Draft, not yet released. In stewardship review. Not indexed until the first approved release.

Executive summary

The edition on a few pages: the abstract, the key messages, the headline finding and what each steward reads in it.

7 min read1 figure0 tables15 notesNR-XTECH-CRYPTO-GLOBAL-2026-BASELINE

Contents
  1. ·Edition home
  2. ·Executive summary
    1. S.1 Abstract
    2. S.2 Key messages
    3. S.3 Headline finding
    4. S.4 At a glance
    5. S.5 What each steward reads in it
    6. S.6 What this edition is, and is not
  3. 1Cryptography is infrastructure under change
  4. 2Key findings
  5. 3Systems and sectors at baseline
  6. 4Risks and capability
  7. 5Signature lag while key agreement migrates
  8. 6Readings from the other desks
  9. 7The 2027 agenda
  10. 8Systems in depth
  11. AMethodology
  12. BData appendix
  13. CReferences and record
  14. ·Complete edition, for print

S.1Abstract

Cybersecurity and advanced cryptography matter to the Nexus programme because every other infrastructure relies on them. They are also being changed. NIST finalised three post-quantum standards on 13 August 2024123 and selected a fifth algorithm, HQC, as a backup on 11 March 20256. The UK NCSC asks organisations to plan by 2028, start priority work by 2031 and finish by 203510. A 2025 preprint estimates that RSA-2048 could be factored with under a million noisy qubits in under a week, under stated assumptions22. Deployment has moved first where it is cheap. Cloudflare reported in October 2025 that most human traffic to its network used post-quantum key agreement, and OpenSSH made a post-quantum exchange its default in version 10.02324. Signatures and certificates lag, because they add size and cost23. Threat pressure is large and mostly ordinary. The CISA KEV catalogue is the public list of vulnerabilities exploited in the wild, and its count at the 30 September close is not bound, and the FBI recorded 859,532 complaints and USD 16.6 billion of reported losses for 202415. The cost and workforce evidence comes in part from vendors and is labelled weak. This baseline sets out what the evidence supports and where it is thin. It forecasts no capability date and ranks no country or vendor.

S.2Key messages

Six readings that frame the cybersecurity and cryptography baseline, and the eight questions this edition answers, each with its status and source.

  1. Three NIST standards were finalised in August 2024; HQC is a backup selected in March 2025.16

    Are post-quantum standards ready?Reported

  2. The UK NCSC says 2035; the NIST IR 8547 draft of November 2024 proposes disallowing quantum-vulnerable algorithms after 2035.1044

    When must migration finish?Reported

  3. Vendor and open-source evidence shows wide deployment of hybrid key agreement.2324

    Is key agreement moving?Reported

  4. Slower. Post-quantum signatures add size, and broad certificate trust is not expected before 2027.23

    Are signatures moving?Reported

  5. A 2025 estimate: under a million noisy qubits in under a week, under stated assumptions.22

    How many qubits would break RSA-2048?Reported

  6. Exploited known vulnerabilities and ransomware recur across the sources read.131415

    What drives incidents?Reported

  7. Skills needs rose in 2025; no gap figure was published.20

    What does the workforce look like?Reported

  8. The lag of signatures and long-life devices behind key agreement. SCN-XT10-SIG-01

    What will 2027 test first?Expert input

S.3Headline finding

ReportedEQL 5NRF-XTECH-CRYPTO-GLOBAL-2026-BASELINE-CRY-001

NIST finalised three post-quantum cryptography standards on 13 August 2024: FIPS 203 (ML-KEM), FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA).

Figure S.1Standards finalised on 13 August 2024
ItemBar, scaled to the largest valueValue
FIPS 203 · key establishment (ML-KEM)1
FIPS 204 · signatures (ML-DSA)1
FIPS 205 · backup signatures (SLH-DSA)1

Source: NIST publication pages for FIPS 203, 204 and 205123. Each bar counts one standard.

Standards exist, so migration is now an engineering and planning task. NIST added HQC as a backup key-encapsulation method on a different mathematical basis, with a final standard expected in 20276. Guidance on using key encapsulation was published in September 20257. The NIST transition draft IR 8547, published on 12 November 2024, proposes disallowing quantum-vulnerable public-key algorithms after 203544.

S.4At a glance

3standards

NIST, August 2024123

2035milestone

NCSC finish date10

<1million

qubits for RSA-2048, estimate22

NOT BOUNDentries

CISA KEV count at the close

859,532complaints

FBI IC3, 202415

4.99USD million

average breach cost, 202618

S.5What each steward reads in it

GCRI · KEY T

Technical Truth

The evidence supports reading cybersecurity and cryptography as protective infrastructure under change.

GRF · KEY M

Public Meaning

For most people the story arrives as a message about encryption, a breach notice or a ransomware headline.

GRA · KEY F

Capital Meaning

Readiness implications only. Breach and ransomware costs come from vendors and are weak evidence.

NEXUS

Synthesis

Cryptography is well described by standards and thinly measured as a system.

S.6What this edition is, and is not

What this edition is

A baseline: the 2026 state of cybersecurity and advanced cryptography as infrastructure and the couplings through which it carries risk into other systems. It synthesises published evidence and ranks no country, company or asset.

What it is not

Not a forecast of when any machine will break any cipher, a technology ranking, an endorsement of any vendor or product, or an assessment of any programme. Standards, regulation and enforcement are decisions of competent authorities.

What comes next

National, regional and sector evidence feeds the 2027 cybersecurity and cryptography edition through the federation. Each edition reports what changed against this baseline: observations, source revisions, method changes, scenario updates and corrections.

Notes

Numbers are the edition’s reference numbers, so a note reads the same in every chapter. The full list, with every source and its licence, is in Annex C. Annex C, references

  1. 1NIST (ed.), Module-Lattice-Based Key-Encapsulation Mechanism Standard, FIPS 203 (publication page; final 13 August 2024; ML-KEM-512, ML-KEM-768 and ML-KEM-1024; initial draft 24 August 2023). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03.back
  2. 2NIST (ed.), Module-Lattice-Based Digital Signature Standard, FIPS 204 (publication page; final 13 August 2024; ML-DSA). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03.back
  3. 3NIST (ed.), Stateless Hash-Based Digital Signature Standard, FIPS 205 (publication page; final 13 August 2024; SLH-DSA, based on SPHINCS+). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03.back
  4. 6NIST (ed.), NIST selects HQC as fifth algorithm for post-quantum encryption (news item, 11 March 2025; backup to ML-KEM; draft standard expected in about a year; final standard expected in 2027). National Institute of Standards and Technology, Gaithersburg. Observation year 2025. Accessed 2026-11-03.back
  5. 10UK National Cyber Security Centre (ed.), Timelines for migration to post-quantum cryptography (guidance page; version 1.0, 20 March 2025; milestones 2028, 2031 and 2035). NCSC, London. Observation year 2025. Accessed 2026-11-03.back
  6. 22Gidney, C., How to factor 2048 bit RSA integers with less than a million noisy qubits, arXiv:2505.15917, submitted 21 May 2025 (abstract page; under one million noisy qubits; under a week; 0.1% gate error; 1 microsecond cycle; 10 microsecond reaction time; the author’s 2019 estimate was about 20 million qubits in 8 hours). arXiv, Ithaca. Observation year 2025. Accessed 2026-11-03.back
  7. 23Cloudflare (ed.), The state of the post-quantum Internet in 2025 (blog analysis; late October 2025 majority of human traffic with post-quantum key agreement; 3.7% of origins; 39% of top 100,000 domains in September 2025; ML-DSA-44 about 15 kB; first post-quantum certificates expected in 2026). Cloudflare, San Francisco. Vendor analysis of its own network, weak evidence. Observation year 2025. Accessed 2026-11-03.back
  8. 24OpenSSH project (ed.), Post-quantum cryptography in OpenSSH (documentation page; sntrup761x25519-sha512 from 9.0; mlkem768x25519-sha256 added in 9.9 and default in 10.0; warning from 10.1). OpenBSD Project. Observation year 2025. Accessed 2026-11-03.back
  9. 15Federal Bureau of Investigation, Internet Crime Complaint Center (ed.), 2024 Internet Crime Report (859,532 complaints; USD 16.6 billion losses, up 33%; 256,256 complaints with a loss; 3,156 ransomware complaints; 263,455 cyber-threat complaints and USD 1.571 billion; 4,878 critical-infrastructure complaints). FBI, Washington. Observation year 2024. Accessed 2026-11-03.back
  10. 44NIST (ed.), Transition to Post-Quantum Cryptography Standards, NIST IR 8547, initial public draft (draft PDF, November 2024; Tables 2 and 4: for quantum-vulnerable signature and key-establishment schemes at 112 bits of security strength, deprecated after 2030 and disallowed after 2035, and at 128 bits or more, disallowed after 2035; the cover sheet added on withdrawal on 27 October 2026 is not used). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03.back
  11. 13POST-CLOSE, context only: CISA (ed.), Known Exploited Vulnerabilities Catalog (catalogue page; 1,767 results at the read; newest entry added 2026-11-03). Cybersecurity and Infrastructure Security Agency, Arlington. Observation year 2026. Accessed 2026-11-03.back
  12. 14CISA and 22 partner agencies (eds.), Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System, advisory AA25-239A (published 27 August 2025; revised 3 September 2025; 23 agencies from 13 countries; known vulnerabilities; no zero-day exploitation observed). Cybersecurity and Infrastructure Security Agency, Arlington. Observation year 2025. Accessed 2026-11-03.back
  13. 20ISC2 (ed.), 2025 Cybersecurity Workforce Study (page; published 4 December 2025; 16,029 respondents; 59% critical or significant skills needs, up from 44%; no workforce gap estimate). ISC2, Alexandria. Observation year 2025. Accessed 2026-11-03.back
  14. 7NIST (ed.), Recommendations for Key-Encapsulation Mechanisms, SP 800-227 (publication page; final 18 September 2025). National Institute of Standards and Technology, Gaithersburg. Observation year 2025. Accessed 2026-11-03.back
  15. 18IBM and Ponemon Institute (eds.), Cost of a Data Breach Report 2026 (landing page; global average USD 4.99 million, up 12%; AI-driven attacks up 56%). IBM, Armonk. Vendor report, weak evidence; the full report was not opened. Observation year 2026. Accessed 2026-11-03.back

Cite this summary

Valadbaygi, S. (Ed.). (2026). Executive summary: Executive summary. In Exponential Technology Report 2026: Cybersecurity and Advanced Cryptography (Baseline Edition 2026, Report No. NR-XTECH-CRYPTO-GLOBAL-2026-BASELINE) [Draft under review]. The Global Centre for Risk and Innovation (GCRI).

Every citation form of the whole report, BibTeX and RIS included, is on the edition home. Cite this report

ReportsContribute

Send evidence or a correction on Cybersecurity and Advanced Cryptography.

Reports is the Consortium’s quarterly publication, written by six desks. This page sits with the Global Centre for Risk and Innovation (GCRI) Systems Evidence desk. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work. Sent to the wrong desk, it is forwarded, not refused.

GCRI Systems Evidence deskExponential Technology

Never send personal data, sensitive infrastructure detail or anything you have no right to share. A contribution is reviewed before use; sending it confers no authorship or editorial rights, and sponsorship never buys a finding.

CC BY 4.0 Free to read. Text and figures: CC BY 4.0. Data: CC0 1.0. Authors keep copyright. Published by GCRI Canada.

The Global Centre for Risk and Innovation

Science · evidence · measurement

Not for profit

Our articles, maps and twins are free to read and free to republish. Readers and partners keep it that way.

Partner with us

Who funds us

GCRI is a not-for-profit institution. To ask who funds a piece of work, use the funding questions form.

Independence

Editors and the expert reviewers named on each article decide what we publish. Funders and partners do not review or approve articles before publication.

Corrections policy

Licence

Articles: CC BY 4.0. Figures, maps, twins and data: CC BY 4.0. Other uses: ask through the permissions form.

Privacy choices