Eight Myths And Mistakes In Post-Quantum Readiness Programmes

Post-quantum migration is new for almost everyone, so it attracts assumptions that sound reasonable but do not hold up. Some lead organisations to wait too long. Others lead them to spend effort in the wrong places.

This article collects eight of the most common, sets each against what official guidance says as of October 2026, and links to the article in this section that covers the topic in depth. It works as a summary of the whole section.

The Myths At A Glance

Myths About Timing

“We can wait until a quantum computer exists.” This ignores two facts. Encrypted data can be stored today and decrypted later, which NIST’s NCCoE calls a store now, decrypt later attack.¹ And migration itself takes years: the NCCoE expects the move to post-quantum cryptography to be harder than past algorithm changes.¹ Mosca’s rule of thumb puts the two together. If the years your data must stay secret plus the years your migration takes exceed the years until a capable quantum computer exists, you are already exposed.² See why migration starts early.

“High priority means high risk.” Priority is about when work must start. Europol’s financial services report rates offline card authentication at the point of sale as medium quantum risk, yet high migration priority, because terminal replacement cycles and the number of parties involved make the change slow.³ See prioritising what to migrate first.

Myths About The Inventory

“The inventory is a one-off project.” OMB’s memorandum M-26-15 describes the foundation of a migration plan as a dynamic, continuously updated inventory of all cryptographic assets, maintained with automated tools.⁴ An inventory that is not refreshed quickly drifts away from reality.

“We need a complete inventory before doing anything.” The opposite error is waiting for perfection. The UK National Cyber Security Centre says its first discovery stage is not meant to be a formal asset register, and that understanding the nature of each system matters more at that point than listing every item.⁵ Europol identifies actions that can start immediately, such as enabling hybrid key exchange on public websites and removing cryptographic antipatterns.³ See what a cryptographic inventory should tell you.

Myths About Ownership

“This is a job for IT and security.” OMB states that migration is not only the responsibility of the chief information officer and chief information security officer, and that every member of the leadership team carries accountability. Its sample roles include the chief financial officer and programme owners.⁴ See running PQC readiness as a programme.

“Our vendors will handle it.” For commodity platforms, the NCSC agrees that suppliers will deliver much of the change through routine updates.⁵ Beyond that, the CISA, NSA and NIST factsheet treats supply chain assessment and vendor engagement as core steps, and Europol’s framework scores external dependencies as one of the three drivers of migration time.⁶³ In practice, someone still has to ask each supplier for a dated roadmap, track progress against it and write post-quantum requirements into contracts and renewals.

Myths About The Technology

“We just swap the algorithm.” The NCCoE explains that an algorithm cannot be replaced until all components of a system can process the new one, and that protocols and infrastructure often have to change as well. It adds that the new algorithms are not always drop-in replacements, citing larger signatures and keys among the reasons.¹ OMB makes the related point that crypto-agility needs more than avoiding hard-coded algorithm names, and tells agencies to identify systems that cannot support post-quantum or hybrid cryptography as priorities for replacement or retirement.⁴ See designing for crypto-agility.

“Hybrid is the answer,” or “hybrid is pointless.” Hybrid cryptography combines a classical and a post-quantum algorithm so that an attacker must break both. OMB treats it as a useful but costly interim measure that agencies should evaluate carefully.⁴ The joint statement from France, Germany, the Netherlands and other EU member states says deploying hybrid solutions is becoming urgent.⁷ Neither position supports a blanket rule. See no-regret first moves.