Draft, not yet released. In stewardship review. Not indexed until the first approved release.

Key findings

Twelve findings carry the cybersecurity and cryptography baseline. They are grouped by coupling and never ranked. Each resolves to its source or, where Nexus analysis is involved, to its stated method.

6 min read1 figure0 tables18 notesNR-XTECH-CRYPTO-GLOBAL-2026-BASELINE

Contents
  1. ·Edition home
  2. ·Executive summary
  3. 1Cryptography is infrastructure under change
  4. 2Key findings
    1. 2.1 Headline finding
    2. 2.2 CRY
    3. 2.3 Governance
    4. 2.4 Infrastructure
    5. 2.5 THR
    6. 2.6 Finance
    7. 2.7 SKL
    8. 2.8 Systemic
  5. 3Systems and sectors at baseline
  6. 4Risks and capability
  7. 5Signature lag while key agreement migrates
  8. 6Readings from the other desks
  9. 7The 2027 agenda
  10. 8Systems in depth
  11. AMethodology
  12. BData appendix
  13. CReferences and record
  14. ·Complete edition, for print

2.1Headline finding

ReportedEQL 5NRF-XTECH-CRYPTO-GLOBAL-2026-BASELINE-CRY-001

NIST finalised three post-quantum cryptography standards on 13 August 2024: FIPS 203 (ML-KEM), FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA).

Figure 2.1Standards finalised on 13 August 2024
ItemBar, scaled to the largest valueValue
FIPS 203 · key establishment (ML-KEM)1
FIPS 204 · signatures (ML-DSA)1
FIPS 205 · backup signatures (SLH-DSA)1

Source: NIST publication pages for FIPS 203, 204 and 205123. Each bar counts one standard.

Implication

Standards exist, so migration is now an engineering and planning task. NIST added HQC as a backup key-encapsulation method on a different mathematical basis, with a final standard expected in 20276. Guidance on using key encapsulation was published in September 20257. The NIST transition draft IR 8547, published on 12 November 2024, proposes disallowing quantum-vulnerable public-key algorithms after 203544.

What would move it

The HQC draft, sector migration progress and national directives would each move this finding.

2.2CRY

  1. ReportedEQL 5NRF-XTECH-CRYPTO-GLOBAL-2026-BASELINE-CRY-001

    NIST finalised FIPS 203 (ML-KEM), FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA) on 13 August 2024. ML-KEM has three parameter sets: 512, 768 and 1024.123

  2. ReportedEQL 4NRF-XTECH-CRYPTO-GLOBAL-2026-BASELINE-CRY-002

    NIST selected HQC on 11 March 2025 as a backup key-encapsulation method based on codes rather than lattices, with a draft standard expected in about a year and a final standard in 2027.632

  3. ReportedEQL 4NRF-XTECH-CRYPTO-GLOBAL-2026-BASELINE-CRY-007

    A 2025 preprint estimates that RSA-2048 could be factored with fewer than one million noisy qubits in under a week, assuming a 0.1% gate error and a 1 microsecond cycle. The author’s 2019 estimate was about 20 million qubits in 8 hours.2237

2.3Governance

  1. ReportedEQL 4NRF-XTECH-CRYPTO-GLOBAL-2026-BASELINE-GOV-003

    NIST published the initial public draft of the transition report IR 8547 on 12 November 2024. The draft proposes that quantum-vulnerable public-key algorithms at 112 bits of security be deprecated after 2030 and that all such algorithms be disallowed after 2035.44

  2. ReportedEQL 4NRF-XTECH-CRYPTO-GLOBAL-2026-BASELINE-GOV-004

    The UK NCSC published migration timelines on 20 March 2025: assess and plan by 2028, do priority migration by 2031 and finish by 2035.10

2.4Infrastructure

  1. ReportedEQL 2NRF-XTECH-CRYPTO-GLOBAL-2026-BASELINE-INF-005

    Cloudflare reported that most human traffic to its network used post-quantum key agreement in late October 2025, while 3.7% of origin servers supported it and an ML-DSA-44 signature adds about 15 kB to a TLS handshake. This is vendor evidence.23

  2. ReportedEQL 3NRF-XTECH-CRYPTO-GLOBAL-2026-BASELINE-INF-006

    OpenSSH made a post-quantum key exchange its default in version 9.0 and switched the default to mlkem768x25519 in version 10.0. Version 10.1 warns when a connection does not use one.24

2.5THR

  1. ReportedEQL 3NRF-XTECH-CRYPTO-GLOBAL-2026-BASELINE-THR-008

    The CISA KEV count at the 30 September close is not bound. A 3 November read of the catalogue is post-close, context only. A 2025 joint advisory from 23 agencies in 13 countries reported router compromise through known vulnerabilities and no observed zero-day exploitation. A vendor report states that 31% of breaches began with exploited vulnerabilities.1417

  2. ReportedEQL 4NRF-XTECH-CRYPTO-GLOBAL-2026-BASELINE-THR-009

    The FBI received 859,532 complaints and USD 16.6 billion of reported losses in 2024, up 33% from 2023. It received 3,156 ransomware complaints and called ransomware the most pervasive threat to critical infrastructure.15

2.6Finance

  1. ReportedEQL 2NRF-XTECH-CRYPTO-GLOBAL-2026-BASELINE-FIN-010

    Chainalysis estimates that ransomware actors received more than USD 820 million on-chain in 2025, about 8% below an updated USD 892 million for 2024. IBM puts the global average cost of a data breach at USD 4.99 million in 2026. Both are vendor estimates.1819

2.7SKL

  1. ReportedEQL 3NRF-XTECH-CRYPTO-GLOBAL-2026-BASELINE-SKL-011

    In the ISC2 2025 study, 59% of respondents reported critical or significant skills needs, up from 44% in 2024. ISC2 published no workforce gap estimate in 2025.20

2.8Systemic

  1. Expert inputEQL 2NRF-XTECH-CRYPTO-GLOBAL-2026-BASELINE-SYS-012

    The leading compound pathway for 2027 testing is the lag of signatures, certificates and long-life devices behind key agreement, while exploited ordinary vulnerabilities keep dominating incidents. § scenario

Notes

Numbers are the edition’s reference numbers, so a note reads the same in every chapter. The full list, with every source and its licence, is in Annex C. Annex C, references

  1. 1NIST (ed.), Module-Lattice-Based Key-Encapsulation Mechanism Standard, FIPS 203 (publication page; final 13 August 2024; ML-KEM-512, ML-KEM-768 and ML-KEM-1024; initial draft 24 August 2023). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03.back
  2. 2NIST (ed.), Module-Lattice-Based Digital Signature Standard, FIPS 204 (publication page; final 13 August 2024; ML-DSA). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03.back
  3. 3NIST (ed.), Stateless Hash-Based Digital Signature Standard, FIPS 205 (publication page; final 13 August 2024; SLH-DSA, based on SPHINCS+). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03.back
  4. 6NIST (ed.), NIST selects HQC as fifth algorithm for post-quantum encryption (news item, 11 March 2025; backup to ML-KEM; draft standard expected in about a year; final standard expected in 2027). National Institute of Standards and Technology, Gaithersburg. Observation year 2025. Accessed 2026-11-03.back
  5. 7NIST (ed.), Recommendations for Key-Encapsulation Mechanisms, SP 800-227 (publication page; final 18 September 2025). National Institute of Standards and Technology, Gaithersburg. Observation year 2025. Accessed 2026-11-03.back
  6. 44NIST (ed.), Transition to Post-Quantum Cryptography Standards, NIST IR 8547, initial public draft (draft PDF, November 2024; Tables 2 and 4: for quantum-vulnerable signature and key-establishment schemes at 112 bits of security strength, deprecated after 2030 and disallowed after 2035, and at 128 bits or more, disallowed after 2035; the cover sheet added on withdrawal on 27 October 2026 is not used). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03.back
  7. 32UNVERIFIED, not opened: NIST (ed.), Status Report on the Fourth Round of the NIST Post-Quantum Cryptography Standardization Process, NIST IR 8545, March 2025, cited from memory. National Institute of Standards and Technology, Gaithersburg. Observation year 2025. Accessed 2026-11-03.back
  8. 22Gidney, C., How to factor 2048 bit RSA integers with less than a million noisy qubits, arXiv:2505.15917, submitted 21 May 2025 (abstract page; under one million noisy qubits; under a week; 0.1% gate error; 1 microsecond cycle; 10 microsecond reaction time; the author’s 2019 estimate was about 20 million qubits in 8 hours). arXiv, Ithaca. Observation year 2025. Accessed 2026-11-03.back
  9. 37UNVERIFIED, not opened: Shor, P.W., Polynomial-time algorithms for prime factorization and discrete logarithms on a quantum computer, SIAM Journal on Computing 26(5), 1484 to 1509, 1997, cited from memory. Observation year 1997. Accessed 2026-11-03.back
  10. 10UK National Cyber Security Centre (ed.), Timelines for migration to post-quantum cryptography (guidance page; version 1.0, 20 March 2025; milestones 2028, 2031 and 2035). NCSC, London. Observation year 2025. Accessed 2026-11-03.back
  11. 23Cloudflare (ed.), The state of the post-quantum Internet in 2025 (blog analysis; late October 2025 majority of human traffic with post-quantum key agreement; 3.7% of origins; 39% of top 100,000 domains in September 2025; ML-DSA-44 about 15 kB; first post-quantum certificates expected in 2026). Cloudflare, San Francisco. Vendor analysis of its own network, weak evidence. Observation year 2025. Accessed 2026-11-03.back
  12. 24OpenSSH project (ed.), Post-quantum cryptography in OpenSSH (documentation page; sntrup761x25519-sha512 from 9.0; mlkem768x25519-sha256 added in 9.9 and default in 10.0; warning from 10.1). OpenBSD Project. Observation year 2025. Accessed 2026-11-03.back
  13. 14CISA and 22 partner agencies (eds.), Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System, advisory AA25-239A (published 27 August 2025; revised 3 September 2025; 23 agencies from 13 countries; known vulnerabilities; no zero-day exploitation observed). Cybersecurity and Infrastructure Security Agency, Arlington. Observation year 2025. Accessed 2026-11-03.back
  14. 17Verizon (ed.), 2026 Data Breach Investigations Report (landing page; period 1 November 2024 to 31 October 2025; 48% of breaches involve ransomware; 31% begin with exploited vulnerabilities). Verizon Business, New York. Vendor report, weak evidence; the full report was not opened. Observation year 2025. Accessed 2026-11-03.back
  15. 15Federal Bureau of Investigation, Internet Crime Complaint Center (ed.), 2024 Internet Crime Report (859,532 complaints; USD 16.6 billion losses, up 33%; 256,256 complaints with a loss; 3,156 ransomware complaints; 263,455 cyber-threat complaints and USD 1.571 billion; 4,878 critical-infrastructure complaints). FBI, Washington. Observation year 2024. Accessed 2026-11-03.back
  16. 18IBM and Ponemon Institute (eds.), Cost of a Data Breach Report 2026 (landing page; global average USD 4.99 million, up 12%; AI-driven attacks up 56%). IBM, Armonk. Vendor report, weak evidence; the full report was not opened. Observation year 2026. Accessed 2026-11-03.back
  17. 19Chainalysis (ed.), ransomware analysis (blog page; more than USD 820 million on-chain in 2025, down 8% from an updated USD 892 million for 2024; original 2024 estimate USD 813 million). Chainalysis, New York. Vendor estimate, weak evidence. Observation year 2025. Accessed 2026-11-03.back
  18. 20ISC2 (ed.), 2025 Cybersecurity Workforce Study (page; published 4 December 2025; 16,029 respondents; 59% critical or significant skills needs, up from 44%; no workforce gap estimate). ISC2, Alexandria. Observation year 2025. Accessed 2026-11-03.back

Cite this chapter

Valadbaygi, S. (Ed.). (2026). Chapter 2: Key findings. In Exponential Technology Report 2026: Cybersecurity and Advanced Cryptography (Baseline Edition 2026, Report No. NR-XTECH-CRYPTO-GLOBAL-2026-BASELINE) [Draft under review]. The Global Centre for Risk and Innovation (GCRI).

Every citation form of the whole report, BibTeX and RIS included, is on the edition home. Cite this report

ReportsContribute

Send evidence or a correction on Cybersecurity and Advanced Cryptography.

Reports is the Consortium’s quarterly publication, written by six desks. This page sits with the Global Centre for Risk and Innovation (GCRI) Systems Evidence desk. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work. Sent to the wrong desk, it is forwarded, not refused.

GCRI Systems Evidence deskExponential Technology

Never send personal data, sensitive infrastructure detail or anything you have no right to share. A contribution is reviewed before use; sending it confers no authorship or editorial rights, and sponsorship never buys a finding.

CC BY 4.0 Free to read. Text and figures: CC BY 4.0. Data: CC0 1.0. Authors keep copyright. Published by GCRI Canada.

The Global Centre for Risk and Innovation

Science · evidence · measurement

Not for profit

Our articles, maps and twins are free to read and free to republish. Readers and partners keep it that way.

Partner with us

Who funds us

GCRI is a not-for-profit institution. To ask who funds a piece of work, use the funding questions form.

Independence

Editors and the expert reviewers named on each article decide what we publish. Funders and partners do not review or approve articles before publication.

Corrections policy

Licence

Articles: CC BY 4.0. Figures, maps, twins and data: CC BY 4.0. Other uses: ask through the permissions form.

Privacy choices