Resources
The knowledge base for what has to last.
Plain-English guides to post-quantum cryptography, cybersecurity regulation and AI security, written by the people doing the work and linked to primary sources. Last reviewed October 2026.
Guides
Start with the essentials.
Post-quantum
- 3 min readPost-quantum cryptography, explainedWhat a quantum computer would break, what it would not, and why the migration has to start years before one exists.
- 3 min readThe NIST post-quantum standardsWhich algorithms are final, which are still drafts, and which to use for what, as of October 2026.
- 3 min readPost-quantum deadlines, by country and sectorThe dates governments and regulators have set, from the US executive order of June 2026 to the 2035 finish line most of them share.
- 3 min readA post-quantum migration playbookThe order of work that gets a regulated enterprise from no inventory to post-quantum in production, without breaking anything on the way.
- 2 min readHow close is a quantum computer that breaks encryption?What the hardware can do today, how fast the estimates are falling, and why the exact date matters less than it seems.
Cybersecurity
- 3 min readCyber regulation for financial institutionsDORA, NIS2, the SEC's disclosure rules, NYDFS Part 500 and PCI DSS 4.0: what each asks for, and where they overlap.
- 2 min readCyber resilience: the questions boards should askTen questions that separate an organisation that will recover quickly from one that will not, and what good answers sound like.
AI security
- 3 min readSecuring AI agentsWhy agents that can use tools need a different security model from chatbots, and the controls that let them pass review.
- 2 min readAI governance, privacy and the EU AI Act timelineThe AI Act's dates after the 2026 Digital Omnibus, the frameworks auditors use, and the privacy techniques that let regulated firms use AI on sensitive data.
Key dates
The deadlines that matter.
Standards, regulations and government deadlines for post-quantum cryptography, cyber resilience and AI, from 2024 to the 2035 finish line most of them share.
- Aug 2024
First NIST post-quantum standards
FIPS 203 (ML-KEM), FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA) published.
- Jan 2025
DORA applies
EU financial entities must meet the Digital Operational Resilience Act.
- Mar 2025
HQC selected; UK timeline
NIST picks HQC as a backup KEM. The NCSC sets 2028, 2031 and 2035 milestones.
- Jun 2025
EU post-quantum roadmap
Member states agree to start by 2026 and protect critical infrastructure by 2030.
- Jan 2026
G7 financial-sector roadmap
Critical financial systems pointed to post-quantum within roughly 2030–2032.
- Jun 2026
US Executive Order 14412
Hard federal deadlines: post-quantum key establishment by 2030, signatures by 2031.
- Jul 2026
EU AI Act amended
Digital Omnibus defers high-risk obligations to December 2027 and August 2028.
- Sep 2026
Cyber Resilience Act reporting
Manufacturers must report actively exploited vulnerabilities in their products.
- End 2026
EU transitions startAhead
Every member state begins its post-quantum transition.
- Jan 2027
CNSA 2.0 for new acquisitionsAhead
New US national security systems expected to be CNSA 2.0 compliant.
- Dec 2027
AI Act high-risk; CRA in fullAhead
Annex III high-risk AI obligations and the Cyber Resilience Act's main duties apply.
- 2028
UK discovery completeAhead
NCSC milestone: goals set, cryptography discovered, initial plan in place.
- 2030
The first hard lineAhead
US high-value systems on post-quantum key establishment; NIST's draft deprecation of RSA-2048 and P-256; EU critical infrastructure; Australia stops traditional asymmetric cryptography.
- 2031
Signatures and prioritiesAhead
US federal post-quantum signatures due; UK highest-priority migrations complete.
- 2033
CNSA 2.0 exclusiveAhead
Browsers, servers, cloud services and operating systems in US national security systems.
- 2035
The finish lineAhead
Quantum-vulnerable algorithms disallowed in NIST's draft plan; US, UK, EU and Canadian migrations complete.
Glossary
The terms, in plain English.
- AES-256
- The Advanced Encryption Standard with 256-bit keys. Symmetric, fast, and considered safe against quantum attack.
- CBOM
- Cryptographic bill of materials: an inventory of the algorithms, keys, certificates and protocols a system uses, and where. CycloneDX defines a standard format.
- CNSA 2.0
- The NSA's Commercial National Security Algorithm Suite 2.0: the algorithms and deadlines for US national security systems (ML-KEM-1024, ML-DSA-87, LMS, XMSS, AES-256, SHA-384/512).
- CRQC
- Cryptographically relevant quantum computer: one large and reliable enough to break today's public-key cryptography.
- Crypto-agility
- The ability to change algorithms, keys and providers quickly, without rewriting applications.
- Confidential computing
- Processing data inside hardware-isolated, attested environments, so it stays protected while in use.
- DORA
- The EU's Digital Operational Resilience Act for financial entities, in application since January 2025.
- FHE
- Fully homomorphic encryption: computing directly on encrypted data without decrypting it.
- FIPS 140-3
- The US standard for validating cryptographic modules, such as HSMs and libraries.
- FN-DSA
- Compact lattice-based signature derived from Falcon, being standardised as FIPS 206 (draft as of October 2026).
- Grover's algorithm
- A quantum search algorithm that gives a square-root speed-up against symmetric keys and hashes, offset by larger parameters.
- Harvest now, decrypt later
- Recording encrypted data today in order to decrypt it once a quantum computer can. Also called HNDL or store now, decrypt later.
- HQC
- Hamming Quasi-Cyclic: a code-based key-encapsulation mechanism NIST selected in 2025 as a backup to ML-KEM.
- HSM
- Hardware security module: tamper-resistant hardware that generates, stores and uses keys.
- Hybrid key exchange
- Combining a classical and a post-quantum algorithm, such as X25519 with ML-KEM-768, so security holds if either does.
- KEM
- Key-encapsulation mechanism: a way for two parties to agree a shared secret key using public-key cryptography.
- KEV
- CISA's Known Exploited Vulnerabilities catalogue: vulnerabilities attackers are actively using, to patch first.
- LMS and XMSS
- Stateful hash-based signature schemes approved in NIST SP 800-208, suited to firmware and code signing.
- ML-DSA
- Module-Lattice Digital Signature Algorithm (FIPS 204), from CRYSTALS-Dilithium: the main post-quantum signature.
- ML-KEM
- Module-Lattice Key-Encapsulation Mechanism (FIPS 203), from CRYSTALS-Kyber: the main post-quantum key establishment.
- Mosca's inequality
- If the years data must stay secret (X) plus the years to migrate (Y) exceed the years until a CRQC (Z), the data is already at risk.
- MPC
- Secure multi-party computation: several parties compute a result together without revealing their inputs to each other.
- Prompt injection
- Instructions planted in input to an AI system, directly or hidden in content it reads, to make it ignore its intended task.
- PQC
- Post-quantum cryptography: public-key algorithms that run on ordinary computers and resist known quantum attacks.
- Q-Day
- Informal name for the day a CRQC first breaks real-world public-key cryptography.
- QKD
- Quantum key distribution: sharing keys using quantum physics over dedicated links. Distinct from PQC, and not favoured by most national agencies for general use.
- Shor's algorithm
- The 1994 quantum algorithm that efficiently factors integers and computes discrete logarithms, breaking RSA and elliptic-curve cryptography.
- SLH-DSA
- Stateless Hash-Based Digital Signature Algorithm (FIPS 205), from SPHINCS+: a conservative signature resting only on hash functions.
- TLPT
- Threat-led penetration testing: intelligence-driven red-team testing of live systems, required under DORA for significant financial entities.
- Zero trust
- A security model that decides access per request on identity, device and context, rather than trusting anything inside the network (NIST SP 800-207).
Primary sources
Go to the source.
The publishers we read first. Every guide links the documents it relies on.
- NIST Post-Quantum Cryptography (opens in a new tab)
- NSA Cybersecurity Advisories (opens in a new tab)
- CISA Post-Quantum Initiative (opens in a new tab)
- UK NCSC (opens in a new tab)
- ENISA (opens in a new tab)
- OWASP GenAI Security Project (opens in a new tab)
- MITRE ATLAS (opens in a new tab)
- CycloneDX CBOM (opens in a new tab)
Let's talk
Start with two weeks.
A fixed-fee readiness sprint: an exposure heatmap, a Mosca analysis and your top ten priorities.
Get in touch
contact@qctcapital.com