CRYPTO-GLOBAL-2026-BASELINE) [Draft under review]. The Global Centre for Risk and Innovation (GCRI).

Every citation form of the whole report, BibTeX and RIS included, is on the edition home. Cite this report

ReportsContribute

Send evidence or a correction on Cybersecurity and Advanced Cryptography.

Reports is the Consortium’s quarterly publication, written by six desks. This page sits with the Global Centre for Risk and Innovation (GCRI) Systems Evidence desk. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work. Sent to the wrong desk, it is forwarded, not refused.

GCRI Systems Evidence deskExponential Technology

Never send personal data, sensitive infrastructure detail or anything you have no right to share. A contribution is reviewed before use; sending it confers no authorship or editorial rights, and sponsorship never buys a finding.

CC BY 4.0 Free to read. Text and figures: CC BY 4.0. Data: CC0 1.0. Authors keep copyright. Published by GCRI Canada.

The Global Centre for Risk and Innovation

Science · evidence · measurement

Not for profit

Our articles, maps and twins are free to read and free to republish. Readers and partners keep it that way.

Partner with us

Who funds us

GCRI is a not-for-profit institution. To ask who funds a piece of work, use the funding questions form.

Independence

Editors and the expert reviewers named on each article decide what we publish. Funders and partners do not review or approve articles before publication.

Corrections policy

Licence

Articles: CC BY 4.0. Figures, maps, twins and data: CC BY 4.0. Other uses: ask through the permissions form.

Privacy choices