Skip to content

Why now

Two clocks. Both are running.

One counts down to a quantum computer that can read today’s encrypted traffic, and that traffic can be recorded now. The other is the attacker’s, and it is now measured in minutes. A device that ships today has to answer both.

Run the numbersTalk to AgilePQ
THE QUANTUM CLOCK0 · 15510Q-DAY?years · unknownWithin 10 years: 28–49%Within 15 years: 51–70%THE ATTACKER’S CLOCK0153045BREAKOUT29minutes · averageAverage breakout: 29 minFastest: 27 seconds
Left: expert odds of a quantum computer that can factor RSA-2048 in under 24 hours. Right: eCrime breakout times in 2025.

01Harvest now, decrypt later

Nothing fails. Everything is kept.

An adversary does not need a quantum computer to start. It needs a copy of the traffic. Traffic protected by RSA or elliptic curves can be stored today and read once a large enough quantum computer exists.

YEAR2026Q-day: the date nobody can promiseField deviceTLS · RSA / elliptic curveOperatorcontrol room · cloud9F 3A C144 E0 1BB7 15 6D2E 91 D8C6 0A 737D 28 F5copied, not blockedThe archive: stored until it can be read9F 3A C1 07 5E D2 8BTANK 4 · 2.31 BAR44 E0 1B 9C 7A 2F 06GATE 12 · OPENB7 15 6D F3 08 A9 C4VALVE 7 · 34%2E 91 D8 40 7C 5B E3PUMP 3 · 1,480 RPMC6 0A 73 BF 19 E4 52FEED B · 61.2 Hz7D 28 F5 61 AE 0C 97DOOR 9 · UNLOCKED
Encrypted today, with the public-key cryptography the internet runs on.Recorded in transit. Nothing fails, so nobody notices.Readable the day a large enough quantum computer exists.

Who says it is already happening

CISA · NSA · NIST, 2023

“…cyber actors could target our nation’s most sensitive information now and leverage future quantum computing technology”

European Commission, 2025

“‘Store now, decrypt later’ attacks are already likely occurring.”

Google, 2026

“The threat to encryption is relevant today with store-now-decrypt-later attacks.”

Google has set 2029 as its own deadline to finish migrating.

The same US agencies call the threat “particularly devastating to sensitive information with long-term secrecy requirements”. A reading sent today does not expire when the link closes. It expires when its secret no longer matters.

AgilePQ’s answerNothing for a quantum computer to break later: no public-key step

02The quantum clock

Every estimate comes in smaller.

In 2019 the best published estimate to factor RSA-2048 was 20 million noisy qubits running for eight hours. In 2025 it fell below one million, in under a week. The hardware is moving too: Google’s 105-qubit Willow chip drove errors down as it scaled up.

102103104105106107108NOISY QUBITS · LOG SCALE20 million2019 · 8 hours< 1 million2025 · < 1 week20× fewerLargest error-corrected chip, 2024: 105 qubits

Noisy qubits needed to factor RSA-2048, by published estimate, on a log scale. The dashed line marks Willow’s 105 qubits (2024).

20× fewer
qubits in the 2025 estimate than in 2019: from 20 million to under one million
105qubits
on Willow, which showed errors falling “while scaling up the number of qubits”

What the experts say

Odds of a quantum computer that can factor RSA-2048 in under 24 hours

Within 10 years28–49%“quite possible”
Within 15 years51–70%“likely”
Global Risk Institute survey of 26 experts, published March 2026. Ranges and words as published.

Nobody can promise the year. Surveyed experts give better than even odds within 15 years: inside the working life of a device sold today.

AgilePQ’s answerSymmetric end to end, with keys from a key server

03Your data’s shelf life

Data has a shelf life. So does encryption.

Mosca’s inequality puts the risk in three numbers: x, how long data must stay secret; y, how long migration takes; z, how long until a quantum computer breaks today’s public-key cryptography. If x + y is greater than z, the data is already at risk.

Try

z is unknown. Anything that must stay secret for x years, sent before migration ends, is being recorded today. Every year of x + y = 15 is a bet on z.

After M. Mosca, “Cybersecurity in an era with quantum computers: will we be ready?”, IACR ePrint 2015/1075, section 1. Inputs are illustrative, not forecasts.

The examples use public anchors. x = 25: US classified information can be marked for up to 25 years. y = 15: AgilePQ’s 2020 white paper puts device field life at over 15 years; AgilePQ now says decades. z = 15: the horizon at which surveyed experts call the machine “likely”. They are scenarios, not forecasts.

x

Shelf life

US classified information is marked for declassification after 10 years, or up to 25 when its sensitivity requires it.

y

Migration

AgilePQ’s experience is that IoT deployments stay in the field for decades. A device whose cryptography cannot be replaced migrates only when the device does.

z

Collapse

Unknown. Surveyed experts put it at 28–49% within 10 years and 51–70% within 15.

And AES-128?

Not broken

NIST’s draft guidance: even with quantum computers, AES-128, AES-192 and AES-256 “will remain secure for the foreseeable future”.

Quantum barely dents it

NIST expects Grover’s algorithm, the quantum shortcut against ciphers like AES, to give “little or no advantage”.

Some buyers already ask for AES-256

For US national security systems, new purchases must be CNSA 2.0 compliant from 1 January 2027 “unless otherwise noted”, and CNSA 2.0 uses AES with 256-bit keys. France’s ANSSI encourages AES-256-level strength as a conservative choice.

Where AES-256 is required, only AES-256 meets the rule: SLiM is not a CNSA 2.0 algorithm. Where it is a choice, moving to AES-256 costs a small device time and energy. In AgilePQ’s tests, SLiM ran 2.7 times as fast as software AES-256-CTR on a 16 MHz Arm Cortex-M0.

AgilePQ’s answerEncryption chosen now, before the device ships

04The attacker’s clock

The other clock runs in minutes.

Attackers now hand work to AI, from writing exploitation scripts to running most of a campaign. Anthropic now warns that small AI models may be months away from copying themselves onto IoT devices. Breakout times have fallen to minutes. And the AI that defenders run decides from data it has to trust.

29minutes
average eCrime breakout time in 2025. The fastest took 27 seconds.
89%
more operations by AI-enabled adversaries than the year before
80–90%
of a cyber espionage campaign performed by AI, according to Anthropic, whose model was misused
62%
of the AI-driven attacks in IBM’s 2026 study targeted critical infrastructure sectors
P1P2P3P42.312.292.332.312.292.332.312.292.332.312.292.33Hacker slips in fake readings0.380.40Integrity check on every packetAI modelVALVEHOLDOPEN
The model decides from the readings it receives.Fake readings slipped in on the way flip the decision.Checked at the source, fake readings never reach the model.

NIST defines data poisoning as an adversary “inserting or modifying training samples”. A fake reading slipped in while the model is running is a different attack with the same result: a decision made on false data. In August 2026 US agencies warned of “AI-generated exploitation scripts disguised as legitimate monitoring tools” aimed at industrial controllers.

Check every reading where it is made, and a fake packet fails before any model can act on it.

37%
of breached organizations said they encrypt sensitive data both at rest and in transit

Average cost of one data breach

2026$4.99 million

$3.5M$4.0M$4.5M$5.0M2014: $3.50 million2015: $3.79 million2016: $4.00 million2017: $3.62 million2018: $3.86 million2019: $3.92 million2020: $3.86 million2021: $4.24 million2022: $4.35 million2023: $4.45 million2024: $4.88 million2025: $4.44 million2026: $4.99 million201420202026
IBM and Ponemon Institute’s global average for one data breach, by report year: from $3.5 million in 2014 to $4.99 million in 2026. The scale starts at $3.25 million, not zero. The companies and countries studied change each year.
AgilePQ’s answerA check on every packet, so fake readings are thrown out

05The deadlines

The dates are already set.

Standards bodies and governments have moved from guidance to dates. Every date still ahead falls inside the working life of a device sold this year.

  1. 2024

    • AprUK product security law in force for connected devices.UK PSTI
    • AugNIST publishes its first post-quantum standards: FIPS 203, 204, 205.NIST

  2. 2025

    • AugEU radio-equipment cybersecurity rules apply.EU RED
    • AugNIST finalizes Ascon, its lightweight standard for constrained devices.NIST SP 800-232

  3. 2026Today

    • SepEU device makers must report actively exploited vulnerabilities.EU Cyber Resilience Act
    • DecEvery EU member state starts its post-quantum transition.EU roadmap

  4. 2027

    • JanNew US national security system acquisitions must be CNSA 2.0 compliant.NSA
    • DecEU Cyber Resilience Act applies in full: data in transit encrypted by “state of the art mechanisms”.EU Cyber Resilience Act

  5. 2028

    • UK organizations to have migration goals and plans defined.UK NCSC

  6. 2029

    • Google’s own deadline to complete its post-quantum migration.Google

  7. 2030

    • DecUS high-value federal systems must use post-quantum key establishment.Executive Order 14412
    • Constrained devices in national security systems: support and prefer CNSA 2.0.NSA
    • EU high-risk systems migrated. 112-bit RSA and elliptic curve deprecated (NIST draft).EU · NIST

  8. 2031

    • UK highest-priority migrations complete; US federal signatures post-quantum.UK NCSC · EO 14412

  9. 2033

    • Constrained devices in national security systems: CNSA 2.0 exclusively.NSA

  10. 2035

    • US goal: mitigate as much quantum risk as feasible.NSM-10
    • Quantum-vulnerable public-key algorithms disallowed (NIST draft). UK migration complete.NIST · UK NCSC

06A device that ships today

Shipped today. Still talking after 2035.

AgilePQ’s experience is that IoT deployments stay in the field for decades. Draw that life from a 2026 ship date and it outlasts every deadline on the list. If its cryptography cannot be replaced in the field, the handshake it ships with is the one it keeps.

20242026202820302032203420362038204020422044204612027220303203342035Shipsin 2026Still in service in 2041and on, for decadesIn usewith an RSA or ECC handshakeRSA, ECC deprecatedNIST draft, after 2030RSA, ECC disallowedNIST draft, after 203520262024202620282030203220342036203820402042204420461234Ships in 2026In useRSA or ECC handshakeRSA, ECC deprecatedNIST draft, after 2030RSA, ECC disallowedNIST draft, after 2035Still in service in 2041and on, for decades2026
  1. 2027. EU Cyber Resilience Act applies in full.
  2. 2030. US high-value systems on post-quantum key establishment; constrained devices in national security systems prefer CNSA 2.0; 112-bit RSA and elliptic curve deprecated in NIST’s draft.
  3. 2033. Constrained devices in national security systems use CNSA 2.0 exclusively.
  4. 2035. Quantum-vulnerable public-key algorithms disallowed in NIST’s draft; the US goal for mitigating quantum risk; UK migration complete.
Ships in 2026, with the cryptography it will keep unless it can be replaced in the field.Still in service when NIST’s draft plan deprecates 112-bit RSA and elliptic curves.Still in service in 2041, years after NIST’s draft disallows quantum-vulnerable public-key algorithms.

Under NIST’s draft transition plan, 112-bit RSA and elliptic-curve algorithms are “Deprecated after 2030” and quantum-vulnerable public-key algorithms are “Disallowed after 2035”. A device with a public-key handshake that ships in 2026 and stays in service for decades spends years on algorithms that plan has retired. The colours show that handshake, not SLiM, which has none.

The time to choose a device’s cryptography is before it ships.

No public-key step

SLiM is symmetric end to end. There is no public-key step for a quantum computer to break.

Symmetric, in general

NIST does not expect to need to transition symmetric standards such as AES as part of the post-quantum migration. That is a statement about symmetric cryptography in general, not an endorsement of SLiM.

Small enough to ship

AgilePQ measured about 1,500 bytes of RAM for the full SLiM protocol on a 16 MHz Arm Cortex-M0.

Illustration: a 2026 ship date and a service life of decades, drawn to 2041 and beyond. The bar is a typical device with an RSA or elliptic-curve handshake, not SLiM. It describes no specific product. NIST IR 8547 is an initial public draft.

How SLiM worksTalk to AgilePQ

07Sources

Sources and notes36 sources · 4 from AgilePQ’s own records
  1. 1CISA, NSA and NIST: “cyber actors could target our nation’s most sensitive information now and leverage future quantum computing technology”, a threat “particularly devastating to sensitive information with long-term secrecy requirements”.NSA press release on the joint Quantum-Readiness fact sheet (21 August 2023).Sourced
  2. 2CrowdStrike: “The average eCrime breakout time fell to just 29 minutes in 2025”, the fastest observed was 27 seconds, and “AI-enabled adversaries increased operations by 89% year-over-year”.CrowdStrike 2026 Global Threat Report (24 February 2026).Sourced
  3. 3Global Risk Institute survey of 26 experts: a quantum computer able to factor RSA-2048 in under 24 hours is “quite possible (28-49%) within the next 10 years” and “likely (51-70%) in the next 15”.Global Risk Institute, Quantum Threat Timeline Report (2025 survey, published March 2026).Sourced
  4. 4NIST’s draft transition plan marks RSA and elliptic-curve algorithms at 112-bit strength “Deprecated after 2030” and quantum-vulnerable public-key algorithms “Disallowed after 2035”. It is still an initial public draft.NIST IR 8547 ipd, Transition to Post-Quantum Cryptography Standards (12 November 2024).Sourced
  5. 5European Commission: “‘Store now, decrypt later’ attacks are already likely occurring.”European Commission, Post-Quantum Cryptography policy page (June 2025).Sourced
  6. 6Google: “We’re setting a timeline for post-quantum cryptography migration to 2029.” “The threat to encryption is relevant today with store-now-decrypt-later attacks.”Google (25 March 2026).Sourced
  7. 7Gidney and Ekerå estimated that RSA-2048 could be factored in 8 hours with 20 million noisy qubits.C. Gidney, M. Ekerå, How to factor 2048 bit RSA integers in 8 hours using 20 million noisy qubits, arXiv:1905.09749 (2019); Quantum 5, 433 (2021).Sourced
  8. 8Gidney: “a 2048 bit RSA integer could be factored in less than a week by a quantum computer with less than a million noisy qubits” (same hardware assumptions as 2019).C. Gidney, arXiv:2505.15917 (21 May 2025).Sourced
  9. 9Google’s 105-qubit Willow chip demonstrated error correction “below threshold”: “being able to drive errors down while scaling up the number of qubits.”Google (9 December 2024).Sourced
  10. 10AgilePQ’s 2020 white paper says IoT deployments may remain in the field for over 15 years; AgilePQ now describes that service life as decades.AgilePQ, SLiM Security for Cellular, Satellite, and Constrained Networks (2020), page 3.AgilePQ record
  11. 11Data is at risk when x + y > z: x is how long it must stay secret, y is how long migration takes, z is how long until a quantum computer breaks today’s public-key cryptography.M. Mosca, “Cybersecurity in an era with quantum computers: will we be ready?”, IACR ePrint 2015/1075, section 1.Sourced
  12. 12U.S. classified information is marked for declassification after 10 years, or up to 25 years when its sensitivity requires it.Executive Order 13526, section 1.5(b).Sourced
  13. 13NIST: “Even with the impact of quantum computers, AES-128, AES-192, and AES-256 will remain secure for the foreseeable future.” The draft lists all three as acceptable, with no end date.NIST SP 800-131A Rev. 3, initial public draft (October 2024), footnote 4 and Table 1.Sourced
  14. 14NIST: “it is quite likely that Grover’s algorithm will provide little or no advantage in attacking AES, and AES 128 will remain secure for decades to come.” “Current applications can continue to use AES with key sizes 128, 192, or 256 bits.”NIST, Post-Quantum Cryptography FAQs (answer added 18 November 2018; page updated 5 August 2026).Sourced
  15. 15NSA: “by January 1, 2027, all new acquisitions for NSS will be required to be CNSA 2.0 compliant unless otherwise noted”; symmetric encryption is AES with “256-bit keys for all classification levels”.NSA, CNSA 2.0 FAQ v2.1 (December 2024).Sourced
  16. 16ANSSI: “there is no concrete evidence that symmetric cryptographic mechanisms would be significantly threatened by quantum computers”; it encourages, as a conservative choice, “at least the same security level as AES-256 for block ciphers”.ANSSI views on the Post-Quantum Cryptography transition (2023 follow up), 21 December 2023.Sourced
  17. 17On a 16 MHz Arm Cortex-M0 without hardware acceleration AgilePQ measured SLiM at 39,552 B/s against 19,891 B/s for AES-128-CTR, 14,431 B/s for AES-256-CTR and 9,914 B/s for AES-256-CBC: two to four times faster than the software AES in those tests. Speeds of software AES libraries differ from one implementation to another, so the ratio holds for the AES AgilePQ tested.AgilePQ engineering benchmarks (July 2021).AgilePQ record
  18. 18FBI, CISA and partners warned of actors “using AI-generated exploitation scripts disguised as legitimate monitoring tools” against industrial controllers.Joint advisory AA26-231A (August 2026).Sourced
  19. 19Anthropic: “the threat actor was able to use AI to perform 80-90% of the campaign, with human intervention required only sporadically”.Anthropic, Disrupting the first reported AI-orchestrated cyber espionage campaign (13 November 2025).Sourced
  20. 20Anthropic: “Our experiments suggest that small AI models may be months away from being capable enough to self-replicate” on commercial internet-of-things devices. “If small models improve at their historical rate, they’ll match this capability level by the end of this year.” Home and small-business devices may be the first targets “because they’re connected to the internet and, historically, have had minimal security measures in place.”Anthropic, AI models may be capable of self-replicating without access to a datacenter (12 October 2026).Sourced
  21. 21IBM gives “the global breach average of $4.99 million”. It reports that “Only 37% of breached organizations stated that they encrypt sensitive data both at rest and in transit” and that “Most AI-driven attacks reported in the study targeted critical infrastructure sectors (62%)”.IBM, Cost of a Data Breach Report 2026 (29 July 2026; 602 organizations, breaches March 2025–February 2026).Sourced
  22. 22NIST: “In a DATA POISONING attack, an adversary controls a subset of the training data by either inserting or modifying training samples.”NIST AI 100-2 E2025, Adversarial Machine Learning, section 2.1.1 (24 March 2025).Sourced
  23. 23IBM and Ponemon Institute, global average cost of a data breach by report year: 2014 $3.5M; 2015 $3.79M; 2016 $4.00M; 2017 $3.62M; 2018 $3.86M; 2019 $3.92M; 2020 $3.86M; 2021 $4.24M; 2022 $4.35M; 2023 $4.45M; 2024 $4.88M; 2025 $4.44M; 2026 $4.99M. The countries and companies studied change from year to year, and each report year covers breaches from roughly the year before.Ponemon Institute release (5 May 2014) and 2015 report; IBM newsroom releases 2016 (IBM Italy, 17 June 2016), 2017 (IBM India, 20 June 2017), 2018 (IBM UK, 11 July 2018) and 2019–2026; IBM 2019 report.Sourced
  24. 24EU Cyber Resilience Act: applies from 11 December 2027, with reporting of actively exploited vulnerabilities from 11 September 2026. Products must “protect the confidentiality of stored, transmitted or otherwise processed data … such as by encrypting relevant data at rest or in transit by state of the art mechanisms”. Fines reach EUR 15 000 000 or 2.5% of worldwide annual turnover, whichever is higher.Regulation (EU) 2024/2847, Article 71(2), Annex I Part I (2)(e), Article 64(2).Sourced
  25. 25Executive Order 14412 directs agencies to “transition all HVAs and high impact systems to use PQC for key establishment by December 31, 2030” and for digital signatures by 31 December 2031, and calls for a rule requiring covered contractors “to comply by December 31, 2030, with NIST’s FIPS, including all applicable FIPS incorporating PQC compliant algorithms.”Executive Order 14412, Securing the Nation Against Advanced Cryptographic Attacks (22 June 2026; Federal Register 2026-12909).Sourced
  26. 26NSA CNSA 2.0: “Niche equipment (e.g., constrained devices, large public-key infrastructure systems): support and prefer CNSA 2.0 by 2030, and exclusively use CNSA 2.0 by 2033.” “NSA expects the transition to QR algorithms for NSS to be complete by 2035.”NSA, Announcing the Commercial National Security Algorithm Suite 2.0 (September 2022).Sourced
  27. 27National Security Memorandum 10 sets the goal “of mitigating as much of the quantum risk as is feasible by 2035”.NSM-10 (4 May 2022), via govinfo.Sourced
  28. 28UK NCSC milestones: by 2028 define migration goals and plan; by 2031 complete the highest-priority migrations; by 2035 “Complete migration to PQC of all your systems, services and products”.NCSC, PQC migration timelines (20 March 2025).Sourced
  29. 29SLiM is symmetric end to end. A key server gives each device its own keys and issues session keys; the encryption changes with every packet. SLiM uses no RSA or elliptic-curve key exchange.AgilePQ, SLiM Overview v2.4 (April 2021) and SLiM Technical Overview v2.4.9 (January 2024).AgilePQ record
  30. 30NIST on AES and other symmetric standards: “NIST does not expect to need to transition away from these standards as part of the PQC migration.”NIST IR 8547 ipd (12 November 2024).Sourced
  31. 31AgilePQ measured about 800 bytes of RAM for the standalone SLiM library and about 1,500 bytes for the full protocol, on a 16 MHz Arm Cortex-M0 compiled at -O3.AgilePQ engineering benchmarks (July 2021).AgilePQ record
  32. 32The UK’s Product Security and Telecommunications Infrastructure regulations “come into force on 29th April 2024”.The Product Security and Telecommunications Infrastructure (Security Requirements for Relevant Connectable Products) Regulations 2023, SI 2023/1007.Sourced
  33. 33NIST approved its first three post-quantum standards in August 2024: FIPS 203 (ML-KEM, key establishment), FIPS 204 (ML-DSA, signatures) and FIPS 205 (SLH-DSA, hash-based signatures). They are public-key algorithms.Federal Register 2024-17956 (effective 14 August 2024).Sourced
  34. 34The EU Radio Equipment Directive cybersecurity requirements (Delegated Regulation (EU) 2022/30) apply from 1 August 2025, with harmonised standards EN 18031-1, -2 and -3.Commission Implementing Decision (EU) 2025/138 (28 January 2025).Sourced
  35. 35NIST SP 800-232 standardizes the Ascon family (Ascon-AEAD128, Ascon-Hash256, Ascon-XOF128, Ascon-CXOF128) for constrained devices, “a viable alternative when the Advanced Encryption Standard (AES) may not perform optimally”.NIST SP 800-232, final (13 August 2025).Sourced
  36. 36EU roadmap: “By 31.12.2026: At least the First Steps have been implemented by all Member States”; by 31.12.2030 the transition for high-risk use cases is completed; by 2035 medium-risk is completed and low-risk completed as far as feasible.Coordinated Implementation Roadmap for the transition to Post-Quantum Cryptography, v1.1 (June 2025).Sourced