Marin Ivezic

Boards are starting to ask about quantum risk. Are we compliant? What exactly is our risk exposure? When is Q-Day? Often neither the directors nor the executives who brief them have dealt with these questions before. And there's no established guidance yet on what a good answer looks like. So let's try to work it out together. Today at 20:00 UTC we're running a free webinar on briefing the board on quantum risk, and you can still register: quantumacademy.com/event/web… We'll go through the four decisions a board makes about quantum risk: exposure, timing, budget and accountability. For each one, we'll take the question directors usually ask and swap it for one the board can act on. Take "When is Q-Day?" Nobody can give a board a reliable date. A better question is "Which deadline applies to us first, and how many months do we have to spare?" That one has an answer. The EU wants high-risk systems migrated by 2030, and US federal high-value systems need post-quantum key establishment by the end of 2030. We'll teach for about 45 minutes and keep the last 15 for your questions. If your board has asked you something about quantum that you weren't sure how to answer, bring it. Or put it in the comments here, and we'll try to cover it tonight. It starts at 15:00 in New York and 21:00 here in Central Europe. Everyone who attends live receives a certificate of attendance for 1 CPE credit. Everyone who registers gets the handbook at least, so register even if you can't make it. #PQC #BoardOfDirectors #CyberRisk

Two days to go before the Quantum-Safe Government and Defense Intensive at Quantum Academy, live online for the Americas. If it's on your list, booking is still open. This one is for program managers, PQC migration leads, CIO or CISO sponsors, accreditation staff, system owners and contracting officers at agencies and defense suppliers. Here's how it works: we teach it live online in two four-hour sessions on consecutive days, eight hours in all. You'll: - Trace contractual flow-down to the suppliers it applies to and write the contract language for it - Apply NSM-10 inventory and planning obligations without producing an inventory nobody uses Everyone who takes it gets a course handbook with every slide and its notes, a PDF copy of my book Quantum Ready and a certificate of completion. A live online seat costs US$1,499. Details: quantumacademy.com/event/qua… #PostQuantumCryptography #CNSA2

I'm really proud to welcome Obada Alia to Quantum Academy as a Senior Instructor. At JPMorgan Chase, Obada was first author of the 2024 study in which his team secured site-to-site VPN tunnels with keys from a QKD system. They ran about 100 Gbps between two of the bank's data centers in Singapore, over 46 km of deployed fiber, for 45 days without interruption. He also holds a PhD in optical and quantum communications from the University of Bristol. Obada is the person I'd want in the room for any QKD decision. If you're deciding whether to deploy QKD alongside post-quantum cryptography, you can now learn from someone who has made it work between a bank's data centers. Welcome to the team, Obada. quantumacademy.com/news/obad… #QuantumKeyDistribution #PostQuantumCryptography

Sectigo, one of the largest certificate authorities, surveyed 500 IT and security leaders. My advice after reading it with Chrome's post-quantum certificate plans: automate certificates end to end before March 15, 2027, and give private PKI its own post-quantum plan now. Key points: - 4% say their certificate management is fully automated. From March 15, new public TLS certificates are valid for 100 days at most. - 18% say preparing for 47-day certificates and preparing for PQC are exactly the same. The 47-day rule applies only to publicly trusted TLS certificates, not to SSH, VPNs, code signing or the cryptography in vendor products. - Replacing certificates more often doesn't change the key exchange, so it gives no protection against harvest now, decrypt later. For that, Google and Mozilla enable hybrid ML-KEM by default in Chrome and Firefox. - For the public web, Google's Chrome team chose Merkle Tree Certificates over post-quantum X.509. Owners of private PKIs can test ML-DSA hierarchies in Chrome 150 today. - NIST published its final transition plan the day before Sectigo's report. It deprecates RSA and elliptic-curve algorithms after 2030 and disallows them after 2035. I teach PKI migration planning in PKI Modernization for Post-Quantum at Quantum Academy. My full analysis: postquantum.com/security-pqc… #PostQuantumCryptography #PQC #PKI #MerkleTreeCertificates #CryptoAgility #TLS #CertificateManagement #CyberSecurity

Briefing a board on quantum risk any time soon? Join our free webinar on Monday. We go through the questions directors ask about exposure, timing, budget and accountability, and how to answer them without overstating or understating the threat. Monday, November 2, 20:00 UTC (15:00 New York). Still time to register: quantumacademy.com/webinars/

Washington has been busy on post-quantum this year. EO 14412, signed June 22: post-quantum key establishment for federal high-value systems by the end of 2030, signatures by the end of 2031. OMB M-26-15: agency migration plans due October 22. CNSA 2.0: new National Security System acquisitions compliant from January 1, 2027. And in October, GAO found that none of the 24 CFO Act agencies had fully addressed all three preparatory practices. If you work for an agency or sell to one, join our free webinar on Friday, November 13. We'll walk through what each of these requires. Then we'll look at what contractors should prepare before the FAR Council proposes its PQC rules. 18:00 UTC (13:00 Washington, 10:00 San Francisco). Free, one hour. Everyone who registers gets the recording. quantumacademy.com/webinars/ #PQC #GovCon

French quantum company @Alice__Bob estimates that 22,593 qubits could break RSA-2048 in about three days. It is the smallest estimate I have seen that runs in days. But it needs qubits nobody can build yet. The paper is serious work. The team laid out Shor's algorithm qubit by qubit on a chip of cat qubits, and the elliptic-curve version, the math behind Bitcoin keys, comes in at about an hour on at most 29,588 qubits. The condition is one assumption: no bit-flips during the run. The paper equates that with a bit-flip time of about 100 years per qubit. The best peer-reviewed measurement with quantum control is 22 seconds. Alice & Bob's own preliminary results reach 44 minutes, and about four hours on qubits it has not yet shown it can control as fully. Its largest chip with error-correction results has 12 cat qubits. The paper moves the algorithm side of the Q-Day question. Your deadlines stay where they were: NIST's final IR 8547 still deprecates RSA and ECC after 2030 and disallows them after 2035. My full analysis is postquantum.com/security-pqc…. We go through it live in a free webinar today at 15:00 UTC, and everyone who registers gets the recording: quantumacademy.com/event/web… #QuantumComputing #PostQuantumCryptography #PQC #QDay #Cybersecurity #Cryptography #QuantumSecurity #CISO #CRQC #RSA2048

Today at 15:00 UTC we run our first free webinar, on the 2026 Q-Day estimates (11:00 New York, 16:00 Berlin). If you've read this year's qubit headlines and wondered what they mean for your plans, join us. Can't make it? Register anyway and you'll get the recording. quantumacademy.com/webinars/

The EU's post-quantum roadmap has three dates. The first one is the end of this year. By then, the EU expects initial planning, asset identification and first pilots. High-risk systems by 2030, medium-risk by 2035. The roadmap is guidance to member states, not law. But if you're regulated under NIS2 or DORA, your supervisor will want to see progress, and 'we're planning to plan' won't cut it. So we're running a free webinar on Thursday, November 12, on what that first checkpoint means in practice: an inventory scope, a risk ranking, a pilot and a plan. 13:00 UTC (14:00 Brussels, 13:00 London). Free, one hour. Register and you'll get the recording. quantumacademy.com/webinars/ #PQC #NIS2

(One of) the year's biggest papers on what it takes to break RSA and ECC goes public tomorrow. I have read it. It is serious work, but it is also going to be badly misread. It changes what a codebreaking quantum computer could look like, if one big assumption holds. Expect this paper to dominate the conversation for days, including various sky-is-falling takes. Luckily, our Q-Day estimates webinar was already on the calendar for tomorrow. The paper goes public one hour before we go live. This year Iceberg Quantum, Google, Oratomic and IonQ each published careful resource estimates, and each time the headlines exaggerated. Expect the same tomorrow. We will put tomorrow's paper next to previous ones and go through: - what it actually achieved in this paper and throughout the year (and with what assumptions) - whether any of it moves Q-Day - what to tell your board when it asks, because they will Free one-hour webinar from Quantum Academy and Applied Quantum, tomorrow, 29 October, at 15:00 UTC (16:00 CET, 11:00 ET). It will be one of the first independent readings of the paper. quantumacademy.com/event/web… #QuantumComputing #PostQuantumCryptography #PQC #QDay #CyberSecurity #CISO #Cryptography #QuantumSecurity

Directors ask four questions about quantum risk. How exposed are we? When do we have to act? What will it cost? Who owns it? On Monday, November 2, we're running a free webinar on answering them well, without scaring the board and without lulling it. Regulators have made one part easier. The EU wants high-risk systems migrated by 2030, and the US wants federal high-value systems on post-quantum key establishment by the end of 2030. You can plan against those dates instead of guessing when Q-Day arrives. If you serve on a board, or brief one as a CISO or CRO, come along. Monday, November 2, 20:00 UTC (15:00 New York, 21:00 Berlin). Free, one hour. Everyone who registers gets the recording. quantumacademy.com/webinars/ #PQC #BoardOfDirectors

Every post-quantum migration team has to answer the same first question: where is all our cryptography? When GAO reviewed the 24 major federal agencies in October, only one had completed that inventory step. CISA and NIST also have a deadline. Under Executive Order 14412, they have until about March 19, 2027 to publish minimum elements for a CBOM, a cryptographic bill of materials. So on Wednesday, November 11, we're running a free webinar on building an inventory and a CBOM your migration team can actually use, including what to do when a full inventory isn't possible. If you're an architect or a PKI engineer, or you run the migration program, this one's for you. 17:00 UTC (12:00 New York, 18:00 Berlin). Free, one hour. Everyone who registers gets the recording. quantumacademy.com/webinars/ #PQC #CBOM

NIST has published the final version of IR 8547, its plan for retiring quantum-vulnerable public-key cryptography. RSA and elliptic-curve algorithms at every approved key size are now deprecated after 2030 and disallowed after 2035. What changed from the 2024 draft: - P-256, RSA-3072 and Ed25519 had no deprecation step. Now they're deprecated from January 1, 2031, like RSA-2048, and disallowed after 2035. - A deprecated algorithm can still be used, but its owner has to examine the risk and decide. I expect auditors to ask for that decision system by system. - A hybrid with at least one approved input, such as ML-KEM, can be FIPS 140-validated even after its classical half is disallowed. - HQC is the alternative KEM and ML-KEM-768 the default parameter set. NIST says it will monitor developments and adjust its transition efforts as appropriate. What NIST left open: - Key exchange and signatures get the same dates. NIST itself says harvest now, decrypt later makes key exchange more urgent. - In Section 3.1.2, NIST still lets authentication systems wait for a CRQC. Under Table 2, the same algorithms are disallowed after 2035 regardless. - Contracts, registries and archives whose signatures must stay verifiable for decades get no guidance. My full analysis: postquantum.com/security-pqc… I cover the US requirements behind these dates in PQC Compliance: United States, a course I teach at Quantum Academy: quantumacademy.com/courses/p… #PQC #PostQuantum #NIST #Cryptography #Cybersecurity #CISO #PKI #TLS

If you work in security, risk or compliance at a bank, you've had a lot of quantum-safe reading this year. The G7 Cyber Expert Group published its roadmap in January: critical systems first, 2035 as the international target. In September, CISA and the G7 Cyber Security Working Group asked organizations to build post-quantum cryptography into procurement. And on October 20, MAS and HM Treasury discussed supervisory expectations. On Wednesday, November 4, we're running a free webinar to turn all of that into one practical question: what will you show your supervisor in 2027? 13:00 UTC (13:00 London, 14:00 Frankfurt, 21:00 Singapore). Free, one hour. Everyone who registers gets the recording. quantumacademy.com/webinars/ #PQC #Banking

This Thursday we kick off a series of free webinars at Quantum Academy, run with Applied Quantum. First topic: the Q-Day estimates. In 2019, researchers put the cost of breaking RSA-2048 at about 20 million physical qubits. In February 2026, Iceberg Quantum got it under 100,000 in a simulation. In March, Google estimated under 500,000 for 256-bit elliptic curves and set 2029 as its own migration deadline. Big drops. Then again, Google's Willow has 105 physical qubits and Quantinuum's Helios has 98. On Thursday we'll go through what changed and what Google and Quantinuum actually demonstrated in October. Then we'll get to the part you care about: your migration plan. If you have to explain these numbers to a board, come along. Thursday, October 29, 15:00 UTC (11:00 New York, 16:00 Berlin). Free, one hour. Everyone who registers gets the recording. quantumacademy.com/webinars/ It's the first of 18. The full list, through February, is on the same page. #PQC #QuantumComputing

An organization with strong PQC governance and no cryptographic inventory is not ready for the post-quantum transition, whatever an averaged score says. So I rebuilt my free PQC Readiness Scorecard around one rule from my PQC Migration Framework v3.0: your readiness level is the level of your weakest domain. The scorecard rates seven domains from 0 to 5: inventory, governance, pilots and deployment, vendors, compliance, crypto-agility, and risk. You earn a level in a domain only when every question at that level and below is a Yes. Partial and Don't know never count. Every Don't know goes on a list of knowledge gaps for you to chase. Crypto-agility also gets its own headline result. An organization can be far into its migration and still unable to change an algorithm on a date it chooses. I want that gap visible. In the results you also get the dated regulatory obligations for your jurisdictions and sectors, a checklist for each domain's next level and a one-page board summary. The scorecard is free and needs no account. Your answers never leave your browser. Why I rebuilt it, and how to use it: postquantum.com/post-quantum… #PQC #PostQuantumCryptography #QuantumSecurity #CryptoAgility #Cybersecurity #CISO #RiskManagement #QuantumReadiness

A bank supervisor should be able to measure quantum-vulnerable cryptography across its whole sector without having access to any single bank's cryptographic inventory. Collecting the inventory should be the exception. Supervisors ask three kinds of questions about a sector's cryptography. How many banks still use only classical key exchange on internet-facing systems? How many run a library affected by a newly disclosed flaw? How many depend on the same HSM firmware or certificate authority? Each answer is a sum. Each bank can compute its part from its own CBOM. The FDA already works this way. It answers drug safety questions across 541.5 million patient identifiers without collecting the records themselves, because health care organizations run the same program on their own data and send back the results. A supervisor that collects every bank's CBOM creates a ranked list of the sector's weakest systems in one place. Bloomberg reported that intruders intercepted the email of about 103 regulators at the OCC, the US national bank supervisor, from mid-2023 until the OCC found them in February 2025. In my new piece I set out the methods, their limits and five things a CISO can do before the first request for a CBOM arrives: postquantum.com/post-quantum… #PostQuantum #PQC #QuantumSecurity #CBOM #Cybersecurity #BankingSupervision #FinancialServices #CISO

I now treat every quantum-beats-classical claim in biology as a simulation until the authors prove otherwise. Italian researchers reviewed 53 peer-reviewed studies, and 36 never ran on a quantum computer. The review, by Manuel Arcieri, Paolo Zuliani and colleagues at Sapienza University of Rome and the University of Tuscia, appeared in Frontiers in High Performance Computing on 24 September. Of the 36 studies without quantum hardware, 25 simulated quantum circuits on classical machines and 11 used quantum-inspired algorithms on ordinary computers. Across all 53, 41 tested toy or heavily reduced datasets. Only 16 published both code and data. All 40 studies that compared themselves with a classical method reported parity or better. The authors say none of them demonstrated a quantum advantage. The papers I checked also report losses inside. One team reports AlphaFold3 ahead of its quantum pipeline on structural accuracy for 5 of 23 protein fragments. In another study, standard machine learning beat quantum annealing in every two-class comparison trained on the full data. Exactly one study combined quantum hardware, realistic-scale data, a classical baseline, and open code and data. Its own authors say the benefit cannot be put down to quantum behavior alone, since classical simulated annealing matched or beat their D-Wave annealers in several comparisons. The test I would put to any quantum pipeline: replace the quantum step with a strong classical solver, keep everything else the same, and compare. postquantum.com/quantum-rese… #QuantumComputing #Bioinformatics #QuantumMachineLearning #ComputationalBiology #DrugDiscovery #Genomics #Reproducibility #OpenScience

A zero-knowledge proof that your vendor's software has no Log4Shell only shows that the affected log4j versions are missing from the vendor's SBOM. Whether they are also missing from the software depends on how that SBOM was produced. TU Berlin's TrustBOM, presented at EDOC 2026 in September, is the fifth design I have reviewed for sharing facts about an SBOM without sharing the SBOM, and the closest of the five to something an enterprise could install. The vendor records a commitment to each release's SBOM on a public blockchain and keeps the SBOM private. Customers then ask for proofs that specific vulnerable packages are absent, at about 0.9 seconds of GPU proving time per package. Like the four designs before it, TrustBOM assumes the SBOM is complete. A package the SBOM tool missed, or wrote under a different name, passes every check. The public code has a second problem: its verifier reads the identity of the program it checks from the vendor's own file, so a dishonest vendor could get any claim accepted. That bug takes a small change to fix, while completeness cannot be proved from the SBOM at all. If a vendor offers you zero-knowledge attestations, ask how it knows its SBOM lists everything, and ask where your verifier gets the identity of the program it checks. postquantum.com/security-pqc… #SBOM #ZeroKnowledgeProofs #SoftwareSupplyChain #SupplyChainSecurity #ThirdPartyRisk #Cybersecurity #CISO #CBOM