The cost of waiting: a decision-theoretic synthesis of early versus late post-quantum migration under uncertainty

1 Introduction

In August 2024, the U.S. National Institute of Standards and Technology (NIST) approved the first three federal standards for post-quantum cryptography: FIPS 203 for key encapsulation, FIPS 204 for digital signatures, and FIPS 205 as a hash-based signature alternative (National Institute of Standards and Technology, 2024a; National Institute of Standards and Technology, 2024b; National Institute of Standards and Technology, 2024c). The approval closed an 8-year selection process and opened a longer and more diffuse one: the replacement of quantum-vulnerable algorithms across the deployed base of cryptographic systems. NIST has since signaled that algorithms providing 112 bits of classical security, including RSA-2048 and the widely used elliptic-curve schemes, are to be deprecated after 2030 and disallowed after 2035 (Moody et al., 2024). Parallel deadlines bind national security systems through the National Security Agency’s Commercial National Security Algorithm Suite 2.0 (National Security Agency, 2024) and U.S. federal civilian systems through National Security Memorandum 10 (Biden, 2022). The United Kingdom has published a comparable schedule with milestones in 2028, 2031, and 2035 (National Cyber Security Centre (NCSC)).

The standards and deadlines settle what to migrate to and, for regulated entities, the latest acceptable completion date. They do not settle when a given organization should begin or how aggressively it should sequence the work ahead of any binding deadline. That decision is an investment problem under uncertainty. The cost of migrating is large, immediate, and reasonably well-characterized; the U.S. Office of the National Cyber Director projects roughly $7.1 billion in 2024 dollars to migrate prioritized federal civilian systems between 2025 and 2035 (Office of the National Cyber Director, 2024). The benefit of migrating, by contrast, is the avoidance of a harm whose timing is genuinely unknown, because no one can presently date the arrival of a cryptographically relevant quantum computer (CRQC). The most recent expert elicitation places the probability of such a machine within 10 years between 28% and 49%, the highest in the survey’s 7-year history (Mosca and Piani, 2025).

This combination, a concrete cost weighed against a probabilistic and deferred benefit, is the canonical setting of investment-timing analysis, and it has produced a small but growing literature offering decision support. The recommendations in that literature diverge. Risk-management framings rooted in the Mosca inequality conclude that many organizations are already behind schedule and must begin at once (Mosca, 2018). Economic framings that import the expected-value logic of information-security investment can rationalize substantial deferral, because the discounted expected loss from a distant and uncertain threat may be smaller than the certain near-term outlay (Gordon and Loeb, 2002). At least one analysis argues that economically useful quantum computation will arrive before cryptographically relevant quantum computation, which a deferral-minded reader could take as a license to wait (Scholten et al., 2024).

The divergence is not primarily empirical. The same publicly available facts, the standards, the cost estimates, and the expert surveys feed all of these treatments. What differs is the modeling apparatus: how the arrival of the threat is represented, what costs and harms are admitted into the objective, what discount rate is applied to the future, and what decision criterion is used to act under the residual uncertainty. The purpose of this article is to make those choices visible and to trace how each one moves the recommendation.

We address three questions. First, what modeling approaches have been used to evaluate the timing of post-quantum migration? Second, how do their assumptions, specifically the threat-arrival distribution, the cost structure, the discount rate, and the value placed on data at risk, differ, and how sensitive are the conclusions to these choices? Third, under what assumption sets does early migration dominate, and where does the case for it weaken?

The contribution is a comparative methodological synthesis rather than a new model. Its central claim is that the published disagreement over migration timing is largely an artifact of three undeclared modeling choices, namely, how the arrival of a cryptographically relevant quantum computer is represented, what discount rate is applied to future harm, and whether harvest-now, decrypt-later interception is admitted into the objective at all; once those choices are made explicit and held fixed, the recommendations converge more than the surface debate suggests. We do not run simulations or collect data. We extract the structure of existing models, compare and stress their assumptions conceptually, and identify the parameters that drive divergent conclusions. Where a decision schematic helps expose the logic, we present one and label it as illustrative. The analysis is deliberately even-handed about the value judgments embedded in the discount-rate and arrival-distribution choices because treating those judgments as if they were settled facts is, we argue, the main reason the literature appears to disagree more than it actually does.

The article proceeds as follows. We first situate migration timing within the broader theory of security investment and decision under uncertainty. We then survey the models that have been brought to bear on PQC migration, extracting the structure of each. A comparative section stresses the assumptions and isolates the drivers of divergence. An illustrative decision tree follows, built only to expose the underlying logic. We close with guidance for decision-makers reasoning under deep uncertainty, a statement of limitations, and a short research agenda.

1.1 Scope and assumptions

Several scoping decisions shape what follows. We treat the migration decision at the level of an organization or a system owner, not at the level of a single protocol or cryptographic primitive. We take the NIST standards as given and address only the timing of migration; the choice among the standardized algorithms is outside our scope. We assume that hybrid deployment, running a classical and a post-quantum algorithm together during transition, is technically available, because every major guidance document treats it as the default transitional posture (European Union Agency for Cybersecurity, 2021; National Security Agency, 2024). We treat the cost figures from official sources as rough orders of magnitude, consistent with how their authors describe them (ONCD, 2024). Finally, where we refer to a probability of arrival of CRQC, we mean the aggregated judgment of the surveyed experts. This is a subjective probability, and its distinction from a frequentist or physically derived one matters for the decision criterion, so we return to it.

1.2 Review approach and model selection

This is a narrative synthesis rather than a systematic review. We selected the model families that recur in the published post-quantum-migration and security-investment literature and, for each, one or more representative exemplars; the aim is analytic coverage of the distinct modeling logics, and we make no claim to enumerate every published treatment; other implementations of each family exist. The comparison that follows is conceptual: we characterize each family along a fixed set of dimensions (objective, parameters, threat-arrival assumption, cost components, discount rate, and headline conclusion) and reason about how each assumption moves the recommendation, rather than fitting or running a new model.

To make the basis of that selection explicit, the search was purposive rather than exhaustive. We drew on three bodies of work: the official guidance issued by the standards bodies and national cybersecurity agencies (NIST, the NSA, ENISA, the NCSC, and the ONCD, among others), the expert elicitations that quantify the arrival of the quantum threat (the Mosca–Piani quantum threat timeline reports), and the decision-analytic and economic sources from which each timing model inherits its structure (the literature on investment under uncertainty, security investment, and decision under deep uncertainty). Within these bodies, a source was included when it contributed a distinct decision structure or a parameter that materially moves the timing conclusion, and sources were set aside when they added neither. This criterion, rather than a database query against predefined search strings, governed what entered the synthesis.

The four families are treated as representative on the same logic, because each embodies a different decision criterion rather than merely a different notation. The Mosca inequality tests feasibility against a deadline; the expected-value and net-present-value models minimize the discounted expected cost; the real-options models value the flexibility to time an irreversible commitment; and the risk-prioritization and portfolio models rank systems for sequencing rather than valuing timing at all. A treatment that recurs in the literature but reduces to one of these criteria is regarded as a further implementation of the same family rather than a distinct approach. Because the selection is purposive and criterion-based, it is not a systematic review, and we make no claim to have enumerated every published treatment; the aim is analytic coverage of the distinct modeling logics that generate divergent recommendations.

2 Background: decision theory and economic evaluation applied to security investment

2.1 The structure of a timing decision

Choosing when to migrate is an instance of investment timing. The decision-maker holds an opportunity to incur a cost now in exchange for protection against a future loss whose magnitude and timing are uncertain. Three features of the PQC case complicate the textbook treatment. The investment is largely irreversible: cryptographic re-engineering, certificate re-issuance, and protocol upgrades cannot be unwound at low cost. The threat against which the investment protects is uncertain in both its arrival and severity. In addition, distinctively, a portion of the harm can be incurred before the threat materializes because an adversary can record protected traffic today and decrypt it once a CRQC exists.

The first two features place the problem within the framework of investment under uncertainty developed by Dixit and Pindyck (1994). Their central result is that irreversibility plus uncertainty creates an option value of waiting: because committing forecloses the chance to act on better information later, the threshold for investing should exceed the simple break-even point. A firm with an opportunity to invest “is holding an ‘option’ analogous to a financial call option” (Dixit and Pindyck, 1994, p. 3), and the value of keeping that option alive is an opportunity cost that should be added to the cost of investing. Applied naively, this logic argues for patience: wait, learn more about the quantum timeline, and migrate when the threat is clearer.

The distinction between these three features carries analytical weight. Each maps to a different term in any formal timing model, and the literature’s disagreements can be traced to which terms a given model chooses to include. Irreversibility of the migration investment is a sunk-cost term that, on its own, counsels caution before committing. Uncertainty regarding the threat’s arrival is a probability or distribution term whose representation we examine at length below. The third feature, present-tense harm from interception, is the term most often dropped, and dropping it is what allows a model to treat the entire benefit of migration as a deferred and discountable future event. Keeping all three terms in view is the minimum requirement for a faithful model of the PQC timing problem, and much of the apparent conflict in the literature dissolves once one asks, of each treatment, which of the three it actually represents.

The third feature breaks the naive application. The option-to-wait result assumes that deferral leaves the future payoff intact, merely delayed. Under “harvest now, decrypt later” interception, deferral does not preserve the payoff; it leaks it. Data with long confidentiality requirements that traverse or rest in systems during the waiting period can be captured and stored, so the harm is locked in at the moment of interception even though it is realized only at decryption. The option to wait, therefore, carries a hidden, accruing cost that the standard model does not contain. We develop this point in the comparative analysis because it is the single feature that most sharply separates conclusions.

2.2 Economic models of security investment

The economics of information security provides the closest established template. Gordon and Loeb, (2002) modeled optimal security investment as the level of spending that maximizes the expected net benefit, defined as the reduction in expected loss minus the cost of the investment. For two broad classes of breach-probability functions, they proved that “this fraction never exceeds 37% of the expected loss” (Gordon and Loeb, 2002, p. 438), and is usually much smaller. The result is often misread as a budgeting rule of thumb; its actual content is that risk-neutral firms should spend only a fraction of expected loss, and that very high-vulnerability assets are not necessarily the ones where investment yields the most benefit.

The 37% figure is the value of 1 e that emerges from the optimization for both classes of breach-probability function the authors consider rather than an arbitrary ceiling; their appendix shows that the optimal outlay, represented as z v, satisfies z v < 1 e v L, where v is vulnerability and L is the loss (Gordon and Loeb, 2002, p. 454). The practical implication for the PQC case is sobering for the early-migration advocate who reasons purely in expected-value terms. If the expected loss from a future breach is itself discounted heavily and weighted by a low near-term arrival probability, the optimal expenditure can be a small fraction of an already-discounted number, which a strict application of the rule would read as a mandate to spend little now. The framework thereby encodes the deferral intuition directly, but it is only because it accepts the breach probability and loss as given inputs and does not ask how they were formed.

The Gordon–Loeb framework is an expected-value optimization. It presumes a known or estimable probability of breach and a known loss, and it selects the spending level that maximizes discounted expected net benefit. Imported into the PQC timing problem, it produces a clear prescription: migrate when the discounted expected loss avoided exceeds the discounted cost of migrating, and not before. Whether that condition is met today depends entirely on the probability assigned to near-term CRQC arrival and on the discount rate, which is the crux we examine later. The framework’s limitation for the PQC case is that it does not model irreversibility, timing flexibility, or interception harm. It fixes the level of security spending but leaves open when that spending should occur, which is the question this article addresses.

Real-options treatments address the timing gap. Chronopoulos et al. (2018) developed an analytical real-options framework for cybersecurity investment and found that greater uncertainty over the cost of attacks increases the value of the option to invest, which can either accelerate or delay action depending on the structure of the embedded options. The general lesson from this branch is that uncertainty does not have an unambiguous sign: it increases the value of waiting when waiting preserves the payoff, but it increases the value of acting when delay exposes the firm to irreversible loss. The PQC case contains both forces, and which one dominates is something the analyst must assume; the model does not establish it.

2.3 Decision under risk versus decision under uncertainty

The expected-value and option-value models share a prerequisite: a probability distribution over the uncertain quantity. Whether that prerequisite is satisfied for the CRQC arrival is doubtful, and the doubt has a long pedigree. Knight (1921) distinguished measurable risk, where outcomes can be assigned probabilities, from true uncertainty, where they cannot. The arrival of a CRQC is closer to the second category. It depends on unrealized engineering breakthroughs, undisclosed state programs, and algorithmic advances that, by their nature, cannot be reliably forecast. Expert surveys produce numbers, but those numbers are aggregated subjective judgments that have moved sharply year to year, not at stable frequencies; the optimistic 10-year estimate rose by 15% points between the 2024 and 2025 elicitations (Mosca and Piani, 2025).

When a probability distribution cannot be confidently assigned, decision theory offers criteria that do not require one. Wald (1950) formalized the minimax criterion: when a prior distribution over states of nature “does not exist or is unknown,” treat nature as an adversary and choose the action whose worst-case outcome is the least bad. Savage (1951) proposed minimax regret as a less pessimistic alternative, in which the decision-maker minimizes the largest possible regret, defined as the gap between the outcome achieved and the best outcome attainable in each state. These criteria formalize precautionary reasoning. Applied to migration, they ask not “what is the expected loss?” but “how bad is the worst case if I wait, and can I tolerate it?”

The policy-analysis tradition has built operational methods on the same foundation. Robust decision making, developed at RAND, reframes the long-range question from “what will the future bring?” to “how can we choose actions today that will be consistent with our long-term interests?” and seeks strategies that perform acceptably across a wide range of plausible futures rather than optimally for a single forecast (Lempert et al., 2003; Lempert, 2019). This framing is well-matched to PQC migration, where the range of plausible CRQC arrival dates spans more than 2 decades and no point-estimate commands consensus.

The choice between an expected-value criterion and a robustness criterion is itself the deepest of the contestable choices because it determines whether the year-to-year movement in expert probabilities should drive the decision at all. In keeping with the literature on decision under deep uncertainty, we treat this choice as a value judgment that the analyst must make and defend.

3 Survey of existing models and their structures

This section extracts the structure of the principal models that have been applied, explicitly or implicitly, to the timing of post-quantum migration. We characterize each by its objective, its key parameters, its treatment of the threat arrival, its cost components, its discount rate, and its headline conclusion. Table 1 collects the comparison; the prose here develops the reasoning behind each row.

TABLE 1. Side-by-side structure of reviewed migration-timing models.

CRQC, cryptographically relevant quantum computer; HNDL, harvest now, decrypt later; NPV, net present value. The expected-value/NPV row characterizes a model family whose components are established in the cited literature; no peer-reviewed model of this exact form specific to post-quantum migration timing was located. Adapted from the sources listed in the final column.

3.1 The Mosca risk inequality

The most widely cited timing model is the inequality introduced by Mosca (2018). It defines three quantities: X, the security shelf-life, meaning the number of years that protected information must remain confidential; Y, the migration time, meaning the years required to move systems to a quantum-safe state; and Z, the collapse time, meaning the years until an adversary obtains a CRQC capable of breaking the deployed cryptography. The decision rule is stark: if X + Y > Z, the organization cannot guarantee the required X years of confidentiality and must regard itself as already at risk (Mosca, 2018; see also Mosca and Mulholland, 2017).

The inequality is best understood as a deadline constraint rather than an optimization. Its objective is feasibility, not cost minimization: it asks whether protection for the required period is even achievable given how long migration takes and when the threat arrives. Its parameters are three durations. Its treatment of threat arrival is a single point estimate, Z, although the framework accommodates uncertainty by inviting the analyst to test a range of Z values. It contains no explicit cost term and no discount rate; cost enters only indirectly, through Y, since a faster migration is more expensive and disruptive (Mosca, 2018). Its headline conclusion is that any organization whose data must outlive the plausible arrival of a CRQC, after accounting for a multi-year migration, cannot afford to wait.

The inequality’s force comes from a structural observation about the confidentiality horizon. Even under conservative estimates of Z, long-lived data generated and transmitted today inherits a confidentiality horizon that extends past Z because the migration itself consumes years, during which vulnerable cryptography remains in production. The joint U.S. advisory issued by the Cybersecurity and Infrastructure Security Agency, the NSA, and NIST makes the same point operationally: early planning is necessary because adversaries “could be targeting data today that would still require protection in the future” through a harvest-now, decrypt-later operation (Cybersecurity and Infrastructure Security Agency, National Security Agency, and National Institute of Standards and Technology, 2023).

3.2 Expected-value and net-present-value cost models

A second family treats migration as a discounted cash-flow problem. The objective is to minimize the present value of the total expected cost, defined as the certain cost of migrating along with the discounted expected cost of a breach, where the latter is the probability of the arrival of a CRQC within the relevant window multiplied by the loss conditional on arrival. The decision rule compares the present value of migrating now against the present value of migrating later and chooses the cheaper path.

No published model of this exact form specific to PQC timing has been peer-reviewed, but its components are well-established, and its logic is implicit in policy cost analyses. The cost side is anchored by the ONCD estimate of $7.1 billion in 2024 dollars for federal civilian migration over 2025 to 2035, which its authors are careful to call a “rough order of magnitude rather than precise calculations” (ONCD, 2024). The probability side is anchored by the expert elicitations of Mosca and Piani (2024), Mosca and Piani (2025). The discount rate, in a U.S. federal setting, is governed by the OMB Circular A-94, and the operative rate has itself moved with policy rather than with economics: the 1992 edition prescribed a 7% real rate for benefit–cost analysis of public investment; the November 2023 revision replaced it with a much lower real rate (2.0%, or 3.1% where benefits and costs are not certainty-equivalent); and the OMB Memorandum M-25-23 revoked that revision in April 2025 and reinstated the 1992 circular, so the benefit–cost rate is 7% is again, with treasury-based rates retained for cost-effectiveness analysis (OMB, 2023; Office of Management and Budget, 2025).

The structure of this family makes its sensitivity transparent. With a low near-term arrival probability and a high discount rate, the discounted expected breach cost can fall below the migration cost, and the model recommends deferral. With a high arrival probability or a low discount rate, the ordering reverses. The model’s conclusion is, therefore, not a property of the quantum threat; it is a property of the two numbers that the analyst supplies. This is the family most often invoked, usually informally, to justify a measured pace, and it is also the family that is most vulnerable to the objection that it omits interception harm.

3.3 Real-options and irreversibility models

A third family applies the real-options logic of Dixit and Pindyck (1994) and the cybersecurity adaptation of Chronopoulos et al. (2018). Its objective is to value the flexibility to time the investment. Its parameters add to the cost model a representation of how uncertainty resolves over time and how much of the investment is irreversible. Its treatment of threat arrival is a stochastic process rather than a point estimate. It carries a discount rate like the cost model.

A related argument is sometimes read as support for the real-options case for patience. Scholten et al. (2024) analyzed the resource requirements of known cryptanalytic algorithms and concluded that “there is a credible expectation that quantum computers will be capable of performing computations that are economically impactful before they will be capable of performing ones that are cryptographically-relevant” (Scholten et al., 2024). A deferral-minded reader can take this as evidence that cryptographic risk is comparatively distant and that resources are better spent elsewhere first. The inference does not survive scrutiny of what the authors actually claim. The same article notes that the maturity of available machines “is not yet at a level where they can be used in production” and explicitly acknowledges that “improvements in quantum algorithms for these problems are taking place in the literature” (Scholten et al., 2024). A statement that economic relevance precedes cryptographic relevance is a statement about ordering, not about dates, and it says nothing about whether the cryptographic threshold falls inside the confidentiality horizon of data being protected today. The ordering claim is fully consistent with a CRQC arriving within the lifetime of long-lived secrets, which is the only thing the timing decision turns on. Used as a license to wait, the argument substitutes a relative ordering for the absolute deadline that the Mosca inequality makes explicit.

The generic real-options result favors waiting because the option to act on better information later has positive value when the underlying payoff is preserved by delay. The PQC application is unusual because two of its features push in opposite directions. Irreversibility of the migration investment raises the option value of waiting, consistent with the standard result. However, irreversibility of the harm, through interception of long-lived data, destroys the option value of waiting for the affected data because the loss is incurred at interception and cannot be recovered by migrating afterward. The net sign depends on the share of an organization’s protected data that is both long-lived and exposed to interception. For an organization whose sensitive data are short-lived and never leave controlled environments, the option value of waiting is positive and the model counsels patience. For an organization holding decades-long secrets that traverse public networks, the option value of waiting is negative for those data and the model counsels immediate action.

3.4 Risk-prioritization and portfolio models

A fourth family, exemplified by national and agency guidance, does not produce a single timing recommendation but a prioritization. The objective is to allocate a fixed migration effort across a heterogeneous portfolio of systems. The parameters are, for each system, a quantum-risk score driven by data sensitivity and shelf life and a migration-difficulty score driven by complexity and dependencies. The threat arrival enters as a shared, organization-wide horizon rather than a per-system quantity. There is no discount rate; the model is a ranking, not a valuation. The headline conclusion sequence is: migrate high-risk, long-shelf-life, harvest-exposed systems first and defer low-risk, short-shelf-life systems (Cybersecurity and Infrastructure Security Agency, National Security Agency, and National Institute of Standards and Technology, 2023; NCSC, 2025; ENISA, 2021).

This family is best read as complementary to the others rather than competing with them. It takes the timing decision as partially settled, that migration will take place within the deadline window, and addresses the within-window sequencing that the deadline does not specify. Its practical importance is large because it converts a binary “now or later” question into a graded program in which the most exposed assets move first regardless of how the aggregate timing debate resolves.

4 Comparative assumption analysis and sensitivity of conclusion

This section is where the article’s central claim is demonstrated: the apparent disagreement among the four families traces to a small set of modeling choices rather than to the facts, and making those choices explicit narrows it. The four families above do not disagree about facts. They disagree because they admit different quantities into the objective and represent the same uncertainty in different ways. Three assumptions account for nearly all of the divergence in their recommendations. Table 2 summarizes the direction in which each assumption pushes the early-versus-late conclusion; this section explains the mechanism behind each entry.

TABLE 2. Qualitative assessment of the assumptions driving divergence in conclusions.

HNDL, harvest now, decrypt later. Directions and strength are reasoned cross-model comparisons drawn from the reviewed literature, not the output of a new sensitivity analysis. The first three rows (threat-arrival representation, discount rate, and interception-harm modeling) are the principal drivers that account for nearly all of the divergence; the remaining rows are secondary. “Strength of effect” refers to how much an assumption contributes to divergence between published analyses, not to its local mathematical sensitivity. Threat arrival and data shelf-life enter the Mosca inequality symmetrically, so an equal change in either moves that feasibility test by the same amount. Arrival is rated higher because it appears in all four families and is contested and revised yearly, while shelf-life is usually a known property of a given system; it, therefore, varies across systems within an analysis more than it divides one analysis from another.

4.1 The threat-arrival assumption

Every model needs some representation of when the threat arrives, and the representation chosen has a first-order effect on the recommendation. Three representations appear in the literature, and they are not interchangeable.

The first is a point estimate used by the Mosca inequality through its single Z. A point estimate forces a crisp answer but hides the analyst’s uncertainty; moving Z by a few years can flip the inequality. The second is a probability distribution used by the expected-value and real-options families that is typically derived from the Mosca–Piani expert surveys. A distribution is more honest about uncertainty but inherits the instability of its source: the surveyed 10-year probability changed from a 19%–34% range in 2024 to a 28%–49% range in 2025, which is a shift large enough to change the sign of an expected-value comparison without any change in the underlying physics (Mosca and Piani, 2024; 2025). The third is a range without probabilities, used by robustness approaches, which treat the span from optimistic to pessimistic arrival as a set of futures to be survived rather than a distribution to be averaged (Lempert et al., 2003).

The technical literature on resource requirements illustrates why even the experts move. The benchmark estimate for factoring RSA-2048 fell from 20 million noisy qubits in 8 hours (Gidney and Ekerå, 2021) to fewer than one million noisy qubits in under a week within 4 years, and it was driven by algorithmic and error-correction advances rather than hardware (Gidney, 2025). A more than 20-fold reduction in the qubit count required to break the most widely deployed public-key algorithm, achieved without any new hardware, is the kind of discontinuity that no smooth extrapolation of physical qubit counts would have predicted. It is also the kind of advance that moves the entire arrival distribution leftward at a stroke because the threshold that the hardware must reach has itself decreased. A model that hard-codes a resource threshold and a hardware growth curve will produce a confidently wrong date; a model that treats the threshold itself as uncertain will produce a wider, more defensible band. The lesson is that the arrival assumption should carry its own uncertainty explicitly, and that any timing conclusion stated without a sensitivity range over arrival is fragile. This is also why the year-to-year movement in the expert elicitations should be read as a feature of the problem rather than as noise to be smoothed away: the experts are responding to genuine shifts in what the threshold requires, and a decision procedure that is destabilized by such shifts is poorly matched to the underlying uncertainty.

The direction of the effect is unambiguous. Earlier assumed arrival, whether expressed as a smaller Z, a higher near-term probability, or a left-shifted range, strengthens the case for early migration in every family. The families differ only in how much an arrival shift moves the recommendation, with the point-estimate inequality being the most sensitive factor because it has no other margin to absorb the change.

4.2 The discount rate

The discount rate converts future costs and harms into present terms, and in a problem where costs are near and harms are far, it is decisive. A high rate shrinks the present value of a distant breach more than it shrinks the present value of near-term migration spending, tilting the comparison toward deferral. A low rate does the opposite.

The range of defensible rates is wide, and the choice is a value judgment rather than a technical fact. U.S. federal guidance illustrates the swing directly. Its 1992 edition prescribed a 7% real rate to approximate the private-sector opportunity cost of capital in benefit–cost analysis; the November 2023 revision replaced that with a much lower real rate near 2% (3.1% where benefits and costs are not certainty-equivalent); and in April 2025, that revision was itself revoked and the 1992 circular reinstated, restoring 7% for benefit–cost analysis while retaining Treasury-based rates for cost-effectiveness comparisons (OMB, 2023; 2025). The gap between 7% and 2% is not a rounding difference. Over a 15-year horizon, a harm discounted at 7% retains about 36% of its undiscounted value, while the same harm discounted at 2% retains approximately 74%; the high rate makes the future harm look approximately half as large. An expected-value model can be made to recommend either action by a defensible choice of rate alone.

Two considerations argue for a lower rate in this setting than a naive application of the 7% figure would suggest. First, the harm being deferred is partly a confidentiality loss to third parties whose data the organization holds, an externality for which the private opportunity cost of capital is not obviously the right deflator. Second, the harvest-now dynamic means that some of the harm is not actually deferred at all; it is incurred now and merely realized later, so discounting it as if it were a future event understates it. Neither consideration dictates a specific number, but both suggest that the conventional high rate biases the comparison toward waiting in a way that does not reflect the structure of the harm.

It is useful to separate two kinds of discounting that the single-rate convention conflates. Financial discounting reflects the time value of money and the opportunity cost of capital, and a market-based rate is appropriate for the migration spending, which is a genuine cash outlay that could otherwise be invested. The confidentiality harm from an interception is a different object. Much of it falls on third parties whose data the organization holds, and once long-lived secrets are exposed, the loss cannot be reversed by any later spending. Irreversible harm to parties who did not choose the risk are the standard case for a near-zero rate in the public-policy literature on intergenerational and environmental discounting, and the same logic applies here. Applying the private cost of capital to such harm is not a neutral technical step; it embeds a judgment that a future privacy loss is worth substantially less than a present one, which is exactly the judgment a decision-maker should make explicitly rather than by default. A defensible practice discounts the migration cost at the financial rate and the confidentiality harm at a much lower, policy-driven rate and reports the recommendation under both a common-rate and a split-rate treatment.

4.3 Whether interception harm is modeled

The third assumption is binary and consequential: does the model include “harvest now, decrypt later” harm? If it does not, the benefit of migrating is entirely a future event, conditional on the arrival of a CRQC, and the expected-value and option-value families naturally favor deferral under any plausibly low near-term arrival probability. If it does, a portion of the benefit of migrating is the prevention of ongoing, present-tense data loss, and the comparison shifts decisively toward early action for long-lived data.

The threat is not hypothetical in the eyes of the agencies that govern the transition. NSM-10 states that “the threat to information protected by asymmetric cryptography exists now because an adversary can collect currently encrypted data and break it when sufficient quantum computation becomes available” (Biden, 2022). The joint CISA–NSA–NIST advisory frames early planning as a direct response to catch-now, break-later operations (Cybersecurity and Infrastructure Security AgencyNational Security Agency& National Institute of Standards and Technology, 2023). The ONCD report calls diligent early migration “the best long-term solution to defend against a record-now, decrypt-later type attack” (ONCD, 2024).

Modeling interception harm changes the option-value calculus in a specific way. In the standard real-options model, waiting preserves the payoff and, therefore, has positive value. Once interception is admitted, waiting leaks the payoff for any data captured during the wait, so the option value of waiting becomes negative for the exposed, long-lived fraction of data. A model that omits interception does more than leave out a term; on our reading, it favors the wrong action for exactly the data that matters most, the data with long confidentiality requirements. We label this a reading rather than a demonstration because it rests on a premise we adopt rather than prove that interception is a live, present threat, as the agencies governing the transition treat it (Biden, 2022; Cybersecurity and Infrastructure Security Agency, National Security Agency, and National Institute of Standards and Technology, 2023; ONCD, 2024). A reader who regards harvest-now collection as speculative would not grant the premise and need not reach the conclusion. On that premise, the deferral-friendly conclusions in the literature tend to come from framings that, explicitly or by omission, treat the benefit of migration as purely a future event.

4.4 Cost, organizational, implementation, and regulatory factors

Beyond the three principal assumptions, four further factors bear directly on the timing decision, and addressing each in its own right, rather than folding them into a single remark, rounds out the comparison: the magnitude and trajectory of migration cost, the organizational level at which the decision is properly made, the implementation difficulty of migration, and the regulatory context. Data shelf-life is the remaining parameter that shifts the conclusion. In the Mosca inequality, it enters symmetrically with the arrival time, so a change in the required confidentiality horizon moves the feasibility test by as much as an equal change in the arrival estimate. Its effect on the divergence between analyses is smaller only because an organization usually knows how long its data must remain confidential, while the arrival time is contested and revised yearly. Because shelf-life operates through the same channel as arrival, we treated it alongside that assumption above.

The magnitude and trajectory of migration cost set the size of the bounded downside that acting early commits to. The one firm anchor is the ONCD projection of roughly $7.1 billion in 2024 dollars to migrate prioritized U.S. federal civilian systems between 2025 and 2035, which its authors describe as a rough order of magnitude (ONCD, 2024). Two features of that number matter for timing. Its magnitude is large in absolute terms but is spread over a decade and confined to prioritized systems, so the annualized commitment is smaller than the headline suggests; and its trajectory is not fixed, because tooling, vendor support, and crypto-agility are expected to lower unit costs over time, which is the one respect in which waiting captures a genuine saving. A rushed, compressed migration runs that trajectory in reverse, since the practitioner literature warns that an emergency transition is both more expensive and more error-prone and can introduce new vulnerabilities of its own (Campagna et al., 2021; Mosca and Piani, 2024). Hybrid deployment cuts the cost of acting early by allowing incremental adoption without abandoning interoperability (ENISA, 2021; National Security Agency, 2024). The cost side, therefore, does not point unambiguously toward waiting; it rewards waiting only where unit costs are genuinely falling faster than exposure is accruing.

Migration decisions belong to the individual system owner. They are made system-by-system, by the owners of particular data flows, applications, and infrastructure, whose shelf-life requirements, exposure, and migration difficulty differ widely within a single organization. Treating the organization as one decision-maker with a single shelf-life and a single risk appetite averages away exactly the heterogeneity that determines timing, and it is that heterogeneity that the prioritization models exploit when they sequence the most exposed, longest-lived systems first (Cybersecurity and Infrastructure Security Agency, National Security Agency, and National Institute of Standards and Technology, 2023; NCSC, 2025). An aggregate recommendation to migrate now or later is, therefore, the wrong object; the decision belongs to the system owner, and the organization’s role is to supply the inventory, the criteria, and the sequencing within which each owner acts.

For most organizations, the binding constraint on early migration is not the cost–benefit comparison but cryptographic discovery. Acting on any of the analysis above presumes a cryptographic inventory that maps each protected data flow to the algorithm securing it and to how long those data must remain confidential, and most organizations do not have one. Building and maintaining that inventory, across embedded systems, third-party and legacy software, and long-lived stored data whose original owners may have moved on, is frequently what stalls migration in practice, well before any comparison of discounted costs is reached. The national guidance treats inventory as the first phase of migration for exactly this reason (Cybersecurity and Infrastructure Security AgencyNational Security Agency& National Institute of Standards and Technology, 2023; NCSC, 2025). Because discovery comes first, before any cost–benefit calculation, a timing analysis that assumes that the inventory already exists understates both the cost and the lead time of acting early, and the discovery phase belongs on the cost-side of any honest comparison.

For regulated entities, the jurisdictional deadline has already truncated the decision. Once a binding schedule is in force, such as NIST’s disallowance of quantum-vulnerable public-key algorithms after 2035, the NSA’s milestones for national security systems, or the United Kingdom’s 2035 completion target, the live question is no longer whether to migrate but how to sequence the work to finish on time (Moody et al., 2024; NCSC, 2025; National Security Agency, 2024). The deadline converts an open-ended timing choice into a scheduling problem and shifts the cost of starting late from the cost of a breach to the cost of a compressed, error-prone transition. The truncation is not universal, since organizations outside the scope of any mandate retain the full decision and jurisdictions differ in both their deadlines and their coverage; but where a mandate applies, it dominates the other factors by removing the deferral option outright for the systems it covers.

4.5 An illustrative worked example

To make the comparison concrete, Table 3 computes a stylized net value of early migration for a single case of long-lived, interception-exposed data across the three principal choices. Costs are expressed as multiples of the one-time migration cost; the discount rates bracket the U.S. federal benefit–cost rate, which has changed from 7% (1992) to approximately 2% (2023 revision) and back to 7% (reinstated 2025) across successive versions of OMB Circular A-94 (Office of Management and Budget, 2023; Office of Management and Budget, 2025); and the near-term arrival probabilities are the low and high ends of the most recent 10-year expert elicitations (approximately 0.19 and 0.49; Mosca and Piani, 2024; Mosca and Piani, 2025). The breach–loss ratio is the one quantity without a clean external anchor and is set conservatively at five times the migration cost. The magnitudes are, therefore, illustrative rather than empirical, but the inputs are drawn from the sources this article already cites, and the sign pattern is the argument. When interception (HNDL) harm is modeled, early migration is preferred in every combination, because deferral leaks value on data captured during the wait. When it is omitted, deferral becomes preferable only in the single corner that combines the high discount rate with the low arrival probability, and even there, the advantage is negligible (a net of −0.01 C) and reverses once the loss exceeds approximately five times the migration cost, any interception exposure is present, or the data outlive the 10-year window.

TABLE 3. Illustrative net value of early migration under the three principal assumptions.

HNDL, harvest now, decrypt later; PV, present value. Costs are multiples of the one-time migration cost C (C = 1). Migrating now costs C and avoids the breach; deferring gains a deferral saving of 1 − (1 + r)^−t on the postponed outlay but risks an expected breach loss of p × [PV of L]. Parameters are anchored to the cited data: the discount rates r = 0.02 and 0.07 span the benefit–cost rate that successive versions of OMB Circular A-94 have prescribed: 2.0% in the 2023 revision and 7% in the 1992 edition, which OMB Memorandum M-25-23 reinstated in 2025 (Office of Management and Budget, 2023; Office of Management and Budget, 2025); the arrival probabilities p = 0.19 and 0.49 are the low- and high-ends of the 10-year CRQC, estimates in the most recent elicitations (Mosca and Piani, 2024; Mosca and Piani, 2025). The breach-loss ratio L = 5 C and horizon t = 10 years are stylized. When HNDL harm is modeled, the loss is locked in at interception and enters undiscounted (PV = L); when omitted, it is discounted (PV = L(1 + r)^−t). Net value = expected loss avoided − deferral saving; a positive value favors migrating now, and components are rounded to two decimals so the net is their difference. Holding the horizon at 10 years and the migration cost equal across paths is conservative: the same experts put the 15-year arrival probability at 0.51–0.70, and a compressed post-breach migration costs more. The single deferral cell is knife-edge (−0.01 C) and turns positive once the loss exceeds approximately five times the migration cost, any interception exposure is present, or the data outlives 10 years. Magnitudes are illustrative; the sign pattern, not the values, carries the argument.

5 An illustrative decision schematic

The comparative analysis can be made concrete with two schematic illustrations. Both are stylized. Neither is fitted to data, and neither should be read as a prediction; they exist to expose the logic that the models above share, not to generate estimates. We present them in that spirit and label them accordingly.

The first illustration concerns the threat-arrival assumption itself, which is the input that the comparative analysis identified as the most consequential. Figure 1 contrasts three stylized representations of the cumulative probability that a CRQC will arrive by a given year: an optimistic-arrival curve that rises early, a central curve, and a pessimistic curve that rises late. The curves are schematic, not fitted to data, and are drawn to make a single point. The spread between the optimistic and pessimistic curves is wide enough that any timing recommendation derived from one of them alone is fragile, and the policy deadlines, marked on the figure, fall within the band where the three curves disagree the most. A model that selects the central curve and proceeds as if it were known is making a hidden assumption that the figure renders visible. The figure is the visual counterpart of the argument that the arrival should be treated as a range to be survived rather than a distribution to be averaged, and it shows why two analysts working from the same expert survey can reach opposite recommendations simply by reading the band differently. An optimist who anchors on the early-rising curve sees a near-term threat and migrates; a pessimist who anchors on the late-rising curve sees ample slack and waits. Neither is contradicting the evidence; each is supplying an arrival assumption that the evidence does not settle.

The construction of Figure 1 is fully specified so that a reader can reproduce or replace it. Each of the three curves is a logistic cumulative distribution function, F t = 1 1 + exp ‐ k t ‐ t 0, where t is the calendar year, t 0 is the year at which the cumulative arrival probability reaches 0.5, and k governs how steeply the curve rises. The logistic form is chosen only because it is the simplest monotonic S-shaped function with an interpretable midpoint and slope; no claim is made that the arrival of a CRQC follows a logistic law. The three midpoints are anchored to the published expert elicitations rather than chosen for visual effect. The optimistic curve uses t 0 = 2034 because the optimistic-end 10-year arrival probability in the 2025 elicitation approaches one-half by the mid-2030s (Mosca and Piani, 2025). The pessimistic curve uses t 0 = 2050 because the pessimistic-end 10-year probability in the 2024 elicitation is only approximately 19% by the mid-2030s (Mosca and Piani, 2024), which places its 50% crossing roughly 15 years later. The central curve uses t 0 = 2042, the midpoint of the optimistic and pessimistic crossings, representing a neutral reading of the same surveys. The slope parameters (k between approximately 0.28 and 0.45) are set so that each curve moves from approximately 10% to approximately 90% arrival over approximately a decade, which encodes how quickly capability is assumed to mature once it begins to appear; these slopes are illustrative and are the one element of the figure not pinned to a reported number. The point of the figure does not depend on the precise parameter values: any reasonable choice that places the optimistic crossing near the policy deadlines and the pessimistic crossing well beyond them produces the same wide band and the same conclusion that a single-curve recommendation is fragile. The choice to hold the slopes fixed rather than derive them is deliberate because the sharpest movements in expert probability have come from the resource threshold rather than from smooth hardware growth. The benchmark qubit count for factoring RSA-2048 decreased more than 20-fold in 4 years, from 20 million noisy qubits to fewer than one million, through algorithmic and error-correction advances alone (Gidney and Ekerå, 2021; Gidney, 2025). A drop of that size shifts the entire arrival band leftward at once because the capability the hardware must reach has itself moved. Rather than encode this as a steeper slope, which would imply a false precision about the pace of error-correction progress, we hold the slope fixed and treat the threshold as the uncertain quantity, which is the same reasoning that leads us to read the year-over-year movement in the elicitations as signal rather than noise.

The second illustration is a stylized decision tree for a single organization choosing between migrating early and deferring. Its branch probabilities and payoffs are not empirical estimates; the tree exists to show how the three contestable assumptions enter a single structure. Figure 2 shows the layout. The decision node offers two actions: migrate now or defer. Each action is followed by a chance node representing whether a CRQC arrives within the data’s confidentiality horizon. The four resulting outcomes capture the logic compactly. If the organization migrates now and a CRQC arrives within the horizon, it has paid the migration cost and avoided the breach; the outcome is the migration cost alone. If it migrates now and no CRQC arrives within the horizon, it has paid the migration cost for protection that this threat did not end up requiring, though it has also satisfied the deadline and gained crypto-agility; the outcome is again approximately the migration cost. The two deferral branches are where interception enters. If the organization defers and a CRQC arrives within the horizon, it bears the breach loss on any long-lived data already intercepted, in addition to the cost of a now-compressed migration; this is the worst outcome. If it defers and no CRQC arrives within the horizon, it has saved the time value of the deferred migration cost and lost nothing, which is the best outcome for the deferring party.

The structure of Figure 2 was chosen deliberately as the smallest tree that still exposes all three contestable assumptions, and its design follows standard decision-analysis convention so that it can be read without a key beyond the legend provided. Three design decisions define it. First, the threat is represented as a single binary chance event, either a CRQC arrives within the data’s confidentiality horizon or it does not, rather than as a distribution over arrival years. The binary form is the minimal representation that still lets the arrival assumption enter as the branch probability; a finer partition would add branches without changing the qualitative ordering of outcomes, and the figure’s purpose is to show structure, not to compute an expected value. Second, the same chance event is placed under both actions, so the only difference between the ‘migrate’ and ‘defer’ sub-trees is the payoff attached to each leaf, which isolates the effect of the action from the effect of the threat. Third, the four leaf payoffs are written as qualitative cost expressions rather than numbers because assigning numbers would imply an empirical calibration that the analysis explicitly disclaims; the ordering among them, not their magnitudes, carries the argument.

That ordering is the one substantive content of the tree, and it is determined by the logic established earlier rather than assumed: both migrate leaves cost approximately the migration cost because migrating protects against the threat whether or not it materializes; the defer-and-no-arrival leaf is the best because it saves the time value of a cost not yet incurred; and the defer-and-arrival leaf is the worst because it combines a breach loss on already-intercepted data with a now-compressed migration. Shapes follow the convention stated in the legend, with a square decision node, rounded chance nodes, and rectangular outcome leaves, so that the node type is distinguishable in grayscale without reliance on color. The tree is illustrative in its probabilities and payoff magnitudes but not arbitrary in its structure, which is dictated by the requirement to display the three assumptions in one diagram.

The structure shows why the recommendation hinges on the three assumptions identified above. The probabilities attached to the chance nodes are the arrival assumption. The weight placed on the deferral-with-arrival branch relative to the others depends on the discount rate because that branch’s loss is realized later. In addition, the very existence of a loss on the deferral-with-arrival branch depends on whether interception harm is modeled; if it is removed, the deferral’s downside collapses to a compressed-migration cost, which is exactly the framing that makes waiting look appealing. The tree also makes plain an asymmetry that expected-value averaging tends to obscure. Migrating early has a bounded, known downside, the migration cost, while deferring has an unbounded, uncertain downside for long-lived data, because the breach loss on intercepted secrets is not capped by the migration budget. Under an expected-value criterion, the choice between the two depends entirely on the probabilities assigned to the chance nodes, so it inherits all of the instability of the arrival assumption. Under a minimax criterion, the comparison is different: the decision-maker looks only at the worst outcome of each action and selects the action whose worst case is least bad, which is early migration, because its worst case is the migration cost, while deferral’s worst case is the migration cost in addition to the breach loss. Under minimax regret, the same ordering holds for long-lived data because the regret of having deferred when the threat arrives is large, while the regret of having migrated when the threat does not arrive is only the time value of the migration cost. This is the formal sense in which a robustness criterion favors early migration almost regardless of the probabilities (Savage, 1951; Wald, 1950), and it is the clearest illustration of a theme that runs through the whole comparison: the choice of decision criterion, as much as the choice of numerical inputs, drives the conclusion. Two boundaries should be kept distinct here. That a robustness criterion produces this ordering, early migration ahead of deferral for long-lived data, is a result that the decision-theoretic literature establishes (Savage, 1951; Wald, 1950). That a decision-maker should adopt a robustness criterion rather than expected-value optimization is not settled by that literature; it is a value judgment we argue for, on the ground that the elicited arrival probability is too unstable to optimize against, and a reader who trusts those probabilities may reasonably prefer to weight them instead. An analyst who never states which criterion is in use has nonetheless chosen one, and the choice is usually expected-value optimization by default, which is the criterion least suited to an uncertainty that resists stable quantification.

6 Guidance for decision-makers under deep uncertainty

The synthesis supports several pieces of guidance, each grounded in the comparative analysis above. We state them as recommendations rather than as findings because they follow from the comparative analysis together with the value judgments we argue for, chiefly that arrival is a deep uncertainty to be survived rather than a probability to be optimized against and that interception is a live, present harm. A reader who declines those judgments will read what follows as one defensible stance among others, and we mark in the limitations where a different stance leads.

First, the timing decision should be treated as one under deep uncertainty, not under measurable risk. The arrival of a CRQC satisfies Knight’s (1921) definition of uncertainty rather than risk: the expert probabilities exist, but they are unstable subjective aggregates, not frequencies, and they have moved by tens of percentage points in a single year (Mosca and Piani, 2025). A decision procedure that is highly sensitive to those numbers will be highly sensitive to next year’s revision. Robustness criteria, which seek strategies that perform acceptably across the full range of plausible arrival dates, are better matched to this epistemic situation than expected-value optimization (Lempert et al., 2003; Lempert, 2019).

Second, the portfolio should be segmented by shelf life and exposure before deciding. The aggregate “migrate now or later” question is the wrong unit of analysis. The decision belongs to the individual system, by which we mean a specific data flow, application, or data store together with the owner who is responsible for it. What matters for its timing is how long that system’s data must stay confidential and whether the data are exposed to interception. The prioritization framing common to the national guidance converts the timing debate into a sequencing program in which the most exposed, longest-lived assets move first regardless of how the aggregate debate resolves (Cybersecurity and Infrastructure Security Agency, National Security Agency, and National Institute of Standards and Technology, 2023; NCSC, 2025). For an organization holding decades-long secrets that traverse public networks, the Mosca inequality is likely already violated, and migration of those assets cannot wait (Mosca, 2018).

The practical obstacle to this segmentation is discovery. Segmenting by shelf-life and exposure presumes an accurate cryptographic inventory that maps each protected data flow to the algorithm securing it and to how long those data must remain confidential, and most organizations do not have one. Building and maintaining that inventory, across embedded systems, third-party software, and long-lived stored data whose owners may have moved on, is frequently the binding constraint on early migration and the reason it stalls in practice well before any cost–benefit calculation is reached. The national guidance treats inventory as the first phase of migration for this reason (Cybersecurity and Infrastructure Security Agency, National Security Agency, and National Institute of Standards and Technology, 2023; NCSC, 2025). A timing analysis that assumes that the inventory already exists will understate the true cost and lead time of acting early, so the discovery phase belongs to the cost side of any honest comparison.

Third, when an expected-value model is used, the discount rate and the arrival distribution should be stated as the value judgments they are, and the recommendation’s sensitivity to both should be reported. A conclusion that depends on a 7% rather than a 2% discount rate, or on a 28% rather than a 49% 10-year arrival probability, is a conclusion about the analyst’s assumptions, not about the quantum threat. Honest practice reports the range of recommendations across defensible inputs rather than a single number derived from a single undefended choice (Office of Management and Budget, 2023; Office of Management and Budget, 2025).

Fourth, interception harm should be accounted for explicitly, or it should be stated clearly that the model omits it. The single largest source of unwarranted deferral recommendations is the silent omission of harvest-now harm, which converts the benefit of migration into a purely future event and makes any low near-term arrival probability sufficient to justify waiting. Because the agencies governing the transition treat interception as an active present threat (Biden, 2022; Cybersecurity and Infrastructure Security Agency, National Security Agency, and National Institute of Standards and Technology, 2023; ONCD, 2024), a model that omits it is not conservative; it tends to favor inaction for the data that matter most.

Fifth, crypto-agility and hybrid deployment should be used to lower the cost of acting early. Much of the apparent force of the deferral case rests on the size and irreversibility of the migration cost. Hybrid deployment reduces that cost by allowing incremental adoption while preserving interoperability, and crypto-agility, the capacity to change algorithms without re-architecting, reduces the cost of any future transition as well (ENISA, 2021; National Security Agency, 2024). Investments that lower the migration cost weaken the strongest argument for waiting and are robust across every assumption set because they pay off whether the threat arrives early or late.

Sixth, it should be recognized that for regulated entities, the deadline has already resolved the binary question. NIST’s disallowance of quantum-vulnerable public-key algorithms after 2035, the NSA’s 2030-to-2033 milestones for national security systems, and the United Kingdom’s 2035 completion target convert “whether to migrate” into “how to finish on time” (Moody et al., 2024; NCSC, 2025; National Security Agency, 2024). For these organizations, the live decision is the sequencing program, and the cost of starting late is the cost of a compressed, error-prone transition rather than the cost of a breach alone.

6.1 Where the case for early migration weakens

Even-handedness requires stating the conditions under which deferral is defensible. The case for early migration weakens, and can reverse, when several conditions hold together. If an organization’s sensitive data have a short confidentiality horizon, so that they will lose their value before any plausible arrival of a CRQC, then X is small and the Mosca inequality is comfortably satisfied without early action. If those data never leave controlled environments and are not exposed to interception, the harvest-now harm is absent, and the option value of waiting is genuinely positive. If the organization faces no binding regulatory deadline, the deadline truncation does not apply. In addition, if the migration cost is large and falling because tooling and vendor support are improving rapidly, then waiting captures a real cost reduction. An organization for which all of these factors hold, namely, short-lived, well-contained data, no deadline, and rapidly falling migration costs, can rationally defer the bulk of its migration, while still maintaining the crypto-agility to act quickly if the threat horizon shortens. The error in the broad deferral case is not that deferral is never optimal; rather, it is that the conditions for optimal deferral are narrow and are frequently assumed rather than verified.

7 Limitations

This is a conceptual synthesis, and its limitations follow from that choice. We did not build or run a model, so we offer no new estimates of optimal timing for any specific organization; the illustrative tree and arrival curves are deliberately schematic and must not be read as results. Our characterization of each model family reflects the published structure of representative exemplars; particular implementations may differ, and a fully formal PQC-specific timing model, with peer review, would sharpen several of our qualitative claims into quantitative ones. The cost figures we rely on are official rough orders of magnitude that cover U.S. federal civilian systems, so they may not transfer to other sectors or jurisdictions (ONCD, 2024). The arrival probabilities we cite are expert elicitations whose instability is itself part of our argument; readers who regard those elicitations as well-calibrated frequencies would weigh the expected-value family more heavily than we do. Finally, our treatment of the discount rate surveys the U.S. federal guidance; other jurisdictions prescribe different rates, and the social-versus-private rate debate is broader than we could engage in here. A further limitation is one of stance rather than of method. Our recommendations lean toward early migration, and although we have tried to mark where that lean reflects a value judgment rather than the evidence, a reader who adopts an expected-value criterion, a low near-term arrival probability, and a market discount rate can reach a markedly more deferral-friendly conclusion from the same literature we review. We regard that combination of assumptions as narrow and have argued against it, but it is internally coherent, and readers who hold it should treat our early-migration guidance as the conclusion of a stance rather than as a settled result. None of these limitations affects the central claim, which is about the structure of the disagreement rather than its numerical resolution.

8 A research and practice agenda

Several gaps follow directly from the synthesis. On the research side, the field lacks a peer-reviewed, PQC-specific timing model that admits interception harm as an accruing cost rather than a conditional future event; building one and releasing it as an open-source tool that lets an organization enter its own shelf-life distribution, cost structure, and risk appetite would turn the qualitative claims here into a calculation that each user could run and would operationalize the argument in a way the static tree and tables cannot. The decision tree and arrival curves in this article are designed to be that tool’s conceptual skeleton, and specifying them explicitly, as we have, is the first step toward implementing them. The treatment of the arrival of a CRQC as deep uncertainty, rather than as a stable distribution, invites application of robust decision methods to the migration problem, an application that has not, to our knowledge, been published. The interaction between organization-level timing decisions and the system-wide coordination problem, in which the value of one organization’s migration depends on the quantum-readiness of its counterparties and supply chain, is largely unmodeled and is a natural target for a game-theoretic treatment (Campagna et al., 2021). A protected channel is only as strong as its weaker endpoint, so an organization that migrates while its counterparties do not captures little of the benefit, which creates an incentive to wait for others and a coordination failure in which each party’s rational deferral leaves the whole network exposed. Even a stylized game, with two or more players choosing when to migrate and payoffs that reward joint readiness, would make this interdependence explicit and would show whether deadlines and standards function as the coordinating device that breaks the impasse. We flag this as the most promising formal extension of the present synthesis. On the practice side, the agenda is clearer: a cryptographic inventory keyed to data shelf-life and exposure should be maintained, crypto-agility and hybrid deployment should be adopted to lower the cost of acting, migration should be sequenced so that long-lived and interception-exposed assets move first, and the discount rate and arrival assumptions behind any timing recommendation should be documented so that the decision can be revisited as the assumptions change.

9 Conclusion

The published treatments of post-quantum migration timing appear to disagree more than they do. Their divergent recommendations are the products of three contestable modeling choices: how the arrival of a cryptographically relevant quantum computer is represented, what discount rate is applied to a future harm, and whether harvest-now, decrypt-later interception is admitted into the objective at all. When those choices are held fixed, the families largely agree. Early migration is the robust choice whenever data confidentiality requirements extend past the plausible arrival horizon, whenever interception harm is modeled, and whenever a robustness criterion replaces expected-value optimization. The case for deferral is real but narrow, requiring short-lived and well-contained data, no binding deadline, and rapidly falling migration costs to hold simultaneously. The arrival of a CRQC is a Knightian uncertainty, not a measurable risk, and the decision is better made by criteria that survive the full range of plausible futures than by optimizing against a probability that has proven unstable. The most useful thing an analyst can do is not to predict the threat more precisely but to state the discount rate and the arrival assumption openly, as the value judgments they are, and to report how the recommendation moves when they change.

Generative AI statement

The author(s) declared that generative AI was used in the creation of this manuscript. ChatUiT, an internal university proofreading tool, was used for styling and editing of text. The author has reviewed all the suggested improvements in styling and applied them, taking full responsibility for their content.

Any alternative text (alt text) provided alongside figures in this article has been generated by Frontiers with the support of artificial intelligence and reasonable efforts have been made to ensure accuracy, including review by the authors wherever possible. If you identify any issues, please contact us.

Publisher’s note

All claims expressed in this article are solely those of the authors and do not necessarily represent those of their affiliated organizations, or those of the publisher, the editors and the reviewers. Any product that may be evaluated in this article, or claim that may be made by its manufacturer, is not guaranteed or endorsed by the publisher.

Footnotes

Edited by: Laszlo Gyongyosi, Budapest University of Technology and Economics, Hungary

Reviewed by: Geeta Sandeep Nadella, University of the Cumberlands, United States

Sheetal Temara, University of the Cumberlands, United States

Sebastian De Haro, University of Amsterdam, Netherlands