Every secret you send today is already stolen — and waiting to be unlocked in the future

What sets PQC apart from other security stories is that it has a "deadline" that many parties have drawn at the same spot. The weapon that will shatter the old keys is called Shor's algorithm — a formula known since 1994 to mean that if you have a large enough quantum computer, it can factor big numbers in a flash, which means cracking RSA/ECC.

So the question isn't "will it happen" but "when." Most experts put "Q-Day" — the day a quantum machine actually breaks the code — around 2030–2035. The machine you'd need is still in the millions of qubits, and today's best machines top out in the thousands, and "noisy" ones at that (lots of errors). But in 2025, Google researchers cut the resource estimate down to "under 100,000 real qubits" — which rattled the field, because it means the deadline may be closer than we thought.

The reason the clock starts now, not in 2030, comes from an idea called "Mosca's inequality" (X + Y > Z) — if the time you need to migrate (X) plus the number of years your data must stay secret (Y) is greater than the years until a quantum machine arrives (Z), you're already too late. Medical records, state secrets, or contracts that must stay secret 20–30 years all qualify today.

And this is a major economic story, not just a technical one. The White House estimates that migrating U.S. federal agencies alone will cost roughly $7.1 billion through 2035 — and that doesn't even count the banks, telecoms, hospitals, and equipment makers worldwide that have to switch along with it.

At the heart of all the urgency is a mechanism called "Harvest Now, Decrypt Later" (HNDL). It's the reason a threat from a machine that "hasn't arrived yet" is a threat today.

Picture it this way: you send a letter locked up tight. An enemy intercepts it but can't open it — so what does he do? He doesn't throw it away. He stockpiles it in a warehouse, millions of letters, waiting for the day he gets a tool that can pick this kind of lock — then comes back and reads the whole pile at once. Data you thought was "safe because it's encrypted" is really only "safe for now."

The fix has two layers. The first is new algorithms — and this is the milestone that changed everything. In August 2024, NIST (the U.S. standards body) officially announced the world's first PQC standards, after an 8-year selection process: FIPS 203 (ML-KEM, formerly Kyber) for key exchange, FIPS 204 (ML-DSA, formerly Dilithium) for digital signatures, and FIPS 205 (SLH-DSA) as a backup. What's striking: 2 of the 3 were developed by a research team at IBM.

PQC sits at the deepest layer of Cybersecurity — it's not a product you see, but the "trust foundation" the other segments sit on. And it's deeply entangled with other trends:

• Born directly out of Quantum Computing: the irony is that PQC's whole threat and market are driven by a machine that isn't built yet. The further quantum advances (see that lesson too), the more urgent PQC gets — one of the few cases where one technology's progress instantly "sells products" for another
• Underpins Identity & Access: the certificates and digital signatures that prove "you are you" all use RSA/ECC — if quantum can forge a signature, the whole identity system collapses. So PQC has to swap this layer's keys first
• Protects Data Security & Resilience: this is HNDL's direct target — data that must stay secret for a long time is exactly what gets harvested for later decryption
• The root of trustworthy AI: once AI agents start transacting and communicating on our behalf, their identity and channels have to be locked down quantum-style too — security-chip makers are already embedding PQC into AI-agent hardware

The most interesting angle: while the other parts of the quantum field "bet on the future" (they only make money once the machine works), PQC harvests from the present — it sells security that organizations have to buy today, because the law mandates it and because HNDL means they can't wait. Put another way, PQC is the "shovel seller" in the quantum gold rush.

After the NIST standards landed in August 2024, the world entered the "actually migrate" phase, and governments became the ones holding the stopwatch. The White House directive NSM-10 requires U.S. federal agencies to finish moving to PQC by 2035 (and to start retiring weak old algorithms from 2031). National-security systems under CNSA 2.0 are stricter — all new procurement from 2027 must be quantum-resistant. Europe and other countries are issuing similar timelines. It's these government deadlines that turned PQC from an "academic topic" into "real orders."

ภาพประกอบ (harvest.png)

The market reflects this urgency clearly. The global PQC market is still small — about $0.4–0.9 billion in 2025 — but it's expected to grow explosively. The research firms give different numbers (the market's just starting), but they agree on "very fast": MarketsandMarkets puts it at ~$2.84 billion in 2030 at ~46% CAGR, while Juniper Research sees it topping $13 billion in 2035 — and once you fold in the "migration market" (services to inventory and replace encryption systems), the numbers get even bigger.

The defining feature of this field — most of the winners are the existing giants in security and chips, not startups — because PQC isn't a standalone new product, but a "feature" that has to be embedded into existing key-storage hardware (HSM), security chips, and certificate-issuing systems (PKI). Whoever controls the installed base can sell the "quantum-resistant upgrade" right away — that's the advantage.

The first direction is a migration wave that lasts many years. The first thing every organization has to do is "inventory the keys" — make a ledger of which systems use which encryption (it's called a CBOM, a Cryptographic Bill of Materials). Sounds boring, but it's becoming a whole new industry, because most big organizations don't even know where their old keys are hidden. The real migration drags on for a decade.

ภาพประกอบ (migration.png)

The second direction is "double-locking" (hybrid). During the transition, most systems will use the old key and the new key at once — insurance in case the new algorithm turns out to have a flaw no one has spotted yet. It's a hedge while we're not yet 100% sure of the new stuff.

The third direction is baking PQC into hardware upstream from the start. Long-lived devices — cars, satellites, medical equipment, IoT devices — have to be quantum-resistant from the day they're built, because updating them later is hard or impossible. That's why chipmakers like NXP and SEALSQ are racing to embed PQC into silicon, and where PQC meets Semiconductors.

PQC is a trend that's "almost certain to happen" but full of uncertainty about timing — and investors have to keep those two things apart.

The first risk is deadline uncertainty. No one knows for sure whether Q-Day comes in 2030, 2035, or later. If practical quantum computers slip far out, the urgency (and the budget organizations are willing to pay) could slow with it — a market driven by "fear" is sensitive to news about how real that fear is.

The second risk is the cost and slowness of migration. History gives a clear warning — the last algorithm migration (SHA-1 → SHA-256) took over 5 years even though it was far easier. This one is many times bigger. NIST itself warned in mid-2025 that "the migration is running slower than planned." Budgets could overrun, and many organizations may miss the deadline. That slowness is both a risk (a real threat) and an opportunity (longer-lived service demand).

The third risk is an "early-stage bubble". Small pure-play PQC stocks tend to spike on quantum news even though their actual revenue is still small and volatile. The long-term value tends to land with the existing giants that embed PQC as a feature into a large installed customer base (key hardware, chips, certificates) — not the newcomers selling only a "story."

The fourth risk is uncertainty about the algorithms themselves. The new standards are still "young" — in the past, a PQC algorithm that made NIST's final round was even pulled after someone found a way to break it with an ordinary computer. That's why the world is choosing "double-locking," and why crypto-agility (the ability to swap algorithms fast) matters more than picking the "right" algorithm.

In short, Post-Quantum Cryptography is the story of racing a clock whose face we can't see — to swap out the keys locking up the world's secrets before the new unlocking tools arrive. What makes it special is that it's one of the few parts of the quantum field that can make money from a future that hasn't arrived, starting today — because just the "possibility" that secrets could be unlocked is enough to force the whole world to act.