Replacing the cryptography inside a running enterprise resembles replacing the water mains beneath an occupied city. The new pipes are demonstrably better; the disruption comes from discovering which buildings were connected to which mains, in what order, and who still holds a plan drawn before the last renovation. Two documented developments have converted that analogy into a procurement problem. NIST finalized its first three post-quantum standards in August 2024, and Google's Willow experiment published evidence of logical error suppression below the surface-code threshold. Together, these moved quantum computing from a laboratory curiosity into a line item that security leaders must now defend to a board.

The Decade Between the Break and the Breach

In August 1999, a team of mathematicians and volunteers factored RSA-158, a 512-bit modulus. The result was a headline, not a migration. Organizations continued deploying 1024-bit RSA for years afterward, and the industry's reckoning with SHA-1 did not arrive until practical collisions demonstrated the problem in 2017 — more than a decade after the first serious academic attacks.

The lesson is uncomfortable for both camps in the quantum debate. Mathematical obsolescence and operational obsolescence are separated by roughly a decade of procurement cycles, embedded firmware, and vendor support contracts. Those who argue quantum computing is irrelevant because no machine can factor RSA-2048 today are measuring the wrong clock. Those who argue migration must be complete tomorrow are ignoring that the 1999 factoring result did not empty anyone's vault overnight. The actionable interval sits between those positions, and it is shorter than most enterprises assume.

The Hidden Tax Is in the Handshake, Not the Algorithm

The first unpriced cost is not computational. It is architectural.

ML-KEM-768, the NIST-standardized workhorse key encapsulation mechanism, carries an 1,184-byte encapsulation key and a 1,088-byte ciphertext. An X25519 key share occupies 32 bytes. Those figures come directly from FIPS 203, and they matter because hybrid deployments — which pair a classical exchange with a post-quantum one during transition — must fit both into a single TLS handshake.

Primary-source figure: ML-KEM-768 ciphertext is 1,088 bytes against a 32-byte classical key share — a roughly 34-fold increase in handshake material for that component alone.

A kilobyte of additional handshake material is not a rounding error. It pushes ClientHello messages past common path-MTU assumptions, exposes fragmentation behavior in older load balancers, and interacts badly with middleboxes engineered around a 2014 specification that nobody ever inventoried. Security teams that budgeted for a compiler upgrade will discover they are funding a network refresh.

The Fleet That Outlives Its Cryptography

The second hidden cost lives in devices that will never receive a software update.

A hospital infusion controller, a utility substation relay, and a manufacturer's programmable logic controller are frequently designed for fifteen to twenty years of service. Their cryptographic identities are burned into firmware, provisioned at the factory, and sometimes stored in hardware that cannot accommodate an ML-DSA signature, which runs to kilobytes rather than the 64 bytes of an ECDSA P-256 signature.

This is where migration stops being an IT project. Replacing a signature scheme in a deployed device may require replacing the device, renegotiating a support contract, or accepting a documented exception that an auditor will eventually read. Enterprises that fare best already maintain a cryptographic bill of materials. Most do not. The NSA's CNSA 2.0 transition schedule does not adjust for that gap.

Retention Policy Has Become a Cryptographic Control

The third implication is the one least discussed outside cryptanalysis circles: confidentiality obligations now extend backward in time.

An adversary who records an encrypted transmission today does not need a quantum computer to benefit from it. They need one in fifteen years. Genomic records, defense procurement data, long-dated financial instruments, and industrial process intellectual property all carry confidentiality horizons that comfortably exceed the plausible arrival of a cryptographically relevant machine.

The consequence is that data retention has become a cryptographic control. Keeping less data for less time is not merely privacy hygiene; it is the only mitigation that does not depend on winning a hardware race. Organizations that treat retention as a legal concern and cryptography as an engineering concern will find the two disciplines have silently merged — and that neither currently owns the resulting risk.

The Threshold Result Is Real. The Factoring Machine Is Not.

None of this justifies the panic currently being marketed as strategy.

Google's Willow result is genuine and important: across surface-code distances of three, five, and seven, the logical error rate fell by a factor of approximately 2.14 per increase in code distance, demonstrating error suppression below threshold rather than merely accumulating physical qubits. That figure is reported in the Nature paper accompanying the experiment. It is not a factoring machine.

The resource estimates remain sobering. Gidney and Ekerå's 2021 analysis in Quantum estimated that factoring a 2,048-bit RSA integer would require roughly 20 million noisy qubits and about eight hours of circuit execution under their architectural assumptions. Subsequent optimizations have improved those figures, but the distance between a logical-qubit scaling demonstration and a cryptographically relevant computer is still measured in engineering generations, not product cycles.

A defensible migration program therefore buys time deliberately. It does not justify abandoning sound classical cryptography, paying a premium for unproven "quantum-proof" hardware, or tearing out infrastructure that will be replaced on its normal lifecycle regardless.

Three Standards, One Mathematical Assumption

Neither does the existence of a standard guarantee the safety the word implies.

FIPS 203, 204, and 205 are three standards, but two of the three — ML-KEM and ML-DSA — rest on the same underlying family of lattice problems. A structural breakthrough against that family would not be an isolated algorithm failure; it would be a simultaneous failure across a large fraction of the world's transitioned infrastructure. SLH-DSA, the hash-based standard, offers a genuinely different mathematical foundation at the cost of substantially larger signatures and slower signing.

This is an argument for cryptographic diversity, not for delay. It is also an argument for agility: the algorithm an enterprise deploys in 2026 should not be the only one its architecture can express in 2036. Vendors selling a fixed, hardware-burned implementation of a single post-quantum algorithm are selling the same rigidity that made this migration necessary.

The Next Six Months: Procurement, Not Physics

The visible movement will be in procurement language rather than in qubit counts.

Expect requests for proposal to begin demanding explicit ML-KEM and ML-DSA support, evidence of a cryptographic bill of materials, and contractual remediation timelines. Expect a wave of middleware failures as hybrid handshakes encounter infrastructure that was never tested against them. Expect a parallel flood of "quantum-safe" marketing claims from vendors whose only change is a rebranded certificate.

What will not happen is a cryptographically relevant quantum computer appearing in a commercial datacenter. Fault-tolerant demonstrations will remain laboratory results, and the practical deadline will continue to be set by standards bodies and procurement departments rather than by a single breakthrough announcement. The winners in this window will be vendors who can demonstrate an inventory and a migration path.

What to Do Before the Next Budget Cycle

  • Inventory first. Enumerate every TLS termination point, VPN, code-signing pipeline, certificate authority, and hardware security module. Assign each an owner and a replacement date. Without this register, every subsequent estimate is fiction.
  • Simplify second. Retire expired certificates, remove unused key-exchange algorithms, and eliminate the cryptographic exceptions that accumulate during acquisitions. A smaller attack surface is a cheaper migration.
  • Prototype at the edge. Test hybrid handshakes on a non-critical termination point first, where a failure is a support ticket rather than an outage.
  • Ask vendors three written questions. Which standards do you support, when, and what happens to a device already in the field when its algorithm ages out? A vendor unable to answer the third has no migration strategy.

For individuals, the advice is narrower. Prefer end-to-end encrypted messaging for anything that must remain private for decades. Treat cloud backups of sensitive documents as a confidentiality commitment you are making to someone else's future infrastructure. And remain skeptical of any consumer product whose entire quantum pitch rests on a marketing adjective.