Beyond Q-Day: Why the Real Quantum-Security Race is About Agility, Infrastructure, and Control (LIFTT)

Summary

• Total quantum investment jumped from about $2 billion in 2024 to $13 billion in 2025, heavily weighted toward computing hardware.p.9
• McKinsey sizes quantum communications at $11 to $15 billion by 2035, with post-quantum cryptography the largest slice, while Toshiba projects the QKD market alone at around $20 billion.p.9
• A March 2026 resource estimate showed Shor's algorithm could break P-256 using as few as 10,000 reconfigurable atomic qubits.p.4
• By October 2025, more than half of the human web traffic reaching Cloudflare used hybrid post-quantum key exchange, up from about a third in March.p.5
• CyberArk bought the machine-identity company Venafi for $1.54 billion, the largest exit the field has produced.p.10
• An independent assessment puts the chance that the main public-key algorithm is broken at 19-34% by 2035.p.6

Key insights

1. Google has suggested the threshold for breaking RSA-2048 could potentially be reached as early as 2029.p.3
2. Cloudflare moved its own post-quantum deadline forward to 2029 after the new resource estimate, and reframed the most urgent risk as authentication.p.4
3. Post-quantum migration so far covers only key exchange, not the digital signatures and certificates that prove identity.p.5
4. In June 2026 the White House set a deadline for civilian agencies to move toward post-quantum cryptography by 2030.p.5
5. HSBC treats quantum key distribution as one hedge inside a portfolio led by software-based standards.p.6
6. The algorithm was never the hard part: what separates institutions is whether they know where their own cryptography lives.p.8
7. Post-quantum cryptography is being absorbed by large cloud and platform providers as a feature, leaving little room for pure-play algorithm vendors.p.9
8. The durable market position is the layer that lets an organisation keep changing its cryptography: discovery, certificate and key lifecycle, and orchestration.p.10
9. The hardest part of migration is finding the old cryptography, and most institutions lack a complete inventory of where it lives.p.13