References and record
Every source the edition rests on, the publication record, the corrections log and the open record.
Contents
- ·Edition home
- ·Executive summary
- 1Cryptography is infrastructure under change
- 2Key findings
- 3Systems and sectors at baseline
- 4Risks and capability
- 5Signature lag while key agreement migrates
- 6Readings from the other desks
- 7The 2027 agenda
- 8Systems in depth
- AMethodology
- BData appendix
- CReferences and record
- ·Complete edition, for print
C.144 sources
NR-CIT-1, editor first. A DOI is linked where the source has one; Nexus records carry a UNI once the catalogue allocates it (NS-1).
- 1NIST (ed.), Module-Lattice-Based Key-Encapsulation Mechanism Standard, FIPS 203 (publication page; final 13 August 2024; ML-KEM-512, ML-KEM-768 and ML-KEM-1024; initial draft 24 August 2023). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03. Cited in the summary, chapter 1, chapter 2, chapter 3, chapter 4, chapter 5, chapter 6, chapter 8
- 2NIST (ed.), Module-Lattice-Based Digital Signature Standard, FIPS 204 (publication page; final 13 August 2024; ML-DSA). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03. Cited in the summary, chapter 1, chapter 2, chapter 3, chapter 6, chapter 8
- 3NIST (ed.), Stateless Hash-Based Digital Signature Standard, FIPS 205 (publication page; final 13 August 2024; SLH-DSA, based on SPHINCS+). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03. Cited in the summary, chapter 1, chapter 2, chapter 3, chapter 6, chapter 8
- 4POST-CLOSE, context only: NIST (ed.), Transition to Post-Quantum Cryptography Standards, NIST IR 8547, initial public draft (publication page; published 12 November 2024; the page states no deprecation dates and records the draft as obsoleted on 27 October 2026). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03.
- 5POST-CLOSE, context only: NIST (ed.), Transition to Post-Quantum Cryptography Standards, NIST IR 8547, final (publication page; document history 27 October 2026, after the 30 September evidence close; abstract refers to Executive Order 14412 and OMB Memorandum M-26-15; no dates on the page; PDF not opened). National Institute of Standards and Technology, Gaithersburg. Observation year 2026. Accessed 2026-11-03. Cited in chapter 6
- 6NIST (ed.), NIST selects HQC as fifth algorithm for post-quantum encryption (news item, 11 March 2025; backup to ML-KEM; draft standard expected in about a year; final standard expected in 2027). National Institute of Standards and Technology, Gaithersburg. Observation year 2025. Accessed 2026-11-03. Cited in the summary, chapter 1, chapter 2, chapter 4, chapter 6, chapter 8
- 7NIST (ed.), Recommendations for Key-Encapsulation Mechanisms, SP 800-227 (publication page; final 18 September 2025). National Institute of Standards and Technology, Gaithersburg. Observation year 2025. Accessed 2026-11-03. Cited in the summary, chapter 2, chapter 4, chapter 6, chapter 8
- 8NIST (ed.), Ascon-Based Lightweight Cryptography Standards for Constrained Devices, SP 800-232 (publication page; final 13 August 2025; Ascon-AEAD128, Ascon-Hash256, Ascon-XOF128, Ascon-CXOF128). National Institute of Standards and Technology, Gaithersburg. Observation year 2025. Accessed 2026-11-03. Cited in chapter 6, chapter 8
- 9NIST (ed.), The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29 (publication page; 26 February 2024). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03. Cited in chapter 4, chapter 6
- 10UK National Cyber Security Centre (ed.), Timelines for migration to post-quantum cryptography (guidance page; version 1.0, 20 March 2025; milestones 2028, 2031 and 2035). NCSC, London. Observation year 2025. Accessed 2026-11-03. Cited in the summary, chapter 1, chapter 2, chapter 3, chapter 4, chapter 6, chapter 8
- 11European Commission (ed.), Coordinated Implementation Roadmap for the transition to Post-Quantum Cryptography (library page; published 23 June 2025; the milestones were not on the page). Directorate-General for Communications Networks, Content and Technology, Brussels. Observation year 2025. Accessed 2026-11-03. Cited in chapter 3, chapter 4, chapter 6, chapter 8
- 12CISA (ed.), Post-Quantum Cryptography Initiative (page; key dates, federal inventory duty under 6 U.S.C. 1526, product categories list, references to Executive Orders 14306, 14412 and 14413 and OMB Memorandum M-26-15). Cybersecurity and Infrastructure Security Agency, Arlington. Observation year 2026. Accessed 2026-11-03. Cited in chapter 4, chapter 6, chapter 8
- 13POST-CLOSE, context only: CISA (ed.), Known Exploited Vulnerabilities Catalog (catalogue page; 1,767 results at the read; newest entry added 2026-11-03). Cybersecurity and Infrastructure Security Agency, Arlington. Observation year 2026. Accessed 2026-11-03. Cited in the summary, chapter 1, chapter 3, chapter 4
- 14CISA and 22 partner agencies (eds.), Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System, advisory AA25-239A (published 27 August 2025; revised 3 September 2025; 23 agencies from 13 countries; known vulnerabilities; no zero-day exploitation observed). Cybersecurity and Infrastructure Security Agency, Arlington. Observation year 2025. Accessed 2026-11-03. Cited in the summary, chapter 1, chapter 2, chapter 3, chapter 4, chapter 6, chapter 8
- 15Federal Bureau of Investigation, Internet Crime Complaint Center (ed.), 2024 Internet Crime Report (859,532 complaints; USD 16.6 billion losses, up 33%; 256,256 complaints with a loss; 3,156 ransomware complaints; 263,455 cyber-threat complaints and USD 1.571 billion; 4,878 critical-infrastructure complaints). FBI, Washington. Observation year 2024. Accessed 2026-11-03. Cited in the summary, chapter 1, chapter 2, chapter 3, chapter 6, chapter 8
- 16European Union Agency for Cybersecurity (ed.), ENISA Threat Landscape 2025 (publication page; period 1 July 2024 to 30 June 2025; 4,875 incidents analysed; version 1.3 of 22 September 2026 corrected figures; PDF not opened). ENISA, Athens. Observation year 2025. Accessed 2026-11-03. Cited in chapter 6
- 17Verizon (ed.), 2026 Data Breach Investigations Report (landing page; period 1 November 2024 to 31 October 2025; 48% of breaches involve ransomware; 31% begin with exploited vulnerabilities). Verizon Business, New York. Vendor report, weak evidence; the full report was not opened. Observation year 2025. Accessed 2026-11-03. Cited in chapter 2, chapter 6
- 18IBM and Ponemon Institute (eds.), Cost of a Data Breach Report 2026 (landing page; global average USD 4.99 million, up 12%; AI-driven attacks up 56%). IBM, Armonk. Vendor report, weak evidence; the full report was not opened. Observation year 2026. Accessed 2026-11-03. Cited in the summary, chapter 1, chapter 2, chapter 3, chapter 4, chapter 6, chapter 8
- 19Chainalysis (ed.), ransomware analysis (blog page; more than USD 820 million on-chain in 2025, down 8% from an updated USD 892 million for 2024; original 2024 estimate USD 813 million). Chainalysis, New York. Vendor estimate, weak evidence. Observation year 2025. Accessed 2026-11-03. Cited in chapter 1, chapter 2, chapter 3, chapter 6, chapter 7, chapter 8
- 20ISC2 (ed.), 2025 Cybersecurity Workforce Study (page; published 4 December 2025; 16,029 respondents; 59% critical or significant skills needs, up from 44%; no workforce gap estimate). ISC2, Alexandria. Observation year 2025. Accessed 2026-11-03. Cited in the summary, chapter 1, chapter 2, chapter 4, chapter 6, chapter 8
- 21US Securities and Exchange Commission (ed.), SEC adopts rules on cybersecurity risk management, strategy, governance and incident disclosure by public companies (press release 2023-139; adopted 26 July 2023; Form 8-K Item 1.05 within four business days of a materiality determination). SEC, Washington. Observation year 2023. Accessed 2026-11-03. Cited in chapter 1, chapter 6, chapter 8
- 22Gidney, C., How to factor 2048 bit RSA integers with less than a million noisy qubits, arXiv:2505.15917, submitted 21 May 2025 (abstract page; under one million noisy qubits; under a week; 0.1% gate error; 1 microsecond cycle; 10 microsecond reaction time; the author’s 2019 estimate was about 20 million qubits in 8 hours). arXiv, Ithaca. Observation year 2025. Accessed 2026-11-03. Cited in the summary, chapter 1, chapter 2, chapter 3, chapter 4, chapter 5, chapter 6
- 23Cloudflare (ed.), The state of the post-quantum Internet in 2025 (blog analysis; late October 2025 majority of human traffic with post-quantum key agreement; 3.7% of origins; 39% of top 100,000 domains in September 2025; ML-DSA-44 about 15 kB; first post-quantum certificates expected in 2026). Cloudflare, San Francisco. Vendor analysis of its own network, weak evidence. Observation year 2025. Accessed 2026-11-03. Cited in the summary, chapter 1, chapter 2, chapter 3, chapter 4, chapter 6, chapter 7, chapter 8
- 24OpenSSH project (ed.), Post-quantum cryptography in OpenSSH (documentation page; sntrup761x25519-sha512 from 9.0; mlkem768x25519-sha256 added in 9.9 and default in 10.0; warning from 10.1). OpenBSD Project. Observation year 2025. Accessed 2026-11-03. Cited in the summary, chapter 1, chapter 2, chapter 4, chapter 6, chapter 8
- 25Signal (ed.), Signal Protocol and Post-Quantum Ratchets, SPQR triple ratchet (blog post, 2 October 2025; ML-KEM 768; gradual rollout; formal verification). Signal Messenger, Mountain View. Vendor announcement, weak evidence. Observation year 2025. Accessed 2026-11-03. Cited in chapter 1, chapter 6, chapter 8
- 26Apple (ed.), iMessage with PQ3: The new state of the art in quantum-secure messaging at scale (security blog post, 21 February 2024; Kyber-1024 and Kyber-768 hybrid with P-256; level 3 on its own scale). Apple, Cupertino. Vendor announcement, weak evidence. Observation year 2024. Accessed 2026-11-03. Cited in chapter 1, chapter 6, chapter 8
- 27UNVERIFIED, not opened: European Union, Regulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elements (Cyber Resilience Act; in force 10 December 2024; reporting duties from 11 September 2026; main obligations from 11 December 2027), dates taken from law-firm search summaries; the Official Journal page returned no text. Observation year 2024. Accessed 2026-11-03. Cited in chapter 1, chapter 6, chapter 8
- 28UNVERIFIED, not opened: European Union, Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS2), cited from memory without figures. Observation year 2022. Accessed 2026-11-03. Cited in chapter 8
- 29UNVERIFIED, not opened: United Nations, Convention against Cybercrime (opened for signature in Hanoi on 25 October 2025; signatory counts of 65, 72, 74 and 75 appear in news and press summaries; entry into force on the ninetieth day after the fortieth ratification), taken from search summaries; the UNODC page returned an error. Observation year 2025. Accessed 2026-11-03. Cited in chapter 8
- 30UNVERIFIED, not opened: NSA (ed.), Commercial National Security Algorithm Suite 2.0 advisory and FAQ, cited from memory; the NSA pages returned an access error and no date is used. National Security Agency, Fort Meade. Observation year 2025. Accessed 2026-11-03. Cited in chapter 6
- 31UNVERIFIED, not opened: NIS Cooperation Group (ed.), Coordinated Implementation Roadmap for the Transition to Post-Quantum Cryptography (national roadmaps by the end of 2026, high-risk use cases by 2030, as many systems as feasible by 2035), taken from secondary summaries in an earlier edition of this series; the milestones were not on the page read. European Commission, Brussels. Observation year 2025. Accessed 2026-11-03. Cited in chapter 6
- 32UNVERIFIED, not opened: NIST (ed.), Status Report on the Fourth Round of the NIST Post-Quantum Cryptography Standardization Process, NIST IR 8545, March 2025, cited from memory. National Institute of Standards and Technology, Gaithersburg. Observation year 2025. Accessed 2026-11-03. Cited in chapter 2, chapter 6
- 33UNVERIFIED, not opened: NIST (ed.), Security Requirements for Cryptographic Modules, FIPS 140-3, cited from memory. National Institute of Standards and Technology, Gaithersburg. Observation year 2019. Accessed 2026-11-03. Cited in chapter 8
- 34UNVERIFIED, not opened: CVE Program (ed.), CVE metrics page; the page returned no figures. MITRE, Bedford. Observation year 2026. Accessed 2026-11-03.
- 35UNVERIFIED, not opened: Europol (ed.), Internet Organised Crime Threat Assessment 2025, cited from memory; the page returned an error. Europol, The Hague. Observation year 2025. Accessed 2026-11-03.
- 36UNVERIFIED, not opened: Microsoft (ed.), Microsoft Digital Defense Report 2025, cited from memory; the page returned an error. Microsoft, Redmond. Vendor report, weak evidence. Observation year 2025. Accessed 2026-11-03. Cited in chapter 6
- 37UNVERIFIED, not opened: Shor, P.W., Polynomial-time algorithms for prime factorization and discrete logarithms on a quantum computer, SIAM Journal on Computing 26(5), 1484 to 1509, 1997, cited from memory. Observation year 1997. Accessed 2026-11-03. Cited in chapter 2, chapter 6
- 38UNVERIFIED, not opened: Mosca, M., Cybersecurity in an era with quantum computers: will we be ready?, IEEE Security and Privacy 16(5), 38 to 41, 2018, cited from memory. Observation year 2018. Accessed 2026-11-03. Cited in chapter 6
- 39UNVERIFIED, not opened: NIST National Cybersecurity Center of Excellence (ed.), Migration to Post-Quantum Cryptography, NIST SP 1800-38, cited from memory. National Institute of Standards and Technology, Gaithersburg. Observation year 2023. Accessed 2026-11-03. Cited in chapter 6
- 40UNVERIFIED, not opened: European Union, Commission Implementing Regulation (EU) 2024/482 establishing the European scheme for cybersecurity of ICT products (EUCC), cited from memory. Observation year 2024. Accessed 2026-11-03. Cited in chapter 8
- 41UNVERIFIED, not opened: US Office of Management and Budget (ed.), Memorandum M-23-02, Migrating to Post-Quantum Cryptography, November 2022, cited from memory. OMB, Washington. Observation year 2022. Accessed 2026-11-03. Cited in chapter 6
- 42UNVERIFIED, not opened: NIST (ed.), additional digital signature schemes for the post-quantum project (on-ramp), cited from memory; the project page returned an error. National Institute of Standards and Technology, Gaithersburg. Observation year 2025. Accessed 2026-11-03. Cited in chapter 4
- 43UNVERIFIED, not opened: Rescorla, E., The Transport Layer Security (TLS) Protocol Version 1.3, RFC 8446, Internet Engineering Task Force, August 2018, cited from memory. Observation year 2018. Accessed 2026-11-03. Cited in chapter 6
- 44NIST (ed.), Transition to Post-Quantum Cryptography Standards, NIST IR 8547, initial public draft (draft PDF, November 2024; Tables 2 and 4: for quantum-vulnerable signature and key-establishment schemes at 112 bits of security strength, deprecated after 2030 and disallowed after 2035, and at 128 bits or more, disallowed after 2035; the cover sheet added on withdrawal on 27 October 2026 is not used). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03. Cited in the summary, chapter 1, chapter 2, chapter 3, chapter 4, chapter 6, chapter 7, chapter 8
C.2Publication record
Publication
- Title
- Exponential Technology Report 2026: Cybersecurity and Advanced Cryptography, Baseline Edition
- Series
- Reports · Exponential Technology Series XT-10
- Edition
- Baseline Edition 2026 · inaugural annual
- Version
- v1.0.0 · draft for stewardship review
- Publication ID
- NR-XTECH-CRYPTO-GLOBAL-2026-BASELINE-v1.0.0
- Evidence close
- 30 September 2026
- Publication date
- October 2026
- DOI
- concept and version DOI at deposit
Publisher
- Publisher of record
- The Global Centre for Risk and Innovation (GCRI), for the Nexus Consortium
- Place
- Toronto
- Editor
- Saeed Valadbaygi, Chief Steward and Managing Editor
- Stewards
- GCRI · technical truth · the Global Risks Forum (GRF) · public meaning · the Global Risks Alliance (GRA) · capital meaning
- Licence
- text CC BY 4.0; data on the terms of each source
- Copyright
- © 2026 GCRI · Nexus Consortium
- Language
- English (en-GB) source edition
- Correspondence
- Registry correction pathway · editorial office
Colophon
- Format
- A4 portrait · screen, print and archival PDF
- Typefaces
- Space Grotesk (display) · Geist (text) · IBM Plex Sans Italic (standfirsts) · IBM Plex Mono (data)
- Design standard
- Reports Foundational Edition, Volume I, Part VII
- Accessibility
- tagged PDF and HTML targets; text alternatives for every figure
- Production
- Reports editorial team, GCRI
Release path for this version
| Step | What happens | When |
|---|---|---|
| Draft | editorial self-check complete at evidence close | October 2026 |
| Steward review | five passes on the exact draft (keys T · M · F · N) | Q4 2026 |
| Approval | publication authority approves the exact digest | before release |
| Deposit | concept and version DOI minted; registry pointer set | at release |
| Succession | the 2027 cybersecurity and cryptography edition reports changes against this baseline | 2027 |
- Current version
- v1.0.0 draft, stewardship review
- Previous edition
- none, first edition of the series
- Next edition
- NR-XTECH-CRYPTO-GLOBAL-2027-v1.0.0
- Latest version
- resolve the concept DOI or the registry record
- Correction route
- Registry correction pathway
- Notice types
- erratum · addendum · supersession · withdrawal
C.3Corrections log
0correction notices. No edition has been released yet, so none can be corrected; the log below lists each edition’s current version.
| Edition | Version | Date | State | Change | Notice |
|---|---|---|---|---|---|
| XT-10 | NR-XTECH-CRYPTO-GLOBAL-2026-BASELINE-v1.0.0 | October 2026 | Draft | Baseline Edition 2026, inaugural annual edition, | None |
Notice types: erratum, addendum, supersession, withdrawal. A correction is a new version with a published notice; the earlier version stays resolvable, and no edition is ever edited in silence.
C.4Open record
This edition’s open record
- Publication ID
- NR-XTECH-CRYPTO-GLOBAL-2026-BASELINE-v1.0.0
- Desk identifier and series alias
- NR-XTC-XT-10-2026-BL
- Collection
- None
- DOI
- Concept and version DOI at deposit, on Zenodo with DataCite metadata
- Versions
- Each correction is a new version (isNewVersionOf); the concept DOI resolves to the latest
- Bundle
- RO-Crate 1.2 with CITATION.cff, CodeMeta and PROV-O provenance; a signed manifest
- Licence
- CC BY 4.0 (SPDX CC-BY-4.0) for original material; metadata CC0 1.0
Credit and identity
- ORCID
- Your iD in the deposit and the contribution record; DataCite can then add the work to your ORCID record
- ROR
- Your organisation by its ROR identifier, never by a typed name alone
- CRediT
- Conceptualization, Data curation, Formal analysis, Investigation, Methodology, Software, Validation, Visualisation, Writing, review and editing
- Account
- None needed to contribute; never a password
Find and follow
Search the open indexes for Cybersecurity and Advanced Cryptography; software is cited by its SWHID from Software Heritage, and a quantified scenario run is preregistered on OSF before it is run. Annotation is your choice: Hypothesis opens this page in its own viewer.
Mirrors and harvest
The DOI is canonical. At release each signed bundle is also given an IPFS content identifier and a bloxberg anchor as mirrors; both are listed in the record once they exist. Zenodo exposes every record over OAI-PMH, and reviews and endorsements can arrive through COAR Notify where the repository supports it.
{
"metadata": {
"resource_type": {
"id": "dataset"
},
"title": "Evidence on Cybersecurity and Advanced Cryptography for Nexus Reports",
"publication_date": "YYYY-MM-DD",
"creators": [
{
"person_or_org": {
"type": "personal",
"family_name": "Your family name",
"given_name": "Your given name",
"identifiers": [
{
"scheme": "orcid",
"identifier": "0000-0000-0000-0000"
}
]
},
"affiliations": [
{
"id": "ROR identifier of your organisation"
}
]
}
],
"description": "What it is, where its record is kept and how it bears on Exponential Technology Report 2026: Cybersecurity and Advanced Cryptography.",
"rights": [
{
"id": "cc-by-4.0"
}
],
"subjects": [
{
"subject": "Nexus Reports"
},
{
"subject": "Cybersecurity and Advanced Cryptography"
},
{
"subject": "Exponential Technology Report · XT-10"
}
],
"related_identifiers": [
{
"identifier": "https://therisk.global/nexus-reports/editions/xt-10/",
"scheme": "url",
"relation_type": {
"id": "issupplementto"
},
"resource_type": {
"id": "publication-report"
}
}
],
"version": "1.0.0"
},
"custom_fields": {},
"access": {
"record": "public",
"files": "public"
},
"files": {
"enabled": true
},
"parent": {
"communities": {
"default": "nexusreports"
}
}
}C.5Where this edition sits among the six pillars
Foundry seals the evidence and Universe tests it; Reports publishes it; Standards takes its corrections and Academy teaches from it.
- F03 Sealed observations and indicator series Foundry Sealed observations and indicator series behind a profile (closeout).
- F04 After-action and scenario findings for Universe After-action and scenario findings for chapters 10 and 13 (after action review).
- F05 National Portfolio movement for chapter Foundry National Portfolio movement for chapter 11 (after action review).
- Applied in editions Standards Nexus Standards: applied in editions.
- XT-10 edition Reports Cybersecurity and Advanced Cryptography 2026, published in every format with its sources, citation and corrections.
- F06 Method and correction findings as change Standards Method and correction findings as change proposals (correction).
- F12 Q4 synthesis informs the next-year Universe Q4 synthesis informs the next-year mandate (renewal).
- Taught in the open Academy Risk Academy: taught in the open.
What Foundry and Universe hand to this edition, and what it hands to Standards, Universe and Academy. From the programme spine; XT-10 is a drafted Baseline Edition, so these handoffs run from its first operational quarter.
| Handoff | Between | What crosses, and when |
|---|---|---|
| F03 | Foundry to Reports | Sealed observations and indicator series behind a profile (closeout). |
| F04 | Universe to Reports | After-action and scenario findings for chapters 10 and 13 (after action review). |
| F05 | Foundry to Reports | National Portfolio movement for chapter 11 (after action review). |
| Ring | Nexus Standards to Reports | Nexus Standards: applied in editions. |
| F06 | Reports to Nexus Standards | Method and correction findings as change proposals (correction). |
| F12 | Reports to Universe | Q4 synthesis informs the next-year mandate (renewal). |
| Ring | Reports to Risk Academy | Risk Academy: taught in the open. |