Europe, the UK and the US set 2035 to abandon today’s cryptography. For those deciding in 2026, that isn’t the future.

The green corner of the matrix

Almost every risk presentation that reaches a board carries the same chart: a matrix with probability on one axis and impact on the other, painted green, yellow and red. An event that is very unlikely in the short term, however large its impact, tends to end up near the green corner.

The matrix has a limitation that is rarely discussed. It has no axis for the time the company would need to react. And there is a whole category of risks in which that is the variable that decides everything.

The missing calculation

In 2015, the researcher Michele Mosca proposed a simple calculation for the quantum threat. He called x the time a piece of information must stay protected, y the time needed to migrate systems to new cryptography (which, he said, can exceed 15 years), and z the time until a quantum computer exists that can break current cryptography. The rule: if x + y is greater than z, the problem already exists today.

The important detail is y. In the traditional matrix, only z would appear, as a probability. Mosca shows that if reacting takes long enough, a distant event is already overdue. NIST reproduces this calculation in its transition document of November 2024, calling it Mosca’s theorem.

How long it takes to react

The same NIST document, still in draft, says the path from standardising an algorithm to actually integrating it into systems can take 10 to 20 years, and notes that previous cryptographic migrations took more than a decade.

History bears this out. NIST advised against using SHA-1, a cryptographic hash algorithm, in 2011. The first practical collision, proof that it was broken, was announced by Google in 2017. Full retirement is scheduled for the end of 2030, almost two decades after the first warning. AES, the symmetric encryption standard that replaced its predecessors, was published in 2001; 3DES was only banned for encryption after 2023.

When the White House estimated, in July 2024, the cost of migrating the US federal government’s priority systems between 2025 and 2035, it came to about $7.1 billion. Ten years of work, for the government of a single country.

The deadlines are already on the calendar

While the risk matrix treats the issue as distant, governments have already set the dates.

The NSA, under its CNSA 2.0 programme, expects to complete the transition of US national security systems by 2035, and wants exclusive use of quantum-resistant algorithms for software signing and network equipment as early as 2030. Britain’s NCSC asked, in March 2025, for a full inventory by 2028, migration of priorities by 2031 and completion by 2035. The European roadmap, from June 2025, calls for national plans by the end of 2026, migration of high-risk use cases by 2030 and of the rest, where feasible, by 2035. The European document itself acknowledges that the process may take well over five years.

In Brazil, the ITI added the first post-quantum algorithms to ICP-Brasil, the infrastructure behind the country’s official digital certificates, in January 2026, still with no date for retiring the old ones.

The detail the CFO should care about

To an executive, 2035 seems far off: it is nine years away. To infrastructure, it is not.

Think of a system bought in 2026 with a ten-year useful life, a common span for network equipment, industrial systems or core platforms. It will still be running in 2035. The calculation is mine, but it is simple: if the purchasing decision ignores the post-quantum calendar, the company is buying today a problem whose expiry date has already been published.

And there is an even more uncomfortable calculation. If NIST says migrations take 10 to 20 years, and there are nine between 2026 and 2035, anyone starting now is already starting below the low end of that range. Anyone starting later starts late.

Three changes in how we measure risk

1. Add reaction time to the matrix. For the main risks, one extra column: how long would we take to respond if the event happened tomorrow? When that time is longer than the event’s horizon, the colour of the cell has to change, however low the probability.

2. Plan backwards. Start from the dates already published (2030 and 2035) and work back to today. The NCSC suggests 2028 for the full inventory, and it is a good milestone for any company, even outside the UK.

3. Buy with the calendar in hand. Any system with a useful life beyond 2030 should carry, in its contract, a commitment to support the new algorithms or to be replaceable without a multi-year project.

The question for the next risk committee

At the next committee, pick the company’s five biggest risks and ask one question about each: if this happened tomorrow, how long would we take to react? If the answer is longer than the time we think we have, the risk sits in the wrong place on the matrix.

Nine years sounds like a long time. It is less than NIST says a migration like this usually takes.