We follow the same practical path the industry has already converged on — not a hypothetical one.
Adversaries don't need a working quantum computer today to profit from one tomorrow. They can capture encrypted traffic and backups now, store them, and decrypt them once a large enough quantum computer exists — an approach security researchers call "harvest now, decrypt later." Any data that needs to stay confidential for years — health records, financial data, trade secrets, government communications — is exposed to this today, not someday.
ML-KEM (FIPS 203), ML-DSA (FIPS 204), and SLH-DSA (FIPS 205) became official, quantum-resistant replacements for RSA, ECDSA, and Diffie-Hellman.
Existing FIPS 140-2 certificates move to historical status, meaning federal buyers can no longer use them to justify new procurement.
The NSA's Commercial National Security Algorithm Suite 2.0 requires new national security systems to run quantum-resistant algorithms from this date, with full migration mandated by the early 2030s.
NIST's transition guidance deprecates RSA-2048 and comparable elliptic-curve algorithms by 2030, and removes them from federal standards entirely by 2035.
This isn't a future roadmap borrowed from a whitepaper. Hybrid post-quantum key exchange — classical and quantum-resistant algorithms running together — is already protecting production traffic at internet scale.
Of human-initiated web traffic through Cloudflare was already using post-quantum key agreement as of late 2025.
Major platforms — Cloudflare, Google Chrome, and Apple iMessage — have shipped hybrid post-quantum protocols to production, not pilot, environments.
Realistic timeline analysts give for a full enterprise cryptographic migration — which is why starting with an inventory now matters more than which algorithm you pick first.
Estimates for how many qubits it takes to break RSA-2048 and elliptic-curve cryptography keep dropping. Work from 2024–2025 cut the figure from roughly 20 million qubits down to around 1 million; a newer proposal using a neutral-atom architecture paired with more efficient error-correcting codes pushes the estimate down again — into the 10,000-to-26,000 range for breaking P-256 and RSA-2048, in days to months rather than years.
Current experimental hardware has already demonstrated over 6,000 coherent neutral atoms — not yet computation-ready, but no longer a distant target. In response, Google moved its own cryptographic migration deadline up to 2029, years earlier than the 2031–2035 window most of the industry had planned around, and is now treating migration of entire public key infrastructures — not just key exchange algorithms — as urgent.
The threat timeline isn't fixed. It moves whenever the underlying math does — which is exactly why zkAssess starts with an inventory today, not a migration scheduled for a decade out.
Further reading: Q-Day Moved Closer: PQC Migration Timelines Just Shifted Left — AQtive Guard, April 2026.
Security agencies and standards bodies are consistent on this: migration starts with a cryptographic inventory, not an algorithm purchase. We follow that order, and we solve the part most inventories get wrong — doing it without exposing your code.
zkAssess scans your code for quantum-vulnerable and classically weak cryptography the same way any cryptographic inventory tool would — except the analysis runs entirely inside your own boundary. No privacy problem, because your source code never leaves your machine or CI runner.
What zkAssess finds, plus your own constraints — legacy clients you can't break, compliance deadlines, risk tolerance — decides which path fits. Most organizations don't choose once; they choose per system.
Roll out the chosen algorithms across your systems — replacing the quantum-vulnerable primitives zkAssess flagged, one system at a time.
Validate the replacement against real traffic and workloads — not just a lab environment — and finalize the migration with a documented, auditable trail.
This is the same choice enterprises deploying Post-Quantum Cryptography today are actually making, not a simplified marketing binary.
| Consideration | Hybrid Post-Quantum Cryptography | Pure Post-Quantum Cryptography |
|---|---|---|
| How it works | Classical (e.g. ECDH) and post-quantum (ML-KEM) algorithms run side by side; a session is only broken if both fail. | Quantum-resistant algorithms replace classical ones outright — no classical fallback. |
| Best fit | Public-facing infrastructure and systems that must stay compatible with clients that don't support Post-Quantum Cryptography yet. | New systems, and regimes such as CNSA 2.0 that plan to require quantum-resistant-only algorithms. |
| Who's shipped it | Cloudflare, Google Chrome, and Apple iMessage already run hybrid key exchange in production. | Expected as the endpoint of most migration roadmaps once compatibility constraints are gone. |
| Trade-off | Larger handshake sizes and two algorithms to maintain, in exchange for a safer transition. | Simpler long-term footprint, but no fallback if a client or dependency can't yet support it. |
A traditional code scanner needs to read your source to find weak cryptography — which means a vendor, auditor, or automated tool now has full visibility into your codebase, business logic, and anything sensitive it contains.
zkAssess resolves this the same way modern privacy-preserving protocols resolve any "prove a fact without revealing the data" problem: the scan runs inside your own boundary, and only a signed, redacted attestation — the score, which patterns matched, cryptographic proof that each finding is real — ever leaves it. Your code is never the thing that crosses the line.
Every product on this path — zkAssess, Hybrid Post-Quantum Cryptography, Pure Post-Quantum Cryptography — is live today.