Exponential Technology Report 2026: Cybersecurity and Advanced Cryptography

S.1Abstract

S.2Key messages

Six readings that frame the cybersecurity and cryptography baseline, and the eight questions this edition answers, each with its status and source.

1. Three NIST standards were finalised in August 2024; HQC is a backup selected in March 2025.¹⁶

   Are post-quantum standards ready?Reported

2. The UK NCSC says 2035; the NIST IR 8547 draft of November 2024 proposes disallowing quantum-vulnerable algorithms after 2035.¹⁰⁴⁴

   When must migration finish?Reported

3. Vendor and open-source evidence shows wide deployment of hybrid key agreement.²³²⁴

   Is key agreement moving?Reported

4. Slower. Post-quantum signatures add size, and broad certificate trust is not expected before 2027.²³

   Are signatures moving?Reported

5. A 2025 estimate: under a million noisy qubits in under a week, under stated assumptions.²²

   How many qubits would break RSA-2048?Reported

6. Exploited known vulnerabilities and ransomware recur across the sources read.¹³¹⁴¹⁵

   What drives incidents?Reported

7. Skills needs rose in 2025; no gap figure was published.²⁰

   What does the workforce look like?Reported

8. The lag of signatures and long-life devices behind key agreement. SCN-XT10-SIG-01

   What will 2027 test first?Expert input

S.3Headline finding

ReportedEQL 5NRF-XTECH-CRYPTO-GLOBAL-2026-BASELINE-CRY-001

NIST finalised three post-quantum cryptography standards on 13 August 2024: FIPS 203 (ML-KEM), FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA).

Standards exist, so migration is now an engineering and planning task. NIST added HQC as a backup key-encapsulation method on a different mathematical basis, with a final standard expected in 2027⁶. Guidance on using key encapsulation was published in September 2025⁷. The NIST transition draft IR 8547, published on 12 November 2024, proposes disallowing quantum-vulnerable public-key algorithms after 2035⁴⁴.

S.4At a glance

S.5What each steward reads in it

S.6What this edition is, and is not

Notes

Numbers are the edition’s reference numbers, so a note reads the same in every chapter. The full list, with every source and its licence, is in Annex C. Annex C, references

1. 1NIST (ed.), Module-Lattice-Based Key-Encapsulation Mechanism Standard, FIPS 203 (publication page; final 13 August 2024; ML-KEM-512, ML-KEM-768 and ML-KEM-1024; initial draft 24 August 2023). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03.back
2. 2NIST (ed.), Module-Lattice-Based Digital Signature Standard, FIPS 204 (publication page; final 13 August 2024; ML-DSA). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03.back
3. 3NIST (ed.), Stateless Hash-Based Digital Signature Standard, FIPS 205 (publication page; final 13 August 2024; SLH-DSA, based on SPHINCS+). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03.back
4. 6NIST (ed.), NIST selects HQC as fifth algorithm for post-quantum encryption (news item, 11 March 2025; backup to ML-KEM; draft standard expected in about a year; final standard expected in 2027). National Institute of Standards and Technology, Gaithersburg. Observation year 2025. Accessed 2026-11-03.back
5. 10UK National Cyber Security Centre (ed.), Timelines for migration to post-quantum cryptography (guidance page; version 1.0, 20 March 2025; milestones 2028, 2031 and 2035). NCSC, London. Observation year 2025. Accessed 2026-11-03.back
6. 22Gidney, C., How to factor 2048 bit RSA integers with less than a million noisy qubits, arXiv:2505.15917, submitted 21 May 2025 (abstract page; under one million noisy qubits; under a week; 0.1% gate error; 1 microsecond cycle; 10 microsecond reaction time; the author’s 2019 estimate was about 20 million qubits in 8 hours). arXiv, Ithaca. Observation year 2025. Accessed 2026-11-03.back
7. 23Cloudflare (ed.), The state of the post-quantum Internet in 2025 (blog analysis; late October 2025 majority of human traffic with post-quantum key agreement; 3.7% of origins; 39% of top 100,000 domains in September 2025; ML-DSA-44 about 15 kB; first post-quantum certificates expected in 2026). Cloudflare, San Francisco. Vendor analysis of its own network, weak evidence. Observation year 2025. Accessed 2026-11-03.back
8. 24OpenSSH project (ed.), Post-quantum cryptography in OpenSSH (documentation page; sntrup761x25519-sha512 from 9.0; mlkem768x25519-sha256 added in 9.9 and default in 10.0; warning from 10.1). OpenBSD Project. Observation year 2025. Accessed 2026-11-03.back
9. 15Federal Bureau of Investigation, Internet Crime Complaint Center (ed.), 2024 Internet Crime Report (859,532 complaints; USD 16.6 billion losses, up 33%; 256,256 complaints with a loss; 3,156 ransomware complaints; 263,455 cyber-threat complaints and USD 1.571 billion; 4,878 critical-infrastructure complaints). FBI, Washington. Observation year 2024. Accessed 2026-11-03.back
10. 44NIST (ed.), Transition to Post-Quantum Cryptography Standards, NIST IR 8547, initial public draft (draft PDF, November 2024; Tables 2 and 4: for quantum-vulnerable signature and key-establishment schemes at 112 bits of security strength, deprecated after 2030 and disallowed after 2035, and at 128 bits or more, disallowed after 2035; the cover sheet added on withdrawal on 27 October 2026 is not used). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03.back
11. 13POST-CLOSE, context only: CISA (ed.), Known Exploited Vulnerabilities Catalog (catalogue page; 1,767 results at the read; newest entry added 2026-11-03). Cybersecurity and Infrastructure Security Agency, Arlington. Observation year 2026. Accessed 2026-11-03.back
12. 14CISA and 22 partner agencies (eds.), Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System, advisory AA25-239A (published 27 August 2025; revised 3 September 2025; 23 agencies from 13 countries; known vulnerabilities; no zero-day exploitation observed). Cybersecurity and Infrastructure Security Agency, Arlington. Observation year 2025. Accessed 2026-11-03.back
13. 20ISC2 (ed.), 2025 Cybersecurity Workforce Study (page; published 4 December 2025; 16,029 respondents; 59% critical or significant skills needs, up from 44%; no workforce gap estimate). ISC2, Alexandria. Observation year 2025. Accessed 2026-11-03.back
14. 7NIST (ed.), Recommendations for Key-Encapsulation Mechanisms, SP 800-227 (publication page; final 18 September 2025). National Institute of Standards and Technology, Gaithersburg. Observation year 2025. Accessed 2026-11-03.back
15. 18IBM and Ponemon Institute (eds.), Cost of a Data Breach Report 2026 (landing page; global average USD 4.99 million, up 12%; AI-driven attacks up 56%). IBM, Armonk. Vendor report, weak evidence; the full report was not opened. Observation year 2026. Accessed 2026-11-03.back

1.1The questions this part answers

Key questions

• Where is cybersecurity and cryptography risk concentrated?
• Which couplings carry cybersecurity and cryptography shocks into other systems?
• Which cybersecurity and cryptography capabilities hold under compound stress?
• What must 2027 evidence measure first?

In this part

• Narrative
• Headline finding
• Lead figure
• Five footprint and governance chapters
• Twelve-domain reading
• Sector screens
• Dependency matrix
• Risk objects
• Capability ladder
• Scenario
• Three lenses
• Portfolio

1.2The argument

1.3Twenty couplings between five systems

The cybersecurity and cryptography-centred matrix types the twenty couplings between the five core systems, read for their cybersecurity and cryptography content. Strengths are Nexus estimates (ESTIMATED) from the cited evidence and analogue events; they set the graph that 2027 evidence will test.

Transmission paths

1. 01

   INF → DAT

   A capable machine would expose data protected by current public-key methods.

   Inferred RSA-2048 estimate²²

2. 02

   GOV → INF

   National timelines set migration dates for operators.

   Reported NCSC and NIST draft¹⁰⁴⁴

3. 03

   INF → FIN

   Exploited vulnerabilities and ransomware create cost and loss.

   Reported IC3, IBM, Chainalysis¹⁵¹⁸¹⁹

4. 04

   INF → INF

   Larger signatures slow handshakes and delay certificate migration.

   Inferred Cloudflare analysis²³

5. 05

   GOV → TRD

   Reporting duties and disclosure rules cross borders.

   Reported SEC rule and EU regulation²¹²⁷

Notes

Numbers are the edition’s reference numbers, so a note reads the same in every chapter. The full list, with every source and its licence, is in Annex C. Annex C, references

1. 1NIST (ed.), Module-Lattice-Based Key-Encapsulation Mechanism Standard, FIPS 203 (publication page; final 13 August 2024; ML-KEM-512, ML-KEM-768 and ML-KEM-1024; initial draft 24 August 2023). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03.back
2. 13POST-CLOSE, context only: CISA (ed.), Known Exploited Vulnerabilities Catalog (catalogue page; 1,767 results at the read; newest entry added 2026-11-03). Cybersecurity and Infrastructure Security Agency, Arlington. Observation year 2026. Accessed 2026-11-03.back
3. 15Federal Bureau of Investigation, Internet Crime Complaint Center (ed.), 2024 Internet Crime Report (859,532 complaints; USD 16.6 billion losses, up 33%; 256,256 complaints with a loss; 3,156 ransomware complaints; 263,455 cyber-threat complaints and USD 1.571 billion; 4,878 critical-infrastructure complaints). FBI, Washington. Observation year 2024. Accessed 2026-11-03.back
4. 2NIST (ed.), Module-Lattice-Based Digital Signature Standard, FIPS 204 (publication page; final 13 August 2024; ML-DSA). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03.back
5. 3NIST (ed.), Stateless Hash-Based Digital Signature Standard, FIPS 205 (publication page; final 13 August 2024; SLH-DSA, based on SPHINCS+). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03.back
6. 6NIST (ed.), NIST selects HQC as fifth algorithm for post-quantum encryption (news item, 11 March 2025; backup to ML-KEM; draft standard expected in about a year; final standard expected in 2027). National Institute of Standards and Technology, Gaithersburg. Observation year 2025. Accessed 2026-11-03.back
7. 10UK National Cyber Security Centre (ed.), Timelines for migration to post-quantum cryptography (guidance page; version 1.0, 20 March 2025; milestones 2028, 2031 and 2035). NCSC, London. Observation year 2025. Accessed 2026-11-03.back
8. 44NIST (ed.), Transition to Post-Quantum Cryptography Standards, NIST IR 8547, initial public draft (draft PDF, November 2024; Tables 2 and 4: for quantum-vulnerable signature and key-establishment schemes at 112 bits of security strength, deprecated after 2030 and disallowed after 2035, and at 128 bits or more, disallowed after 2035; the cover sheet added on withdrawal on 27 October 2026 is not used). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03.back
9. 22Gidney, C., How to factor 2048 bit RSA integers with less than a million noisy qubits, arXiv:2505.15917, submitted 21 May 2025 (abstract page; under one million noisy qubits; under a week; 0.1% gate error; 1 microsecond cycle; 10 microsecond reaction time; the author’s 2019 estimate was about 20 million qubits in 8 hours). arXiv, Ithaca. Observation year 2025. Accessed 2026-11-03.back
10. 23Cloudflare (ed.), The state of the post-quantum Internet in 2025 (blog analysis; late October 2025 majority of human traffic with post-quantum key agreement; 3.7% of origins; 39% of top 100,000 domains in September 2025; ML-DSA-44 about 15 kB; first post-quantum certificates expected in 2026). Cloudflare, San Francisco. Vendor analysis of its own network, weak evidence. Observation year 2025. Accessed 2026-11-03.back
11. 24OpenSSH project (ed.), Post-quantum cryptography in OpenSSH (documentation page; sntrup761x25519-sha512 from 9.0; mlkem768x25519-sha256 added in 9.9 and default in 10.0; warning from 10.1). OpenBSD Project. Observation year 2025. Accessed 2026-11-03.back
12. 25Signal (ed.), Signal Protocol and Post-Quantum Ratchets, SPQR triple ratchet (blog post, 2 October 2025; ML-KEM 768; gradual rollout; formal verification). Signal Messenger, Mountain View. Vendor announcement, weak evidence. Observation year 2025. Accessed 2026-11-03.back
13. 26Apple (ed.), iMessage with PQ3: The new state of the art in quantum-secure messaging at scale (security blog post, 21 February 2024; Kyber-1024 and Kyber-768 hybrid with P-256; level 3 on its own scale). Apple, Cupertino. Vendor announcement, weak evidence. Observation year 2024. Accessed 2026-11-03.back
14. 14CISA and 22 partner agencies (eds.), Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System, advisory AA25-239A (published 27 August 2025; revised 3 September 2025; 23 agencies from 13 countries; known vulnerabilities; no zero-day exploitation observed). Cybersecurity and Infrastructure Security Agency, Arlington. Observation year 2025. Accessed 2026-11-03.back
15. 18IBM and Ponemon Institute (eds.), Cost of a Data Breach Report 2026 (landing page; global average USD 4.99 million, up 12%; AI-driven attacks up 56%). IBM, Armonk. Vendor report, weak evidence; the full report was not opened. Observation year 2026. Accessed 2026-11-03.back
16. 19Chainalysis (ed.), ransomware analysis (blog page; more than USD 820 million on-chain in 2025, down 8% from an updated USD 892 million for 2024; original 2024 estimate USD 813 million). Chainalysis, New York. Vendor estimate, weak evidence. Observation year 2025. Accessed 2026-11-03.back
17. 20ISC2 (ed.), 2025 Cybersecurity Workforce Study (page; published 4 December 2025; 16,029 respondents; 59% critical or significant skills needs, up from 44%; no workforce gap estimate). ISC2, Alexandria. Observation year 2025. Accessed 2026-11-03.back
18. 21US Securities and Exchange Commission (ed.), SEC adopts rules on cybersecurity risk management, strategy, governance and incident disclosure by public companies (press release 2023-139; adopted 26 July 2023; Form 8-K Item 1.05 within four business days of a materiality determination). SEC, Washington. Observation year 2023. Accessed 2026-11-03.back
19. 27UNVERIFIED, not opened: European Union, Regulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elements (Cyber Resilience Act; in force 10 December 2024; reporting duties from 11 September 2026; main obligations from 11 December 2027), dates taken from law-firm search summaries; the Official Journal page returned no text. Observation year 2024. Accessed 2026-11-03.back

2.1Headline finding

ReportedEQL 5NRF-XTECH-CRYPTO-GLOBAL-2026-BASELINE-CRY-001

NIST finalised three post-quantum cryptography standards on 13 August 2024: FIPS 203 (ML-KEM), FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA).

Implication

Standards exist, so migration is now an engineering and planning task. NIST added HQC as a backup key-encapsulation method on a different mathematical basis, with a final standard expected in 2027⁶. Guidance on using key encapsulation was published in September 2025⁷. The NIST transition draft IR 8547, published on 12 November 2024, proposes disallowing quantum-vulnerable public-key algorithms after 2035⁴⁴.

What would move it

The HQC draft, sector migration progress and national directives would each move this finding.

2.2CRY

1. ReportedEQL 5NRF-XTECH-CRYPTO-GLOBAL-2026-BASELINE-CRY-001

   NIST finalised FIPS 203 (ML-KEM), FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA) on 13 August 2024. ML-KEM has three parameter sets: 512, 768 and 1024.¹²³

2. ReportedEQL 4NRF-XTECH-CRYPTO-GLOBAL-2026-BASELINE-CRY-002

   NIST selected HQC on 11 March 2025 as a backup key-encapsulation method based on codes rather than lattices, with a draft standard expected in about a year and a final standard in 2027.⁶³²

3. ReportedEQL 4NRF-XTECH-CRYPTO-GLOBAL-2026-BASELINE-CRY-007

   A 2025 preprint estimates that RSA-2048 could be factored with fewer than one million noisy qubits in under a week, assuming a 0.1% gate error and a 1 microsecond cycle. The author’s 2019 estimate was about 20 million qubits in 8 hours.²²³⁷

2.3Governance

1. ReportedEQL 4NRF-XTECH-CRYPTO-GLOBAL-2026-BASELINE-GOV-003

   NIST published the initial public draft of the transition report IR 8547 on 12 November 2024. The draft proposes that quantum-vulnerable public-key algorithms at 112 bits of security be deprecated after 2030 and that all such algorithms be disallowed after 2035.⁴⁴

2. ReportedEQL 4NRF-XTECH-CRYPTO-GLOBAL-2026-BASELINE-GOV-004

   The UK NCSC published migration timelines on 20 March 2025: assess and plan by 2028, do priority migration by 2031 and finish by 2035.¹⁰

2.4Infrastructure

1. ReportedEQL 2NRF-XTECH-CRYPTO-GLOBAL-2026-BASELINE-INF-005

   Cloudflare reported that most human traffic to its network used post-quantum key agreement in late October 2025, while 3.7% of origin servers supported it and an ML-DSA-44 signature adds about 15 kB to a TLS handshake. This is vendor evidence.²³

2. ReportedEQL 3NRF-XTECH-CRYPTO-GLOBAL-2026-BASELINE-INF-006

   OpenSSH made a post-quantum key exchange its default in version 9.0 and switched the default to mlkem768x25519 in version 10.0. Version 10.1 warns when a connection does not use one.²⁴

2.5THR

1. ReportedEQL 3NRF-XTECH-CRYPTO-GLOBAL-2026-BASELINE-THR-008

   The CISA KEV count at the 30 September close is not bound. A 3 November read of the catalogue is post-close, context only. A 2025 joint advisory from 23 agencies in 13 countries reported router compromise through known vulnerabilities and no observed zero-day exploitation. A vendor report states that 31% of breaches began with exploited vulnerabilities.¹⁴¹⁷

2. ReportedEQL 4NRF-XTECH-CRYPTO-GLOBAL-2026-BASELINE-THR-009

   The FBI received 859,532 complaints and USD 16.6 billion of reported losses in 2024, up 33% from 2023. It received 3,156 ransomware complaints and called ransomware the most pervasive threat to critical infrastructure.¹⁵

2.6Finance

1. ReportedEQL 2NRF-XTECH-CRYPTO-GLOBAL-2026-BASELINE-FIN-010

   Chainalysis estimates that ransomware actors received more than USD 820 million on-chain in 2025, about 8% below an updated USD 892 million for 2024. IBM puts the global average cost of a data breach at USD 4.99 million in 2026. Both are vendor estimates.¹⁸¹⁹

2.7SKL

1. ReportedEQL 3NRF-XTECH-CRYPTO-GLOBAL-2026-BASELINE-SKL-011

   In the ISC2 2025 study, 59% of respondents reported critical or significant skills needs, up from 44% in 2024. ISC2 published no workforce gap estimate in 2025.²⁰

2.8Systemic

1. Expert inputEQL 2NRF-XTECH-CRYPTO-GLOBAL-2026-BASELINE-SYS-012

   The leading compound pathway for 2027 testing is the lag of signatures, certificates and long-life devices behind key agreement, while exploited ordinary vulnerabilities keep dominating incidents. § scenario

Notes

Numbers are the edition’s reference numbers, so a note reads the same in every chapter. The full list, with every source and its licence, is in Annex C. Annex C, references

1. 1NIST (ed.), Module-Lattice-Based Key-Encapsulation Mechanism Standard, FIPS 203 (publication page; final 13 August 2024; ML-KEM-512, ML-KEM-768 and ML-KEM-1024; initial draft 24 August 2023). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03.back
2. 2NIST (ed.), Module-Lattice-Based Digital Signature Standard, FIPS 204 (publication page; final 13 August 2024; ML-DSA). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03.back
3. 3NIST (ed.), Stateless Hash-Based Digital Signature Standard, FIPS 205 (publication page; final 13 August 2024; SLH-DSA, based on SPHINCS+). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03.back
4. 6NIST (ed.), NIST selects HQC as fifth algorithm for post-quantum encryption (news item, 11 March 2025; backup to ML-KEM; draft standard expected in about a year; final standard expected in 2027). National Institute of Standards and Technology, Gaithersburg. Observation year 2025. Accessed 2026-11-03.back
5. 7NIST (ed.), Recommendations for Key-Encapsulation Mechanisms, SP 800-227 (publication page; final 18 September 2025). National Institute of Standards and Technology, Gaithersburg. Observation year 2025. Accessed 2026-11-03.back
6. 44NIST (ed.), Transition to Post-Quantum Cryptography Standards, NIST IR 8547, initial public draft (draft PDF, November 2024; Tables 2 and 4: for quantum-vulnerable signature and key-establishment schemes at 112 bits of security strength, deprecated after 2030 and disallowed after 2035, and at 128 bits or more, disallowed after 2035; the cover sheet added on withdrawal on 27 October 2026 is not used). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03.back
7. 32UNVERIFIED, not opened: NIST (ed.), Status Report on the Fourth Round of the NIST Post-Quantum Cryptography Standardization Process, NIST IR 8545, March 2025, cited from memory. National Institute of Standards and Technology, Gaithersburg. Observation year 2025. Accessed 2026-11-03.back
8. 22Gidney, C., How to factor 2048 bit RSA integers with less than a million noisy qubits, arXiv:2505.15917, submitted 21 May 2025 (abstract page; under one million noisy qubits; under a week; 0.1% gate error; 1 microsecond cycle; 10 microsecond reaction time; the author’s 2019 estimate was about 20 million qubits in 8 hours). arXiv, Ithaca. Observation year 2025. Accessed 2026-11-03.back
9. 37UNVERIFIED, not opened: Shor, P.W., Polynomial-time algorithms for prime factorization and discrete logarithms on a quantum computer, SIAM Journal on Computing 26(5), 1484 to 1509, 1997, cited from memory. Observation year 1997. Accessed 2026-11-03.back
10. 10UK National Cyber Security Centre (ed.), Timelines for migration to post-quantum cryptography (guidance page; version 1.0, 20 March 2025; milestones 2028, 2031 and 2035). NCSC, London. Observation year 2025. Accessed 2026-11-03.back
11. 23Cloudflare (ed.), The state of the post-quantum Internet in 2025 (blog analysis; late October 2025 majority of human traffic with post-quantum key agreement; 3.7% of origins; 39% of top 100,000 domains in September 2025; ML-DSA-44 about 15 kB; first post-quantum certificates expected in 2026). Cloudflare, San Francisco. Vendor analysis of its own network, weak evidence. Observation year 2025. Accessed 2026-11-03.back
12. 24OpenSSH project (ed.), Post-quantum cryptography in OpenSSH (documentation page; sntrup761x25519-sha512 from 9.0; mlkem768x25519-sha256 added in 9.9 and default in 10.0; warning from 10.1). OpenBSD Project. Observation year 2025. Accessed 2026-11-03.back
13. 14CISA and 22 partner agencies (eds.), Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System, advisory AA25-239A (published 27 August 2025; revised 3 September 2025; 23 agencies from 13 countries; known vulnerabilities; no zero-day exploitation observed). Cybersecurity and Infrastructure Security Agency, Arlington. Observation year 2025. Accessed 2026-11-03.back
14. 17Verizon (ed.), 2026 Data Breach Investigations Report (landing page; period 1 November 2024 to 31 October 2025; 48% of breaches involve ransomware; 31% begin with exploited vulnerabilities). Verizon Business, New York. Vendor report, weak evidence; the full report was not opened. Observation year 2025. Accessed 2026-11-03.back
15. 15Federal Bureau of Investigation, Internet Crime Complaint Center (ed.), 2024 Internet Crime Report (859,532 complaints; USD 16.6 billion losses, up 33%; 256,256 complaints with a loss; 3,156 ransomware complaints; 263,455 cyber-threat complaints and USD 1.571 billion; 4,878 critical-infrastructure complaints). FBI, Washington. Observation year 2024. Accessed 2026-11-03.back
16. 18IBM and Ponemon Institute (eds.), Cost of a Data Breach Report 2026 (landing page; global average USD 4.99 million, up 12%; AI-driven attacks up 56%). IBM, Armonk. Vendor report, weak evidence; the full report was not opened. Observation year 2026. Accessed 2026-11-03.back
17. 19Chainalysis (ed.), ransomware analysis (blog page; more than USD 820 million on-chain in 2025, down 8% from an updated USD 892 million for 2024; original 2024 estimate USD 813 million). Chainalysis, New York. Vendor estimate, weak evidence. Observation year 2025. Accessed 2026-11-03.back
18. 20ISC2 (ed.), 2025 Cybersecurity Workforce Study (page; published 4 December 2025; 16,029 respondents; 59% critical or significant skills needs, up from 44%; no workforce gap estimate). ISC2, Alexandria. Observation year 2025. Accessed 2026-11-03.back

3.1Where each system stood at evidence close

3.2Domain posture

Each of the twelve coupled domains is read through cybersecurity and cryptography, in words, not scored. The coupling column names the dependency that carries cybersecurity and cryptography risk into each domain.

3.3Sector screens

All sixteen sectors are screened for their dependence on cybersecurity and cryptography, on the same grammar as every national edition. The evidence column describes coverage of the baseline evidence, not the performance of the sector.

Notes

Numbers are the edition’s reference numbers, so a note reads the same in every chapter. The full list, with every source and its licence, is in Annex C. Annex C, references

1. 1NIST (ed.), Module-Lattice-Based Key-Encapsulation Mechanism Standard, FIPS 203 (publication page; final 13 August 2024; ML-KEM-512, ML-KEM-768 and ML-KEM-1024; initial draft 24 August 2023). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03.back
2. 2NIST (ed.), Module-Lattice-Based Digital Signature Standard, FIPS 204 (publication page; final 13 August 2024; ML-DSA). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03.back
3. 3NIST (ed.), Stateless Hash-Based Digital Signature Standard, FIPS 205 (publication page; final 13 August 2024; SLH-DSA, based on SPHINCS+). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03.back
4. 22Gidney, C., How to factor 2048 bit RSA integers with less than a million noisy qubits, arXiv:2505.15917, submitted 21 May 2025 (abstract page; under one million noisy qubits; under a week; 0.1% gate error; 1 microsecond cycle; 10 microsecond reaction time; the author’s 2019 estimate was about 20 million qubits in 8 hours). arXiv, Ithaca. Observation year 2025. Accessed 2026-11-03.back
5. 23Cloudflare (ed.), The state of the post-quantum Internet in 2025 (blog analysis; late October 2025 majority of human traffic with post-quantum key agreement; 3.7% of origins; 39% of top 100,000 domains in September 2025; ML-DSA-44 about 15 kB; first post-quantum certificates expected in 2026). Cloudflare, San Francisco. Vendor analysis of its own network, weak evidence. Observation year 2025. Accessed 2026-11-03.back
6. 15Federal Bureau of Investigation, Internet Crime Complaint Center (ed.), 2024 Internet Crime Report (859,532 complaints; USD 16.6 billion losses, up 33%; 256,256 complaints with a loss; 3,156 ransomware complaints; 263,455 cyber-threat complaints and USD 1.571 billion; 4,878 critical-infrastructure complaints). FBI, Washington. Observation year 2024. Accessed 2026-11-03.back
7. 18IBM and Ponemon Institute (eds.), Cost of a Data Breach Report 2026 (landing page; global average USD 4.99 million, up 12%; AI-driven attacks up 56%). IBM, Armonk. Vendor report, weak evidence; the full report was not opened. Observation year 2026. Accessed 2026-11-03.back
8. 14CISA and 22 partner agencies (eds.), Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System, advisory AA25-239A (published 27 August 2025; revised 3 September 2025; 23 agencies from 13 countries; known vulnerabilities; no zero-day exploitation observed). Cybersecurity and Infrastructure Security Agency, Arlington. Observation year 2025. Accessed 2026-11-03.back
9. 19Chainalysis (ed.), ransomware analysis (blog page; more than USD 820 million on-chain in 2025, down 8% from an updated USD 892 million for 2024; original 2024 estimate USD 813 million). Chainalysis, New York. Vendor estimate, weak evidence. Observation year 2025. Accessed 2026-11-03.back
10. 13POST-CLOSE, context only: CISA (ed.), Known Exploited Vulnerabilities Catalog (catalogue page; 1,767 results at the read; newest entry added 2026-11-03). Cybersecurity and Infrastructure Security Agency, Arlington. Observation year 2026. Accessed 2026-11-03.back
11. 10UK National Cyber Security Centre (ed.), Timelines for migration to post-quantum cryptography (guidance page; version 1.0, 20 March 2025; milestones 2028, 2031 and 2035). NCSC, London. Observation year 2025. Accessed 2026-11-03.back
12. 11European Commission (ed.), Coordinated Implementation Roadmap for the transition to Post-Quantum Cryptography (library page; published 23 June 2025; the milestones were not on the page). Directorate-General for Communications Networks, Content and Technology, Brussels. Observation year 2025. Accessed 2026-11-03.back
13. 44NIST (ed.), Transition to Post-Quantum Cryptography Standards, NIST IR 8547, initial public draft (draft PDF, November 2024; Tables 2 and 4: for quantum-vulnerable signature and key-establishment schemes at 112 bits of security strength, deprecated after 2030 and disallowed after 2035, and at 128 bits or more, disallowed after 2035; the cover sheet added on withdrawal on 27 October 2026 is not used). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03.back

4.1Risk objects

Each risk is read across the chain from hazard to consequence, with its status and evidence-quality level.

1. InferredEQL 4RSK-XT10-CRY-001

   Cryptographic transition lag

   Driver

   falling resource estimates and slow migration²²¹

   Exposure

   long-lived sensitive data; signatures on long-life devices

   Vulnerability

   inventory gaps; embedded and legacy systems

   Capacity

   standards and national timelines¹¹⁰¹²

   Cascade

   DAT → FIN, HLT, INF

   Horizon

   1 to 10 years

2. InferredEQL 3RSK-XT10-INF-002

   Signature and certificate migration lag

   Driver

   larger signatures and slow trust-store change²³

   Exposure

   web, code signing, device identity

   Vulnerability

   performance limits; long-lived certificates

   Capacity

   new schemes under evaluation⁴²

   Cascade

   INF → DAT

   Horizon

   1 to 5 years

3. ReportedEQL 4RSK-XT10-THR-003

   Known vulnerabilities in edge devices

   Driver

   exploitation of known CVEs¹³¹⁴

   Exposure

   routers, gateways, telecom and transport networks

   Vulnerability

   slow patching; exposed management planes

   Capacity

   catalogues, advisories and hardening guidance¹³¹⁴

   Cascade

   INF → ENE, FIN

   Horizon

   1 to 5 years

4. InferredEQL 3RSK-XT10-GOV-004

   Fragmented timelines and duties

   Driver

   different dates in NCSC, NIST draft, EU and CISA material^44101112

   Exposure

   multinational operators and suppliers

   Vulnerability

   duplicate reporting; unclear product duties

   Capacity

   standards, roadmaps and shared guidance⁹¹¹

   Cascade

   GOV → INF, FIN

   Horizon

   1 to 5 years

4.2Capability ladder

Existence is not readiness. Each of the fifteen capability functions is placed on the ladder by the strongest public evidence for cybersecurity and cryptography at the global level.

Notes

Numbers are the edition’s reference numbers, so a note reads the same in every chapter. The full list, with every source and its licence, is in Annex C. Annex C, references

1. 22Gidney, C., How to factor 2048 bit RSA integers with less than a million noisy qubits, arXiv:2505.15917, submitted 21 May 2025 (abstract page; under one million noisy qubits; under a week; 0.1% gate error; 1 microsecond cycle; 10 microsecond reaction time; the author’s 2019 estimate was about 20 million qubits in 8 hours). arXiv, Ithaca. Observation year 2025. Accessed 2026-11-03.back
2. 1NIST (ed.), Module-Lattice-Based Key-Encapsulation Mechanism Standard, FIPS 203 (publication page; final 13 August 2024; ML-KEM-512, ML-KEM-768 and ML-KEM-1024; initial draft 24 August 2023). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03.back
3. 10UK National Cyber Security Centre (ed.), Timelines for migration to post-quantum cryptography (guidance page; version 1.0, 20 March 2025; milestones 2028, 2031 and 2035). NCSC, London. Observation year 2025. Accessed 2026-11-03.back
4. 12CISA (ed.), Post-Quantum Cryptography Initiative (page; key dates, federal inventory duty under 6 U.S.C. 1526, product categories list, references to Executive Orders 14306, 14412 and 14413 and OMB Memorandum M-26-15). Cybersecurity and Infrastructure Security Agency, Arlington. Observation year 2026. Accessed 2026-11-03.back
5. 23Cloudflare (ed.), The state of the post-quantum Internet in 2025 (blog analysis; late October 2025 majority of human traffic with post-quantum key agreement; 3.7% of origins; 39% of top 100,000 domains in September 2025; ML-DSA-44 about 15 kB; first post-quantum certificates expected in 2026). Cloudflare, San Francisco. Vendor analysis of its own network, weak evidence. Observation year 2025. Accessed 2026-11-03.back
6. 42UNVERIFIED, not opened: NIST (ed.), additional digital signature schemes for the post-quantum project (on-ramp), cited from memory; the project page returned an error. National Institute of Standards and Technology, Gaithersburg. Observation year 2025. Accessed 2026-11-03.back
7. 13POST-CLOSE, context only: CISA (ed.), Known Exploited Vulnerabilities Catalog (catalogue page; 1,767 results at the read; newest entry added 2026-11-03). Cybersecurity and Infrastructure Security Agency, Arlington. Observation year 2026. Accessed 2026-11-03.back
8. 14CISA and 22 partner agencies (eds.), Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System, advisory AA25-239A (published 27 August 2025; revised 3 September 2025; 23 agencies from 13 countries; known vulnerabilities; no zero-day exploitation observed). Cybersecurity and Infrastructure Security Agency, Arlington. Observation year 2025. Accessed 2026-11-03.back
9. 44NIST (ed.), Transition to Post-Quantum Cryptography Standards, NIST IR 8547, initial public draft (draft PDF, November 2024; Tables 2 and 4: for quantum-vulnerable signature and key-establishment schemes at 112 bits of security strength, deprecated after 2030 and disallowed after 2035, and at 128 bits or more, disallowed after 2035; the cover sheet added on withdrawal on 27 October 2026 is not used). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03.back
10. 11European Commission (ed.), Coordinated Implementation Roadmap for the transition to Post-Quantum Cryptography (library page; published 23 June 2025; the milestones were not on the page). Directorate-General for Communications Networks, Content and Technology, Brussels. Observation year 2025. Accessed 2026-11-03.back
11. 9NIST (ed.), The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29 (publication page; 26 February 2024). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03.back
12. 7NIST (ed.), Recommendations for Key-Encapsulation Mechanisms, SP 800-227 (publication page; final 18 September 2025). National Institute of Standards and Technology, Gaithersburg. Observation year 2025. Accessed 2026-11-03.back
13. 6NIST (ed.), NIST selects HQC as fifth algorithm for post-quantum encryption (news item, 11 March 2025; backup to ML-KEM; draft standard expected in about a year; final standard expected in 2027). National Institute of Standards and Technology, Gaithersburg. Observation year 2025. Accessed 2026-11-03.back
14. 18IBM and Ponemon Institute (eds.), Cost of a Data Breach Report 2026 (landing page; global average USD 4.99 million, up 12%; AI-driven attacks up 56%). IBM, Armonk. Vendor report, weak evidence; the full report was not opened. Observation year 2026. Accessed 2026-11-03.back
15. 24OpenSSH project (ed.), Post-quantum cryptography in OpenSSH (documentation page; sntrup761x25519-sha512 from 9.0; mlkem768x25519-sha256 added in 9.9 and default in 10.0; warning from 10.1). OpenBSD Project. Observation year 2025. Accessed 2026-11-03.back
16. 20ISC2 (ed.), 2025 Cybersecurity Workforce Study (page; published 4 December 2025; 16,029 respondents; 59% critical or significant skills needs, up from 44%; no workforce gap estimate). ISC2, Alexandria. Observation year 2025. Accessed 2026-11-03.back

5.1Assumptions

Scenario SCN-XT10-SIG-01: what is assumed, and what is held constant.

Baseline

the 2026 reference state in this edition

Drivers

key agreement is widely hybrid while signatures, certificates and long-life devices stay on current methods, and a hardware milestone arrives sooner than planned

Analogues

the fall in resource estimates from 2019 to 2025; the 2024 standards²²¹

Interventions

none modelled: the specification describes the unmitigated case

Run state

narrative specification; quantified run scheduled for 2027

5.2The cascade, step by step

1. 1

   INF → DAT

   a hardware milestone lowers confidence in public-key signatures

   2025

2. 2

   DAT → INF

   long-life devices and certificates cannot be updated quickly

   2025

3. 3

   INF → FIN

   operators re-prioritise migration spending

   2026

4. 4

   GOV → INF

   national timelines and reporting duties diverge

   2026

5. 5

   INF → HLT

   archived records and device identities become the first exposure

   2026

6. 6

   FIN → INF

   spending shifts to inventory and agility

   2026

5.3The scenario as a table of steps

How the shock in scenario SCN-XT10-SIG-01 would travel through Cybersecurity and Advanced Cryptography’s coupled systems, step by step, under the assumptions the edition states.

A teaching model of a conditional scenario under the edition’s stated assumptions: not a forecast, not a prediction and not a warning. Sources: Cybersecurity and Advanced Cryptography 2026, scenario SCN-XT10-SIG-01 (2026); Cybersecurity and Advanced Cryptography 2026, references (NR-CIT-1) (2026).

Notes

Numbers are the edition’s reference numbers, so a note reads the same in every chapter. The full list, with every source and its licence, is in Annex C. Annex C, references

1. 22Gidney, C., How to factor 2048 bit RSA integers with less than a million noisy qubits, arXiv:2505.15917, submitted 21 May 2025 (abstract page; under one million noisy qubits; under a week; 0.1% gate error; 1 microsecond cycle; 10 microsecond reaction time; the author’s 2019 estimate was about 20 million qubits in 8 hours). arXiv, Ithaca. Observation year 2025. Accessed 2026-11-03.back
2. 1NIST (ed.), Module-Lattice-Based Key-Encapsulation Mechanism Standard, FIPS 203 (publication page; final 13 August 2024; ML-KEM-512, ML-KEM-768 and ML-KEM-1024; initial draft 24 August 2023). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03.back

6.1The other desks’ editions of this subject

Federation: each desk writes its own edition for the subjects in its remit. Until a desk releases, its edition shows its frame and the reading this edition printed for it.

6.2Three lenses

One edition, read by each steward. The lens of this site comes first.

6.3Standards, Academy and steward contributions

How the Nexus Standards drafts, the Risk Academy and the three stewards feed each quarterly edition for cybersecurity and cryptography. The standards are a preparatory working draft (2026) and are cited as drafts, never as adopted standards.

6.4GCRI reading: the model card

GCRI’s reading of this edition is its model card: what the national model is, what it computes and where it stops. It is printed in full in Annex A, with the methods it belongs to. Annex A, methodology

6.5Global Risks Forum reading: editorial essays

Four signed essays by the Reports editorial team set out the positions this edition takes. They are interpretation, labelled as such; the evidence they draw on is in the findings register.

6.6Global Risks Alliance reading: 2027 cybersecurity and cryptography readiness pack

The registers that open the 2027 global cycle. At baseline each is initialised from this edition.

Publication dispositions

• Publish
• Hold
• Needs evidence
• Restricted
• Superseded

6.7Nexus Standards reading: standards and regulatory watch

Instruments and published guidance that shape the systems in this edition, by status on the retrieval date. The edition assesses no one’s compliance.

• IN FORCE
• PUBLISHED
• DRAFT
• PUBLISHED · VOLUNTARY

6.8Risk Academy reading: literature and evidence review, science and assessments

The review behind this edition covers cybersecurity and cryptography assessments, peer-reviewed science and the institutional reports that bind its findings. Systematic reviews for each agenda item begin in 2027.

Review protocol

Question

What does the published evidence establish about cybersecurity and advanced cryptography as infrastructure and its couplings?

Sources searched

preprints and journals; standards bodies and agencies; roadmaps and regulation; threat and cost reports

Window

releases available at evidence close, 30 September 2026

Selection

sources that bind or contextualise a finding in this edition

Next step

systematic reviews for agenda items 01 to 05 in 2027

Notes

Numbers are the edition’s reference numbers, so a note reads the same in every chapter. The full list, with every source and its licence, is in Annex C. Annex C, references

1. 18IBM and Ponemon Institute (eds.), Cost of a Data Breach Report 2026 (landing page; global average USD 4.99 million, up 12%; AI-driven attacks up 56%). IBM, Armonk. Vendor report, weak evidence; the full report was not opened. Observation year 2026. Accessed 2026-11-03.back
2. 19Chainalysis (ed.), ransomware analysis (blog page; more than USD 820 million on-chain in 2025, down 8% from an updated USD 892 million for 2024; original 2024 estimate USD 813 million). Chainalysis, New York. Vendor estimate, weak evidence. Observation year 2025. Accessed 2026-11-03.back
3. 1NIST (ed.), Module-Lattice-Based Key-Encapsulation Mechanism Standard, FIPS 203 (publication page; final 13 August 2024; ML-KEM-512, ML-KEM-768 and ML-KEM-1024; initial draft 24 August 2023). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03.back
4. 2NIST (ed.), Module-Lattice-Based Digital Signature Standard, FIPS 204 (publication page; final 13 August 2024; ML-DSA). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03.back
5. 3NIST (ed.), Stateless Hash-Based Digital Signature Standard, FIPS 205 (publication page; final 13 August 2024; SLH-DSA, based on SPHINCS+). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03.back
6. 44NIST (ed.), Transition to Post-Quantum Cryptography Standards, NIST IR 8547, initial public draft (draft PDF, November 2024; Tables 2 and 4: for quantum-vulnerable signature and key-establishment schemes at 112 bits of security strength, deprecated after 2030 and disallowed after 2035, and at 128 bits or more, disallowed after 2035; the cover sheet added on withdrawal on 27 October 2026 is not used). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03.back
7. 7NIST (ed.), Recommendations for Key-Encapsulation Mechanisms, SP 800-227 (publication page; final 18 September 2025). National Institute of Standards and Technology, Gaithersburg. Observation year 2025. Accessed 2026-11-03.back
8. 8NIST (ed.), Ascon-Based Lightweight Cryptography Standards for Constrained Devices, SP 800-232 (publication page; final 13 August 2025; Ascon-AEAD128, Ascon-Hash256, Ascon-XOF128, Ascon-CXOF128). National Institute of Standards and Technology, Gaithersburg. Observation year 2025. Accessed 2026-11-03.back
9. 9NIST (ed.), The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29 (publication page; 26 February 2024). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03.back
10. 10UK National Cyber Security Centre (ed.), Timelines for migration to post-quantum cryptography (guidance page; version 1.0, 20 March 2025; milestones 2028, 2031 and 2035). NCSC, London. Observation year 2025. Accessed 2026-11-03.back
11. 11European Commission (ed.), Coordinated Implementation Roadmap for the transition to Post-Quantum Cryptography (library page; published 23 June 2025; the milestones were not on the page). Directorate-General for Communications Networks, Content and Technology, Brussels. Observation year 2025. Accessed 2026-11-03.back
12. 31UNVERIFIED, not opened: NIS Cooperation Group (ed.), Coordinated Implementation Roadmap for the Transition to Post-Quantum Cryptography (national roadmaps by the end of 2026, high-risk use cases by 2030, as many systems as feasible by 2035), taken from secondary summaries in an earlier edition of this series; the milestones were not on the page read. European Commission, Brussels. Observation year 2025. Accessed 2026-11-03.back
13. 30UNVERIFIED, not opened: NSA (ed.), Commercial National Security Algorithm Suite 2.0 advisory and FAQ, cited from memory; the NSA pages returned an access error and no date is used. National Security Agency, Fort Meade. Observation year 2025. Accessed 2026-11-03.back
14. 27UNVERIFIED, not opened: European Union, Regulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elements (Cyber Resilience Act; in force 10 December 2024; reporting duties from 11 September 2026; main obligations from 11 December 2027), dates taken from law-firm search summaries; the Official Journal page returned no text. Observation year 2024. Accessed 2026-11-03.back
15. 21US Securities and Exchange Commission (ed.), SEC adopts rules on cybersecurity risk management, strategy, governance and incident disclosure by public companies (press release 2023-139; adopted 26 July 2023; Form 8-K Item 1.05 within four business days of a materiality determination). SEC, Washington. Observation year 2023. Accessed 2026-11-03.back
16. 5POST-CLOSE, context only: NIST (ed.), Transition to Post-Quantum Cryptography Standards, NIST IR 8547, final (publication page; document history 27 October 2026, after the 30 September evidence close; abstract refers to Executive Order 14412 and OMB Memorandum M-26-15; no dates on the page; PDF not opened). National Institute of Standards and Technology, Gaithersburg. Observation year 2026. Accessed 2026-11-03.back
17. 6NIST (ed.), NIST selects HQC as fifth algorithm for post-quantum encryption (news item, 11 March 2025; backup to ML-KEM; draft standard expected in about a year; final standard expected in 2027). National Institute of Standards and Technology, Gaithersburg. Observation year 2025. Accessed 2026-11-03.back
18. 22Gidney, C., How to factor 2048 bit RSA integers with less than a million noisy qubits, arXiv:2505.15917, submitted 21 May 2025 (abstract page; under one million noisy qubits; under a week; 0.1% gate error; 1 microsecond cycle; 10 microsecond reaction time; the author’s 2019 estimate was about 20 million qubits in 8 hours). arXiv, Ithaca. Observation year 2025. Accessed 2026-11-03.back
19. 37UNVERIFIED, not opened: Shor, P.W., Polynomial-time algorithms for prime factorization and discrete logarithms on a quantum computer, SIAM Journal on Computing 26(5), 1484 to 1509, 1997, cited from memory. Observation year 1997. Accessed 2026-11-03.back
20. 38UNVERIFIED, not opened: Mosca, M., Cybersecurity in an era with quantum computers: will we be ready?, IEEE Security and Privacy 16(5), 38 to 41, 2018, cited from memory. Observation year 2018. Accessed 2026-11-03.back
21. 25Signal (ed.), Signal Protocol and Post-Quantum Ratchets, SPQR triple ratchet (blog post, 2 October 2025; ML-KEM 768; gradual rollout; formal verification). Signal Messenger, Mountain View. Vendor announcement, weak evidence. Observation year 2025. Accessed 2026-11-03.back
22. 26Apple (ed.), iMessage with PQ3: The new state of the art in quantum-secure messaging at scale (security blog post, 21 February 2024; Kyber-1024 and Kyber-768 hybrid with P-256; level 3 on its own scale). Apple, Cupertino. Vendor announcement, weak evidence. Observation year 2024. Accessed 2026-11-03.back
23. 24OpenSSH project (ed.), Post-quantum cryptography in OpenSSH (documentation page; sntrup761x25519-sha512 from 9.0; mlkem768x25519-sha256 added in 9.9 and default in 10.0; warning from 10.1). OpenBSD Project. Observation year 2025. Accessed 2026-11-03.back
24. 43UNVERIFIED, not opened: Rescorla, E., The Transport Layer Security (TLS) Protocol Version 1.3, RFC 8446, Internet Engineering Task Force, August 2018, cited from memory. Observation year 2018. Accessed 2026-11-03.back
25. 32UNVERIFIED, not opened: NIST (ed.), Status Report on the Fourth Round of the NIST Post-Quantum Cryptography Standardization Process, NIST IR 8545, March 2025, cited from memory. National Institute of Standards and Technology, Gaithersburg. Observation year 2025. Accessed 2026-11-03.back
26. 39UNVERIFIED, not opened: NIST National Cybersecurity Center of Excellence (ed.), Migration to Post-Quantum Cryptography, NIST SP 1800-38, cited from memory. National Institute of Standards and Technology, Gaithersburg. Observation year 2023. Accessed 2026-11-03.back
27. 41UNVERIFIED, not opened: US Office of Management and Budget (ed.), Memorandum M-23-02, Migrating to Post-Quantum Cryptography, November 2022, cited from memory. OMB, Washington. Observation year 2022. Accessed 2026-11-03.back
28. 15Federal Bureau of Investigation, Internet Crime Complaint Center (ed.), 2024 Internet Crime Report (859,532 complaints; USD 16.6 billion losses, up 33%; 256,256 complaints with a loss; 3,156 ransomware complaints; 263,455 cyber-threat complaints and USD 1.571 billion; 4,878 critical-infrastructure complaints). FBI, Washington. Observation year 2024. Accessed 2026-11-03.back
29. 16European Union Agency for Cybersecurity (ed.), ENISA Threat Landscape 2025 (publication page; period 1 July 2024 to 30 June 2025; 4,875 incidents analysed; version 1.3 of 22 September 2026 corrected figures; PDF not opened). ENISA, Athens. Observation year 2025. Accessed 2026-11-03.back
30. 20ISC2 (ed.), 2025 Cybersecurity Workforce Study (page; published 4 December 2025; 16,029 respondents; 59% critical or significant skills needs, up from 44%; no workforce gap estimate). ISC2, Alexandria. Observation year 2025. Accessed 2026-11-03.back
31. 17Verizon (ed.), 2026 Data Breach Investigations Report (landing page; period 1 November 2024 to 31 October 2025; 48% of breaches involve ransomware; 31% begin with exploited vulnerabilities). Verizon Business, New York. Vendor report, weak evidence; the full report was not opened. Observation year 2025. Accessed 2026-11-03.back
32. 36UNVERIFIED, not opened: Microsoft (ed.), Microsoft Digital Defense Report 2025, cited from memory; the page returned an error. Microsoft, Redmond. Vendor report, weak evidence. Observation year 2025. Accessed 2026-11-03.back
33. 14CISA and 22 partner agencies (eds.), Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System, advisory AA25-239A (published 27 August 2025; revised 3 September 2025; 23 agencies from 13 countries; known vulnerabilities; no zero-day exploitation observed). Cybersecurity and Infrastructure Security Agency, Arlington. Observation year 2025. Accessed 2026-11-03.back
34. 23Cloudflare (ed.), The state of the post-quantum Internet in 2025 (blog analysis; late October 2025 majority of human traffic with post-quantum key agreement; 3.7% of origins; 39% of top 100,000 domains in September 2025; ML-DSA-44 about 15 kB; first post-quantum certificates expected in 2026). Cloudflare, San Francisco. Vendor analysis of its own network, weak evidence. Observation year 2025. Accessed 2026-11-03.back
35. 12CISA (ed.), Post-Quantum Cryptography Initiative (page; key dates, federal inventory duty under 6 U.S.C. 1526, product categories list, references to Executive Orders 14306, 14412 and 14413 and OMB Memorandum M-26-15). Cybersecurity and Infrastructure Security Agency, Arlington. Observation year 2026. Accessed 2026-11-03.back

7.1Questions for the operational series

1. C-01

   How far has each sector inventoried its cryptography, and how fast is migration to post-quantum methods in each sector?

   INI-XT10-INV-01 · inventory and migration; first output: sector migration register.

2. C-02

   How many certificates and signatures in deployed systems can move to post-quantum methods, and at what size and cost?

   INI-XT10-SIG-02 · signatures and certificates; first output: deployment table.

3. C-03

   What share of embedded and long-life devices can receive cryptographic updates?

   INI-XT10-EDG-03 · long-life devices; first output: device update map.

4. C-04

   How long do exploited vulnerabilities stay open, and how does that compare across sources?

   INI-XT10-KEV-04 · exploitation and patching; first output: time-to-fix series.

5. C-05

   How can migration progress be measured on a common basis?

   INI-XT10-MSR-05 · migration measurement; first output: indicator table.

6. C-06

   Which national roadmaps set migration dates, and how do they differ?

   To be admitted in 2027; first output: roadmap overlay.

7. C-07

   What workforce exists for cryptographic migration and incident response?

   To be admitted in 2027; first output: scoping note.

8. C-08

   Which readiness capabilities have been tested in real migrations, and which are only planned?

   Readiness capability register; first output: rung evidence for 15 functions.

7.2Portfolio proposed for the Q1 2027 alignment

Five initiatives and one Universe mission candidate are proposed for the 2027 cybersecurity and cryptography portfolio. They are programme objects: no partner, funder or member is attached to them in this edition.

7.3The pathway

The cybersecurity and cryptography edition reads national readiness chapters, the coupled sector reports on cyber and digital systems, and the global edition through one governed evidence graph. At baseline the federation is designed; the global energy and lifeline editions are drafted. This page states what exists today and what comes next.

1. 01

   National readiness chapters

   cyber and cryptographic readiness in each national edition

   IN PREPARATION · national baselines

2. 02

   Sector couplings

   GS-13 cyber and digital · XT-02 quantum · SR-10 systemic cyber risk

   GS-13 DRAFTED · sector baselines

3. 03

   Technology system model

   cryptography, deployment, threat, workforce, governance

   v0 SPECIFIED · v1 with federation evidence

4. 04

   Strategic links

   SR-02 lifeline systems · SR-13 strategic technology

   PLANNED · strategic baselines

5. 05

   Universe

   annual proving environment

   CANDIDATE MISSION · mandate in 2027

6. 06

   XT-10 report

   this series

   BASELINE DRAFT · 2027 annual edition

7. 07

   Evidence and correction

   one graph, many projections

   OPEN · first correction cycle in 2027

7.4Universe 2027: evidence pack for the cybersecurity and cryptography candidate mission

1. 01

   Mandate

2. 02

   Core Build · 1 month

3. 03

   Action · 1 week

4. 04

   Evidence seal

5. 05

   Portfolio correction

6. 06

   Next mandate

Mission

ID

MSN-XT10-2027-01 · Signature lag Universe mission

Role spine

Leadership sponsor · Institutional anchor · Mission lead: drawn from national pathways

Receiving actors

to be identified with the mandate

7.5Handoffs and routing

Where the baseline’s findings go next. A handoff routes a finding for awareness, review or work; it transfers no authority.

7.6Feeds and signal register

Escalation routes

• none · keep monitoring
• research question
• project
• risk object
• annual publication
• signal report

Notes

Numbers are the edition’s reference numbers, so a note reads the same in every chapter. The full list, with every source and its licence, is in Annex C. Annex C, references

1. 44NIST (ed.), Transition to Post-Quantum Cryptography Standards, NIST IR 8547, initial public draft (draft PDF, November 2024; Tables 2 and 4: for quantum-vulnerable signature and key-establishment schemes at 112 bits of security strength, deprecated after 2030 and disallowed after 2035, and at 128 bits or more, disallowed after 2035; the cover sheet added on withdrawal on 27 October 2026 is not used). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03.back
2. 23Cloudflare (ed.), The state of the post-quantum Internet in 2025 (blog analysis; late October 2025 majority of human traffic with post-quantum key agreement; 3.7% of origins; 39% of top 100,000 domains in September 2025; ML-DSA-44 about 15 kB; first post-quantum certificates expected in 2026). Cloudflare, San Francisco. Vendor analysis of its own network, weak evidence. Observation year 2025. Accessed 2026-11-03.back
3. 19Chainalysis (ed.), ransomware analysis (blog page; more than USD 820 million on-chain in 2025, down 8% from an updated USD 892 million for 2024; original 2024 estimate USD 813 million). Chainalysis, New York. Vendor estimate, weak evidence. Observation year 2025. Accessed 2026-11-03.back

8.1Cryptographic platforms and protocols

Cryptography reaches users through protocols and libraries. Evidence is strongest for standards texts and open-source defaults, and weakest for signatures and embedded devices.

Related editions

• GLB Global Systems
• GS-13 Cyber and Digital Systems
• SR-10 Digital Public Infrastructure and Systemic Cyber Risk
• XT-02 Quantum Technologies
• XT-01 Artificial Intelligence and Agentic Systems
• XT-11 Blockchain and Distributed Ledgers

8.2Performance, bandwidth and energy of cryptography

Post-quantum objects are larger than the ones they replace. The cost shows first in handshakes and certificate chains.

Related editions

• GLB Global Systems
• GS-13 Cyber and Digital Systems
• SR-10 Digital Public Infrastructure and Systemic Cyber Risk
• XT-02 Quantum Technologies
• XT-01 Artificial Intelligence and Agentic Systems
• XT-11 Blockchain and Distributed Ledgers

8.3Modules, devices and supply chain

Long-life devices and validated modules limit how fast cryptography can change. The sources read give no supply figures.

Related editions

• GLB Global Systems
• GS-13 Cyber and Digital Systems
• SR-10 Digital Public Infrastructure and Systemic Cyber Risk
• XT-02 Quantum Technologies
• XT-01 Artificial Intelligence and Agentic Systems
• XT-11 Blockchain and Distributed Ledgers

8.4Economy, cost and workforce

Cost and workforce evidence is thin and partly from vendors. The figures below are weak evidence and are read as such.

Related editions

• GLB Global Systems
• GS-13 Cyber and Digital Systems
• SR-10 Digital Public Infrastructure and Systemic Cyber Risk
• XT-02 Quantum Technologies
• XT-01 Artificial Intelligence and Agentic Systems
• XT-11 Blockchain and Distributed Ledgers

8.5Security, cryptography and governance watch

Governance is moving on three fronts: migration timelines, product and incident duties, and cybercrime law. Dates differ by authority.

Related editions

• GLB Global Systems
• GS-13 Cyber and Digital Systems
• SR-10 Digital Public Infrastructure and Systemic Cyber Risk
• XT-02 Quantum Technologies
• XT-01 Artificial Intelligence and Agentic Systems
• XT-11 Blockchain and Distributed Ledgers

Notes

Numbers are the edition’s reference numbers, so a note reads the same in every chapter. The full list, with every source and its licence, is in Annex C. Annex C, references

1. 1NIST (ed.), Module-Lattice-Based Key-Encapsulation Mechanism Standard, FIPS 203 (publication page; final 13 August 2024; ML-KEM-512, ML-KEM-768 and ML-KEM-1024; initial draft 24 August 2023). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03.back
2. 2NIST (ed.), Module-Lattice-Based Digital Signature Standard, FIPS 204 (publication page; final 13 August 2024; ML-DSA). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03.back
3. 3NIST (ed.), Stateless Hash-Based Digital Signature Standard, FIPS 205 (publication page; final 13 August 2024; SLH-DSA, based on SPHINCS+). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03.back
4. 24OpenSSH project (ed.), Post-quantum cryptography in OpenSSH (documentation page; sntrup761x25519-sha512 from 9.0; mlkem768x25519-sha256 added in 9.9 and default in 10.0; warning from 10.1). OpenBSD Project. Observation year 2025. Accessed 2026-11-03.back
5. 6NIST (ed.), NIST selects HQC as fifth algorithm for post-quantum encryption (news item, 11 March 2025; backup to ML-KEM; draft standard expected in about a year; final standard expected in 2027). National Institute of Standards and Technology, Gaithersburg. Observation year 2025. Accessed 2026-11-03.back
6. 25Signal (ed.), Signal Protocol and Post-Quantum Ratchets, SPQR triple ratchet (blog post, 2 October 2025; ML-KEM 768; gradual rollout; formal verification). Signal Messenger, Mountain View. Vendor announcement, weak evidence. Observation year 2025. Accessed 2026-11-03.back
7. 26Apple (ed.), iMessage with PQ3: The new state of the art in quantum-secure messaging at scale (security blog post, 21 February 2024; Kyber-1024 and Kyber-768 hybrid with P-256; level 3 on its own scale). Apple, Cupertino. Vendor announcement, weak evidence. Observation year 2024. Accessed 2026-11-03.back
8. 23Cloudflare (ed.), The state of the post-quantum Internet in 2025 (blog analysis; late October 2025 majority of human traffic with post-quantum key agreement; 3.7% of origins; 39% of top 100,000 domains in September 2025; ML-DSA-44 about 15 kB; first post-quantum certificates expected in 2026). Cloudflare, San Francisco. Vendor analysis of its own network, weak evidence. Observation year 2025. Accessed 2026-11-03.back
9. 8NIST (ed.), Ascon-Based Lightweight Cryptography Standards for Constrained Devices, SP 800-232 (publication page; final 13 August 2025; Ascon-AEAD128, Ascon-Hash256, Ascon-XOF128, Ascon-CXOF128). National Institute of Standards and Technology, Gaithersburg. Observation year 2025. Accessed 2026-11-03.back
10. 7NIST (ed.), Recommendations for Key-Encapsulation Mechanisms, SP 800-227 (publication page; final 18 September 2025). National Institute of Standards and Technology, Gaithersburg. Observation year 2025. Accessed 2026-11-03.back
11. 14CISA and 22 partner agencies (eds.), Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System, advisory AA25-239A (published 27 August 2025; revised 3 September 2025; 23 agencies from 13 countries; known vulnerabilities; no zero-day exploitation observed). Cybersecurity and Infrastructure Security Agency, Arlington. Observation year 2025. Accessed 2026-11-03.back
12. 12CISA (ed.), Post-Quantum Cryptography Initiative (page; key dates, federal inventory duty under 6 U.S.C. 1526, product categories list, references to Executive Orders 14306, 14412 and 14413 and OMB Memorandum M-26-15). Cybersecurity and Infrastructure Security Agency, Arlington. Observation year 2026. Accessed 2026-11-03.back
13. 33UNVERIFIED, not opened: NIST (ed.), Security Requirements for Cryptographic Modules, FIPS 140-3, cited from memory. National Institute of Standards and Technology, Gaithersburg. Observation year 2019. Accessed 2026-11-03.back
14. 27UNVERIFIED, not opened: European Union, Regulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elements (Cyber Resilience Act; in force 10 December 2024; reporting duties from 11 September 2026; main obligations from 11 December 2027), dates taken from law-firm search summaries; the Official Journal page returned no text. Observation year 2024. Accessed 2026-11-03.back
15. 40UNVERIFIED, not opened: European Union, Commission Implementing Regulation (EU) 2024/482 establishing the European scheme for cybersecurity of ICT products (EUCC), cited from memory. Observation year 2024. Accessed 2026-11-03.back
16. 18IBM and Ponemon Institute (eds.), Cost of a Data Breach Report 2026 (landing page; global average USD 4.99 million, up 12%; AI-driven attacks up 56%). IBM, Armonk. Vendor report, weak evidence; the full report was not opened. Observation year 2026. Accessed 2026-11-03.back
17. 19Chainalysis (ed.), ransomware analysis (blog page; more than USD 820 million on-chain in 2025, down 8% from an updated USD 892 million for 2024; original 2024 estimate USD 813 million). Chainalysis, New York. Vendor estimate, weak evidence. Observation year 2025. Accessed 2026-11-03.back
18. 20ISC2 (ed.), 2025 Cybersecurity Workforce Study (page; published 4 December 2025; 16,029 respondents; 59% critical or significant skills needs, up from 44%; no workforce gap estimate). ISC2, Alexandria. Observation year 2025. Accessed 2026-11-03.back
19. 15Federal Bureau of Investigation, Internet Crime Complaint Center (ed.), 2024 Internet Crime Report (859,532 complaints; USD 16.6 billion losses, up 33%; 256,256 complaints with a loss; 3,156 ransomware complaints; 263,455 cyber-threat complaints and USD 1.571 billion; 4,878 critical-infrastructure complaints). FBI, Washington. Observation year 2024. Accessed 2026-11-03.back
20. 10UK National Cyber Security Centre (ed.), Timelines for migration to post-quantum cryptography (guidance page; version 1.0, 20 March 2025; milestones 2028, 2031 and 2035). NCSC, London. Observation year 2025. Accessed 2026-11-03.back
21. 21US Securities and Exchange Commission (ed.), SEC adopts rules on cybersecurity risk management, strategy, governance and incident disclosure by public companies (press release 2023-139; adopted 26 July 2023; Form 8-K Item 1.05 within four business days of a materiality determination). SEC, Washington. Observation year 2023. Accessed 2026-11-03.back
22. 11European Commission (ed.), Coordinated Implementation Roadmap for the transition to Post-Quantum Cryptography (library page; published 23 June 2025; the milestones were not on the page). Directorate-General for Communications Networks, Content and Technology, Brussels. Observation year 2025. Accessed 2026-11-03.back
23. 44NIST (ed.), Transition to Post-Quantum Cryptography Standards, NIST IR 8547, initial public draft (draft PDF, November 2024; Tables 2 and 4: for quantum-vulnerable signature and key-establishment schemes at 112 bits of security strength, deprecated after 2030 and disallowed after 2035, and at 128 bits or more, disallowed after 2035; the cover sheet added on withdrawal on 27 October 2026 is not used). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03.back
24. 28UNVERIFIED, not opened: European Union, Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS2), cited from memory without figures. Observation year 2022. Accessed 2026-11-03.back
25. 29UNVERIFIED, not opened: United Nations, Convention against Cybercrime (opened for signature in Hanoi on 25 October 2025; signatory counts of 65, 72, 74 and 75 appear in news and press summaries; entry into force on the ninetieth day after the fortieth ratification), taken from search summaries; the UNODC page returned an error. Observation year 2025. Accessed 2026-11-03.back

A.1Methods

The global baseline uses published values and four simple derivations. Each is shown in full so that any reader can reproduce it.

A.2Model card, Cybersecurity and Cryptography System Model v0

Model ID

MDL-XT10-CRYPTO · v0.1

Purpose

represent cybersecurity and cryptography as protective infrastructure coupled to networks, devices, finance, workforce and regulation

Family

graph-based system of systems

Inputs

the cited sources of this edition; no proprietary data

Method

expert-specified coupling strengths (STRONG · MODERATE · WEAK) from assessments and analogue events

Validation

none yet, first validation against federation evidence in 2027

Uncertainty

qualitative; strengths are hypotheses, not measurements

Domain of validity

global scale; not for asset-, site- or country-level use

Reproducibility

strength table and sources published in this edition

A.3The baseline evidence cut

Every Nexus edition is published from a frozen evidence cut. The global baseline cut is documentary: it pins the exact edition of every source cited. Federation cuts begin with the first national Foundry cuts in 2027.

Cut ID

DC-XTECH-CRYPTO-GLOBAL-2026-B0

Type

baseline documentary cut

Resolution policy

pinned · as of 30 September 2026

Sources pinned

44 cited sources, each at the edition and access date in the references

Model runs

none at baseline, analytical values are stated with their method

Digest

computed at freeze and recorded in the publication record

Supersedes

nothing, first cut of the series

Superseded by

the 2027 cybersecurity and cryptography annual cut

Lineage

1. 01

   source edition

2. 02

   pinned citation

3. 03

   finding

4. 04

   page

5. 05

   publication record

A.4Evidence age and coverage

A 2026 global edition rests on evidence observed in many different years. This page shows each time base, so that no single year label hides older evidence.

A.5Evidence cards, two anchor sources

Evidence cards to follow in 2027

• NIST IR 8547 final⁵: dates for algorithms, if any, in the PDF
• European Commission¹¹: roadmap document with milestones
• NSA³⁰: CNSA 2.0 documents
• Verizon¹⁷ and IBM¹⁸: full reports

A.6Publication acceptance record

Editorial self-check at evidence close. Every applicable item carries a disposition; the remaining items are review, approval and deposit.

A.7Status words

A.8How the edition is made, released and corrected

Every edition is built from a sealed evidence cut, reviewed under three keys, signed and deposited before any site shows it as published; corrections go to Nexus Standards as change proposals and feed the next cut.

A teaching model of the process, not a forecast and not a record of any run; dates and counts on this page come from the programme record. Sources: Reports governance at GCRI Canada (2026); Zenodo, repository of record for Reports deposits (2026).

Lifecycle, one state at a time: Draft, Computed, Evidence bound, Reviewed, Approved for release, Published, Corrected, Superseded. This edition is a draft.

A.9Glossary and abbreviations

A.10Technical annex

A.1 · indicator definition: post-quantum share of human traffic

Construct

share of human-initiated web requests to one network that use hybrid post-quantum key agreement

Unit

percent of requests

Method

vendor measurement on its own network, excluding automated traffic

Source

Cloudflare analysis, 2025²³

Uncertainty

the post states a majority and later over 50%; no exact value was read

Known limits

one network; client support drives the figure; signatures are not covered

Notes

Numbers are the edition’s reference numbers, so a note reads the same in every chapter. The full list, with every source and its licence, is in Annex C. Annex C, references

1. 12CISA (ed.), Post-Quantum Cryptography Initiative (page; key dates, federal inventory duty under 6 U.S.C. 1526, product categories list, references to Executive Orders 14306, 14412 and 14413 and OMB Memorandum M-26-15). Cybersecurity and Infrastructure Security Agency, Arlington. Observation year 2026. Accessed 2026-11-03.back
2. 23Cloudflare (ed.), The state of the post-quantum Internet in 2025 (blog analysis; late October 2025 majority of human traffic with post-quantum key agreement; 3.7% of origins; 39% of top 100,000 domains in September 2025; ML-DSA-44 about 15 kB; first post-quantum certificates expected in 2026). Cloudflare, San Francisco. Vendor analysis of its own network, weak evidence. Observation year 2025. Accessed 2026-11-03.back
3. 11European Commission (ed.), Coordinated Implementation Roadmap for the transition to Post-Quantum Cryptography (library page; published 23 June 2025; the milestones were not on the page). Directorate-General for Communications Networks, Content and Technology, Brussels. Observation year 2025. Accessed 2026-11-03.back
4. 31UNVERIFIED, not opened: NIS Cooperation Group (ed.), Coordinated Implementation Roadmap for the Transition to Post-Quantum Cryptography (national roadmaps by the end of 2026, high-risk use cases by 2030, as many systems as feasible by 2035), taken from secondary summaries in an earlier edition of this series; the milestones were not on the page read. European Commission, Brussels. Observation year 2025. Accessed 2026-11-03.back
5. 30UNVERIFIED, not opened: NSA (ed.), Commercial National Security Algorithm Suite 2.0 advisory and FAQ, cited from memory; the NSA pages returned an access error and no date is used. National Security Agency, Fort Meade. Observation year 2025. Accessed 2026-11-03.back
6. 5POST-CLOSE, context only: NIST (ed.), Transition to Post-Quantum Cryptography Standards, NIST IR 8547, final (publication page; document history 27 October 2026, after the 30 September evidence close; abstract refers to Executive Order 14412 and OMB Memorandum M-26-15; no dates on the page; PDF not opened). National Institute of Standards and Technology, Gaithersburg. Observation year 2026. Accessed 2026-11-03.back
7. 44NIST (ed.), Transition to Post-Quantum Cryptography Standards, NIST IR 8547, initial public draft (draft PDF, November 2024; Tables 2 and 4: for quantum-vulnerable signature and key-establishment schemes at 112 bits of security strength, deprecated after 2030 and disallowed after 2035, and at 128 bits or more, disallowed after 2035; the cover sheet added on withdrawal on 27 October 2026 is not used). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03.back
8. 17Verizon (ed.), 2026 Data Breach Investigations Report (landing page; period 1 November 2024 to 31 October 2025; 48% of breaches involve ransomware; 31% begin with exploited vulnerabilities). Verizon Business, New York. Vendor report, weak evidence; the full report was not opened. Observation year 2025. Accessed 2026-11-03.back
9. 18IBM and Ponemon Institute (eds.), Cost of a Data Breach Report 2026 (landing page; global average USD 4.99 million, up 12%; AI-driven attacks up 56%). IBM, Armonk. Vendor report, weak evidence; the full report was not opened. Observation year 2026. Accessed 2026-11-03.back
10. 19Chainalysis (ed.), ransomware analysis (blog page; more than USD 820 million on-chain in 2025, down 8% from an updated USD 892 million for 2024; original 2024 estimate USD 813 million). Chainalysis, New York. Vendor estimate, weak evidence. Observation year 2025. Accessed 2026-11-03.back
11. 13POST-CLOSE, context only: CISA (ed.), Known Exploited Vulnerabilities Catalog (catalogue page; 1,767 results at the read; newest entry added 2026-11-03). Cybersecurity and Infrastructure Security Agency, Arlington. Observation year 2026. Accessed 2026-11-03.back
12. 34UNVERIFIED, not opened: CVE Program (ed.), CVE metrics page; the page returned no figures. MITRE, Bedford. Observation year 2026. Accessed 2026-11-03.back
13. 16European Union Agency for Cybersecurity (ed.), ENISA Threat Landscape 2025 (publication page; period 1 July 2024 to 30 June 2025; 4,875 incidents analysed; version 1.3 of 22 September 2026 corrected figures; PDF not opened). ENISA, Athens. Observation year 2025. Accessed 2026-11-03.back
14. 35UNVERIFIED, not opened: Europol (ed.), Internet Organised Crime Threat Assessment 2025, cited from memory; the page returned an error. Europol, The Hague. Observation year 2025. Accessed 2026-11-03.back
15. 20ISC2 (ed.), 2025 Cybersecurity Workforce Study (page; published 4 December 2025; 16,029 respondents; 59% critical or significant skills needs, up from 44%; no workforce gap estimate). ISC2, Alexandria. Observation year 2025. Accessed 2026-11-03.back
16. 10UK National Cyber Security Centre (ed.), Timelines for migration to post-quantum cryptography (guidance page; version 1.0, 20 March 2025; milestones 2028, 2031 and 2035). NCSC, London. Observation year 2025. Accessed 2026-11-03.back
17. 1NIST (ed.), Module-Lattice-Based Key-Encapsulation Mechanism Standard, FIPS 203 (publication page; final 13 August 2024; ML-KEM-512, ML-KEM-768 and ML-KEM-1024; initial draft 24 August 2023). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03.back
18. 2NIST (ed.), Module-Lattice-Based Digital Signature Standard, FIPS 204 (publication page; final 13 August 2024; ML-DSA). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03.back
19. 3NIST (ed.), Stateless Hash-Based Digital Signature Standard, FIPS 205 (publication page; final 13 August 2024; SLH-DSA, based on SPHINCS+). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03.back

B.1The indicator set

B.2Global source register

The governed source set behind this edition. Each source keeps its authority, coverage, cadence and role; categories describe origin, not truth.

Domains bound by the register

• INF
• DAT
• FIN
• TRD
• HLT
• ENE
• WAT
• MIN
• CLI
• FOO

B.3Regional reading, cybersecurity and cryptography across ten clusters

Regional plates follow with the regional editions. This page gives the regional reading of cybersecurity and cryptographic readiness in table form and ranks no region.

B.4Cluster card: hybrid key-agreement deployment

• deployment
• key agreement
• protocols
• signatures

Systems in view

web protocol, secure shell, messaging protocols, content networks

Defining events

OpenSSH 10.0 default and the 2025 network measurement²³²⁴

Couplings

GOV → INF timelines; INF → DAT exposure

Capability evidence

open-source defaults and protocol designs reported²⁴²⁵²⁶

Gaps

signature deployment; embedded devices; sector totals

Agenda items

C-02 · C-03

B.5How countries appear in the cybersecurity and cryptography edition

Countries enter the cybersecurity and cryptography edition through the readiness chapters of their own national editions, on one card grammar. They are read against peer distributions and thresholds, never ranked.

Editions in the 2026 Baseline programme

How to read a country card

• Each system is shown against the distribution of its peers, with thresholds where they exist
• Couplings and risk objects come from the country’s own national edition
• Capability rungs record evidence, not a judgement of institutions
• Evidence age is printed, so older national data are visible as such

B.6Licences

B.7Formats and provenance

Provenance

Edition pack

The edition’s content pack (JSON), from which the print and web editions are built

Evidence cut

DC-XTECH-CRYPTO-GLOBAL-2026-B0, closed 30 September 2026

Reproducibility

sourced values cited; analytical values reproducible from stated parameters

Self-check

14 of 23 at evidence close; a fail on any item blocks release

Review

five passes scheduled before release (in Annex C)

Publisher of record

GCRI for the Nexus Consortium

Corrections

Registry correction pathway; upheld corrections are published as notices with a new version

Notes

Numbers are the edition’s reference numbers, so a note reads the same in every chapter. The full list, with every source and its licence, is in Annex C. Annex C, references

1. 1NIST (ed.), Module-Lattice-Based Key-Encapsulation Mechanism Standard, FIPS 203 (publication page; final 13 August 2024; ML-KEM-512, ML-KEM-768 and ML-KEM-1024; initial draft 24 August 2023). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03.back
2. 2NIST (ed.), Module-Lattice-Based Digital Signature Standard, FIPS 204 (publication page; final 13 August 2024; ML-DSA). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03.back
3. 3NIST (ed.), Stateless Hash-Based Digital Signature Standard, FIPS 205 (publication page; final 13 August 2024; SLH-DSA, based on SPHINCS+). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03.back
4. 44NIST (ed.), Transition to Post-Quantum Cryptography Standards, NIST IR 8547, initial public draft (draft PDF, November 2024; Tables 2 and 4: for quantum-vulnerable signature and key-establishment schemes at 112 bits of security strength, deprecated after 2030 and disallowed after 2035, and at 128 bits or more, disallowed after 2035; the cover sheet added on withdrawal on 27 October 2026 is not used). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03.back
5. 5POST-CLOSE, context only: NIST (ed.), Transition to Post-Quantum Cryptography Standards, NIST IR 8547, final (publication page; document history 27 October 2026, after the 30 September evidence close; abstract refers to Executive Order 14412 and OMB Memorandum M-26-15; no dates on the page; PDF not opened). National Institute of Standards and Technology, Gaithersburg. Observation year 2026. Accessed 2026-11-03.back
6. 6NIST (ed.), NIST selects HQC as fifth algorithm for post-quantum encryption (news item, 11 March 2025; backup to ML-KEM; draft standard expected in about a year; final standard expected in 2027). National Institute of Standards and Technology, Gaithersburg. Observation year 2025. Accessed 2026-11-03.back
7. 10UK National Cyber Security Centre (ed.), Timelines for migration to post-quantum cryptography (guidance page; version 1.0, 20 March 2025; milestones 2028, 2031 and 2035). NCSC, London. Observation year 2025. Accessed 2026-11-03.back
8. 22Gidney, C., How to factor 2048 bit RSA integers with less than a million noisy qubits, arXiv:2505.15917, submitted 21 May 2025 (abstract page; under one million noisy qubits; under a week; 0.1% gate error; 1 microsecond cycle; 10 microsecond reaction time; the author’s 2019 estimate was about 20 million qubits in 8 hours). arXiv, Ithaca. Observation year 2025. Accessed 2026-11-03.back
9. 23Cloudflare (ed.), The state of the post-quantum Internet in 2025 (blog analysis; late October 2025 majority of human traffic with post-quantum key agreement; 3.7% of origins; 39% of top 100,000 domains in September 2025; ML-DSA-44 about 15 kB; first post-quantum certificates expected in 2026). Cloudflare, San Francisco. Vendor analysis of its own network, weak evidence. Observation year 2025. Accessed 2026-11-03.back
10. 14CISA and 22 partner agencies (eds.), Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System, advisory AA25-239A (published 27 August 2025; revised 3 September 2025; 23 agencies from 13 countries; known vulnerabilities; no zero-day exploitation observed). Cybersecurity and Infrastructure Security Agency, Arlington. Observation year 2025. Accessed 2026-11-03.back
11. 15Federal Bureau of Investigation, Internet Crime Complaint Center (ed.), 2024 Internet Crime Report (859,532 complaints; USD 16.6 billion losses, up 33%; 256,256 complaints with a loss; 3,156 ransomware complaints; 263,455 cyber-threat complaints and USD 1.571 billion; 4,878 critical-infrastructure complaints). FBI, Washington. Observation year 2024. Accessed 2026-11-03.back
12. 16European Union Agency for Cybersecurity (ed.), ENISA Threat Landscape 2025 (publication page; period 1 July 2024 to 30 June 2025; 4,875 incidents analysed; version 1.3 of 22 September 2026 corrected figures; PDF not opened). ENISA, Athens. Observation year 2025. Accessed 2026-11-03.back
13. 11European Commission (ed.), Coordinated Implementation Roadmap for the transition to Post-Quantum Cryptography (library page; published 23 June 2025; the milestones were not on the page). Directorate-General for Communications Networks, Content and Technology, Brussels. Observation year 2025. Accessed 2026-11-03.back
14. 13POST-CLOSE, context only: CISA (ed.), Known Exploited Vulnerabilities Catalog (catalogue page; 1,767 results at the read; newest entry added 2026-11-03). Cybersecurity and Infrastructure Security Agency, Arlington. Observation year 2026. Accessed 2026-11-03.back
15. 18IBM and Ponemon Institute (eds.), Cost of a Data Breach Report 2026 (landing page; global average USD 4.99 million, up 12%; AI-driven attacks up 56%). IBM, Armonk. Vendor report, weak evidence; the full report was not opened. Observation year 2026. Accessed 2026-11-03.back
16. 20ISC2 (ed.), 2025 Cybersecurity Workforce Study (page; published 4 December 2025; 16,029 respondents; 59% critical or significant skills needs, up from 44%; no workforce gap estimate). ISC2, Alexandria. Observation year 2025. Accessed 2026-11-03.back
17. 12CISA (ed.), Post-Quantum Cryptography Initiative (page; key dates, federal inventory duty under 6 U.S.C. 1526, product categories list, references to Executive Orders 14306, 14412 and 14413 and OMB Memorandum M-26-15). Cybersecurity and Infrastructure Security Agency, Arlington. Observation year 2026. Accessed 2026-11-03.back
18. 29UNVERIFIED, not opened: United Nations, Convention against Cybercrime (opened for signature in Hanoi on 25 October 2025; signatory counts of 65, 72, 74 and 75 appear in news and press summaries; entry into force on the ninetieth day after the fortieth ratification), taken from search summaries; the UNODC page returned an error. Observation year 2025. Accessed 2026-11-03.back
19. 24OpenSSH project (ed.), Post-quantum cryptography in OpenSSH (documentation page; sntrup761x25519-sha512 from 9.0; mlkem768x25519-sha256 added in 9.9 and default in 10.0; warning from 10.1). OpenBSD Project. Observation year 2025. Accessed 2026-11-03.back
20. 25Signal (ed.), Signal Protocol and Post-Quantum Ratchets, SPQR triple ratchet (blog post, 2 October 2025; ML-KEM 768; gradual rollout; formal verification). Signal Messenger, Mountain View. Vendor announcement, weak evidence. Observation year 2025. Accessed 2026-11-03.back
21. 26Apple (ed.), iMessage with PQ3: The new state of the art in quantum-secure messaging at scale (security blog post, 21 February 2024; Kyber-1024 and Kyber-768 hybrid with P-256; level 3 on its own scale). Apple, Cupertino. Vendor announcement, weak evidence. Observation year 2024. Accessed 2026-11-03.back

C.144 sources

NR-CIT-1, editor first. A DOI is linked where the source has one; Nexus records carry a UNI once the catalogue allocates it (NS-1).

1. 1NIST (ed.), Module-Lattice-Based Key-Encapsulation Mechanism Standard, FIPS 203 (publication page; final 13 August 2024; ML-KEM-512, ML-KEM-768 and ML-KEM-1024; initial draft 24 August 2023). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03. Cited in the summary, chapter 1, chapter 2, chapter 3, chapter 4, chapter 5, chapter 6, chapter 8
2. 2NIST (ed.), Module-Lattice-Based Digital Signature Standard, FIPS 204 (publication page; final 13 August 2024; ML-DSA). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03. Cited in the summary, chapter 1, chapter 2, chapter 3, chapter 6, chapter 8
3. 3NIST (ed.), Stateless Hash-Based Digital Signature Standard, FIPS 205 (publication page; final 13 August 2024; SLH-DSA, based on SPHINCS+). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03. Cited in the summary, chapter 1, chapter 2, chapter 3, chapter 6, chapter 8
4. 4POST-CLOSE, context only: NIST (ed.), Transition to Post-Quantum Cryptography Standards, NIST IR 8547, initial public draft (publication page; published 12 November 2024; the page states no deprecation dates and records the draft as obsoleted on 27 October 2026). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03.
5. 5POST-CLOSE, context only: NIST (ed.), Transition to Post-Quantum Cryptography Standards, NIST IR 8547, final (publication page; document history 27 October 2026, after the 30 September evidence close; abstract refers to Executive Order 14412 and OMB Memorandum M-26-15; no dates on the page; PDF not opened). National Institute of Standards and Technology, Gaithersburg. Observation year 2026. Accessed 2026-11-03. Cited in chapter 6
6. 6NIST (ed.), NIST selects HQC as fifth algorithm for post-quantum encryption (news item, 11 March 2025; backup to ML-KEM; draft standard expected in about a year; final standard expected in 2027). National Institute of Standards and Technology, Gaithersburg. Observation year 2025. Accessed 2026-11-03. Cited in the summary, chapter 1, chapter 2, chapter 4, chapter 6, chapter 8
7. 7NIST (ed.), Recommendations for Key-Encapsulation Mechanisms, SP 800-227 (publication page; final 18 September 2025). National Institute of Standards and Technology, Gaithersburg. Observation year 2025. Accessed 2026-11-03. Cited in the summary, chapter 2, chapter 4, chapter 6, chapter 8
8. 8NIST (ed.), Ascon-Based Lightweight Cryptography Standards for Constrained Devices, SP 800-232 (publication page; final 13 August 2025; Ascon-AEAD128, Ascon-Hash256, Ascon-XOF128, Ascon-CXOF128). National Institute of Standards and Technology, Gaithersburg. Observation year 2025. Accessed 2026-11-03. Cited in chapter 6, chapter 8
9. 9NIST (ed.), The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29 (publication page; 26 February 2024). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03. Cited in chapter 4, chapter 6
10. 10UK National Cyber Security Centre (ed.), Timelines for migration to post-quantum cryptography (guidance page; version 1.0, 20 March 2025; milestones 2028, 2031 and 2035). NCSC, London. Observation year 2025. Accessed 2026-11-03. Cited in the summary, chapter 1, chapter 2, chapter 3, chapter 4, chapter 6, chapter 8
11. 11European Commission (ed.), Coordinated Implementation Roadmap for the transition to Post-Quantum Cryptography (library page; published 23 June 2025; the milestones were not on the page). Directorate-General for Communications Networks, Content and Technology, Brussels. Observation year 2025. Accessed 2026-11-03. Cited in chapter 3, chapter 4, chapter 6, chapter 8
12. 12CISA (ed.), Post-Quantum Cryptography Initiative (page; key dates, federal inventory duty under 6 U.S.C. 1526, product categories list, references to Executive Orders 14306, 14412 and 14413 and OMB Memorandum M-26-15). Cybersecurity and Infrastructure Security Agency, Arlington. Observation year 2026. Accessed 2026-11-03. Cited in chapter 4, chapter 6, chapter 8
13. 13POST-CLOSE, context only: CISA (ed.), Known Exploited Vulnerabilities Catalog (catalogue page; 1,767 results at the read; newest entry added 2026-11-03). Cybersecurity and Infrastructure Security Agency, Arlington. Observation year 2026. Accessed 2026-11-03. Cited in the summary, chapter 1, chapter 3, chapter 4
14. 14CISA and 22 partner agencies (eds.), Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System, advisory AA25-239A (published 27 August 2025; revised 3 September 2025; 23 agencies from 13 countries; known vulnerabilities; no zero-day exploitation observed). Cybersecurity and Infrastructure Security Agency, Arlington. Observation year 2025. Accessed 2026-11-03. Cited in the summary, chapter 1, chapter 2, chapter 3, chapter 4, chapter 6, chapter 8
15. 15Federal Bureau of Investigation, Internet Crime Complaint Center (ed.), 2024 Internet Crime Report (859,532 complaints; USD 16.6 billion losses, up 33%; 256,256 complaints with a loss; 3,156 ransomware complaints; 263,455 cyber-threat complaints and USD 1.571 billion; 4,878 critical-infrastructure complaints). FBI, Washington. Observation year 2024. Accessed 2026-11-03. Cited in the summary, chapter 1, chapter 2, chapter 3, chapter 6, chapter 8
16. 16European Union Agency for Cybersecurity (ed.), ENISA Threat Landscape 2025 (publication page; period 1 July 2024 to 30 June 2025; 4,875 incidents analysed; version 1.3 of 22 September 2026 corrected figures; PDF not opened). ENISA, Athens. Observation year 2025. Accessed 2026-11-03. Cited in chapter 6
17. 17Verizon (ed.), 2026 Data Breach Investigations Report (landing page; period 1 November 2024 to 31 October 2025; 48% of breaches involve ransomware; 31% begin with exploited vulnerabilities). Verizon Business, New York. Vendor report, weak evidence; the full report was not opened. Observation year 2025. Accessed 2026-11-03. Cited in chapter 2, chapter 6
18. 18IBM and Ponemon Institute (eds.), Cost of a Data Breach Report 2026 (landing page; global average USD 4.99 million, up 12%; AI-driven attacks up 56%). IBM, Armonk. Vendor report, weak evidence; the full report was not opened. Observation year 2026. Accessed 2026-11-03. Cited in the summary, chapter 1, chapter 2, chapter 3, chapter 4, chapter 6, chapter 8
19. 19Chainalysis (ed.), ransomware analysis (blog page; more than USD 820 million on-chain in 2025, down 8% from an updated USD 892 million for 2024; original 2024 estimate USD 813 million). Chainalysis, New York. Vendor estimate, weak evidence. Observation year 2025. Accessed 2026-11-03. Cited in chapter 1, chapter 2, chapter 3, chapter 6, chapter 7, chapter 8
20. 20ISC2 (ed.), 2025 Cybersecurity Workforce Study (page; published 4 December 2025; 16,029 respondents; 59% critical or significant skills needs, up from 44%; no workforce gap estimate). ISC2, Alexandria. Observation year 2025. Accessed 2026-11-03. Cited in the summary, chapter 1, chapter 2, chapter 4, chapter 6, chapter 8
21. 21US Securities and Exchange Commission (ed.), SEC adopts rules on cybersecurity risk management, strategy, governance and incident disclosure by public companies (press release 2023-139; adopted 26 July 2023; Form 8-K Item 1.05 within four business days of a materiality determination). SEC, Washington. Observation year 2023. Accessed 2026-11-03. Cited in chapter 1, chapter 6, chapter 8
22. 22Gidney, C., How to factor 2048 bit RSA integers with less than a million noisy qubits, arXiv:2505.15917, submitted 21 May 2025 (abstract page; under one million noisy qubits; under a week; 0.1% gate error; 1 microsecond cycle; 10 microsecond reaction time; the author’s 2019 estimate was about 20 million qubits in 8 hours). arXiv, Ithaca. Observation year 2025. Accessed 2026-11-03. Cited in the summary, chapter 1, chapter 2, chapter 3, chapter 4, chapter 5, chapter 6
23. 23Cloudflare (ed.), The state of the post-quantum Internet in 2025 (blog analysis; late October 2025 majority of human traffic with post-quantum key agreement; 3.7% of origins; 39% of top 100,000 domains in September 2025; ML-DSA-44 about 15 kB; first post-quantum certificates expected in 2026). Cloudflare, San Francisco. Vendor analysis of its own network, weak evidence. Observation year 2025. Accessed 2026-11-03. Cited in the summary, chapter 1, chapter 2, chapter 3, chapter 4, chapter 6, chapter 7, chapter 8
24. 24OpenSSH project (ed.), Post-quantum cryptography in OpenSSH (documentation page; sntrup761x25519-sha512 from 9.0; mlkem768x25519-sha256 added in 9.9 and default in 10.0; warning from 10.1). OpenBSD Project. Observation year 2025. Accessed 2026-11-03. Cited in the summary, chapter 1, chapter 2, chapter 4, chapter 6, chapter 8
25. 25Signal (ed.), Signal Protocol and Post-Quantum Ratchets, SPQR triple ratchet (blog post, 2 October 2025; ML-KEM 768; gradual rollout; formal verification). Signal Messenger, Mountain View. Vendor announcement, weak evidence. Observation year 2025. Accessed 2026-11-03. Cited in chapter 1, chapter 6, chapter 8
26. 26Apple (ed.), iMessage with PQ3: The new state of the art in quantum-secure messaging at scale (security blog post, 21 February 2024; Kyber-1024 and Kyber-768 hybrid with P-256; level 3 on its own scale). Apple, Cupertino. Vendor announcement, weak evidence. Observation year 2024. Accessed 2026-11-03. Cited in chapter 1, chapter 6, chapter 8
27. 27UNVERIFIED, not opened: European Union, Regulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elements (Cyber Resilience Act; in force 10 December 2024; reporting duties from 11 September 2026; main obligations from 11 December 2027), dates taken from law-firm search summaries; the Official Journal page returned no text. Observation year 2024. Accessed 2026-11-03. Cited in chapter 1, chapter 6, chapter 8
28. 28UNVERIFIED, not opened: European Union, Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS2), cited from memory without figures. Observation year 2022. Accessed 2026-11-03. Cited in chapter 8
29. 29UNVERIFIED, not opened: United Nations, Convention against Cybercrime (opened for signature in Hanoi on 25 October 2025; signatory counts of 65, 72, 74 and 75 appear in news and press summaries; entry into force on the ninetieth day after the fortieth ratification), taken from search summaries; the UNODC page returned an error. Observation year 2025. Accessed 2026-11-03. Cited in chapter 8
30. 30UNVERIFIED, not opened: NSA (ed.), Commercial National Security Algorithm Suite 2.0 advisory and FAQ, cited from memory; the NSA pages returned an access error and no date is used. National Security Agency, Fort Meade. Observation year 2025. Accessed 2026-11-03. Cited in chapter 6
31. 31UNVERIFIED, not opened: NIS Cooperation Group (ed.), Coordinated Implementation Roadmap for the Transition to Post-Quantum Cryptography (national roadmaps by the end of 2026, high-risk use cases by 2030, as many systems as feasible by 2035), taken from secondary summaries in an earlier edition of this series; the milestones were not on the page read. European Commission, Brussels. Observation year 2025. Accessed 2026-11-03. Cited in chapter 6
32. 32UNVERIFIED, not opened: NIST (ed.), Status Report on the Fourth Round of the NIST Post-Quantum Cryptography Standardization Process, NIST IR 8545, March 2025, cited from memory. National Institute of Standards and Technology, Gaithersburg. Observation year 2025. Accessed 2026-11-03. Cited in chapter 2, chapter 6
33. 33UNVERIFIED, not opened: NIST (ed.), Security Requirements for Cryptographic Modules, FIPS 140-3, cited from memory. National Institute of Standards and Technology, Gaithersburg. Observation year 2019. Accessed 2026-11-03. Cited in chapter 8
34. 34UNVERIFIED, not opened: CVE Program (ed.), CVE metrics page; the page returned no figures. MITRE, Bedford. Observation year 2026. Accessed 2026-11-03.
35. 35UNVERIFIED, not opened: Europol (ed.), Internet Organised Crime Threat Assessment 2025, cited from memory; the page returned an error. Europol, The Hague. Observation year 2025. Accessed 2026-11-03.
36. 36UNVERIFIED, not opened: Microsoft (ed.), Microsoft Digital Defense Report 2025, cited from memory; the page returned an error. Microsoft, Redmond. Vendor report, weak evidence. Observation year 2025. Accessed 2026-11-03. Cited in chapter 6
37. 37UNVERIFIED, not opened: Shor, P.W., Polynomial-time algorithms for prime factorization and discrete logarithms on a quantum computer, SIAM Journal on Computing 26(5), 1484 to 1509, 1997, cited from memory. Observation year 1997. Accessed 2026-11-03. Cited in chapter 2, chapter 6
38. 38UNVERIFIED, not opened: Mosca, M., Cybersecurity in an era with quantum computers: will we be ready?, IEEE Security and Privacy 16(5), 38 to 41, 2018, cited from memory. Observation year 2018. Accessed 2026-11-03. Cited in chapter 6
39. 39UNVERIFIED, not opened: NIST National Cybersecurity Center of Excellence (ed.), Migration to Post-Quantum Cryptography, NIST SP 1800-38, cited from memory. National Institute of Standards and Technology, Gaithersburg. Observation year 2023. Accessed 2026-11-03. Cited in chapter 6
40. 40UNVERIFIED, not opened: European Union, Commission Implementing Regulation (EU) 2024/482 establishing the European scheme for cybersecurity of ICT products (EUCC), cited from memory. Observation year 2024. Accessed 2026-11-03. Cited in chapter 8
41. 41UNVERIFIED, not opened: US Office of Management and Budget (ed.), Memorandum M-23-02, Migrating to Post-Quantum Cryptography, November 2022, cited from memory. OMB, Washington. Observation year 2022. Accessed 2026-11-03. Cited in chapter 6
42. 42UNVERIFIED, not opened: NIST (ed.), additional digital signature schemes for the post-quantum project (on-ramp), cited from memory; the project page returned an error. National Institute of Standards and Technology, Gaithersburg. Observation year 2025. Accessed 2026-11-03. Cited in chapter 4
43. 43UNVERIFIED, not opened: Rescorla, E., The Transport Layer Security (TLS) Protocol Version 1.3, RFC 8446, Internet Engineering Task Force, August 2018, cited from memory. Observation year 2018. Accessed 2026-11-03. Cited in chapter 6
44. 44NIST (ed.), Transition to Post-Quantum Cryptography Standards, NIST IR 8547, initial public draft (draft PDF, November 2024; Tables 2 and 4: for quantum-vulnerable signature and key-establishment schemes at 112 bits of security strength, deprecated after 2030 and disallowed after 2035, and at 128 bits or more, disallowed after 2035; the cover sheet added on withdrawal on 27 October 2026 is not used). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03. Cited in the summary, chapter 1, chapter 2, chapter 3, chapter 4, chapter 6, chapter 7, chapter 8

C.2Publication record

Colophon

Format

A4 portrait · screen, print and archival PDF

Typefaces

Space Grotesk (display) · Geist (text) · IBM Plex Sans Italic (standfirsts) · IBM Plex Mono (data)

Design standard

Reports Foundational Edition, Volume I, Part VII

Accessibility

tagged PDF and HTML targets; text alternatives for every figure

Production

Reports editorial team, GCRI

Release path for this version