Post-Quantum Cryptography Readiness in 2026: Why Enterprise Security Teams Must Move From Awareness to Execution

EXECUTIVE SUMMARY

Post-quantum cryptography (PQC) has emerged as an enterprise modernization priority.

For several years, enterprise discussions focused on future risk: when quantum computers might mature, which algorithms would become standards, and how long organizations could afford to wait before planning a migration.

That period has largely passed. Standardization is underway, vendor roadmaps are accelerating, and organizations are beginning to treat cryptographic modernization as an enterprise program rather than a theoretical exercise. Recent guidance from NIST, together with product roadmaps from Microsoft, Google Cloud, Cisco, IBM, and other technology providers, signals that preparation is shifting from awareness to execution.

By 2026, the more important question is no longer whether organizations should prepare for quantum-safe security. It is whether they can modernize cryptographic infrastructure quickly enough without disrupting the systems that already underpin business operations.

CyberTech Intelligence views post-quantum cryptography as a trust-layer modernization program rather than a narrow encryption upgrade. Public-key cryptography underpins virtual private networks, cloud platforms, software-signing pipelines, digital certificates, identity systems, APIs, firewalls, routers, databases, payment systems, and secure communications. In many enterprises, it also remains embedded inside third-party platforms, legacy applications, and commercial software that have never been comprehensively inventoried. As a result, migration is rarely the first obstacle. Most organizations must first identify where cryptographic dependencies reside, assess their business criticality, and understand the operational risks of replacing them.

The business risk is already present. Cisco’s Quantum-Ready Migration Guide describes “Harvest Now, Decrypt Later” as a current threat pattern in which adversaries collect encrypted traffic today and store it until future quantum capabilities make decryption possible.¹ Google Cloud’s Cloud KMS documentation makes the same point: encrypted material protected by classical algorithms such as RSA and ECDSA may be vulnerable to future decryption if it is harvested now.²

The market is also moving. IBM announced in June 2026 that it plans to invest more than $10 billion in quantum computing over the next five years, spanning research and development, manufacturing, ecosystem expansion, capital expenditure, and mergers and acquisitions.³ IBM also stated that it operates more than 90 quantum systems globally and works with a client and partner network of more than 340 organizations.³

Cisco has published a detailed post-quantum roadmap for Secure Firewall, targeting ML-KEM support for Secure Firewall Threat Defense 10.5 and ASA 9.25 in late 2026, with broader ML-DSA and SLH-DSA support planned for FTD/ASA 11.0 in the second half of calendar year 2027.⁴ Google Cloud has introduced ML-Key Encapsulation Mechanisms in Cloud KMS preview, including generation, encapsulation, and decapsulation capabilities for post-quantum experimentation.⁵ Microsoft’s Digital Defense Report 2025 warns that a sufficiently powerful quantum computer could break widely used public-key algorithms, undermining digital communications and data security.⁶

The implication is clear. PQC readiness has moved from research planning to operational execution. The organizations that act now will have time to apply a structured readiness model: discover cryptographic dependencies, prioritize high-risk systems, modernize PKI and cloud key management, validate vendor roadmaps, and report progress through executive governance metrics. Those who wait may find themselves migrating under regulatory, customer, or incident-driven pressure.

CyberTech Intelligence Framework: Five Pillars of Enterprise PQC Readiness™ 

CyberTech Intelligence recommends that enterprise security leaders evaluate post-quantum cryptography readiness through five connected pillars: Discovery, Prioritization, Modernization, Vendor Readiness, and Governance. Together, these pillars help organizations move beyond awareness and build a practical operating model for quantum-safe security.

This framework helps security teams treat PQC as a staged modernization program rather than a one-time algorithm replacement. The most mature organizations will not begin with migration alone. They will begin by identifying cryptographic dependencies, ranking exposure, testing hybrid deployment models, validating vendor roadmaps, and reporting readiness through measurable governance indicators.

Five Pillars of Enterprise PQC Readiness™

Discovery
↓
Prioritization
↓
Modernization
↓
Vendor Readiness
↓
Governance

This sequence gives enterprise security leaders a practical path from visibility to execution, ensuring that PQC readiness becomes measurable, fundable, and operationally manageable. 

CyberTech Intelligence Research Desk Observation

Organizations that begin cryptographic discovery before regulatory or vendor pressure emerges are more likely to complete PQC migration with lower operational disruption, stronger vendor control, and better long-term crypto-agility. The enterprises most exposed to quantum-era risk are not always those with the weakest encryption today. They are often those with the least visibility into where encryption is embedded across infrastructure, applications, identities, cloud services, and third-party platforms.

1. WHY THE PQC CONVERSATION HAS CHANGED

For many security leaders, post-quantum cryptography used to sit in the “important, but not urgent” category. It was discussed at conferences, tracked by cryptographers, and occasionally raised in board-level risk sessions. But it rarely shaped annual infrastructure budgets.

That is changing for three reasons.

The same announcement points to IBM Quantum Starling in 2029, describing it as a large-scale, fault-tolerant quantum computer expected to execute 20,000 times more operations than today’s existing systems.³ IBM also states that Starling will lay the foundation for IBM Quantum Blue Jay, which is expected to run 1 billion quantum operations across 2,000 qubits.³

Second, enterprise vendors are no longer waiting. Cisco, Google Cloud, and Microsoft are turning PQC into product guidance, cloud features, migration playbooks, and infrastructure roadmaps. That matters because enterprises cannot complete PQC migration alone. They depend on cloud providers, firewall vendors, software platforms, identity systems, certificate authorities, hardware vendors, and managed service partners.

Third, the threat timeline is not the same as the hardware timeline. Attackers do not need a cryptographically relevant quantum computer today to create future damage. They only need encrypted data worth saving. If that data remains sensitive over an extended period, the exposure begins now. 

The uncomfortable truth is that quantum risk does not arrive all at once. It accumulates quietly.

2. FRESH MARKET SIGNALS FROM MAJOR TECHNOLOGY PROVIDERS

The strongest recent signal is not a single research breakthrough. It is the pattern of movement across major technology providers.

2.1 IBM: Quantum Investment Becomes a Strategic Commitment

IBM’s June 2026 quantum investment announcement marks a major commercial signal. The company committed a substantial multi-year investment to accelerate its quantum roadmap. The investment spans research and development, capital expenditure, manufacturing scaling, ecosystem partnerships, and mergers and acquisitions.

IBM also reported that it operates a broad global network of quantum systems and has a large client and partner ecosystem running real workloads today.

For cybersecurity leaders, this does not mean that RSA and ECC will break tomorrow. It does mean the quantum ecosystem is maturing fast enough that cryptographic migration can no longer be treated as a distant concern.

2.2 Cisco: PQC Moves Into Network Security Roadmaps

Cisco’s Preparing for Post-Quantum Cryptography: The Secure Firewall Roadmap turns PQC into a practical infrastructure question: what happens to VPNs, IPsec, TLS inspection, management access, secure boot, and firewall identity when post-quantum standards become the baseline?⁴

Cisco states that ML-KEM support arrives in Secure Firewall Threat Defense 10.5 and ASA 9.25, targeted for general availability in late 2026. ML-DSA support is planned for FTD/ASA 11.0 in the second half of calendar year 2027, and SLH-DSA support is also planned for FTD/ASA 11.0.⁴

That roadmap gives security teams something concrete to plan around. Upgrade windows, firewall refresh cycles, VPN modernization, and hardware trust decisions now have a post-quantum dimension.

Cisco’s Quantum Safe Communications Roadmap, last updated June 11, 2026, also identifies planned quantum-safe communications and product coverage across enterprise routing, switching, wireless, data center networking, service provider platforms, firewalls, VPNs, Meraki, Catalyst Center, Splunk, ThousandEyes, and Duo.⁷

The signal is hard to miss: PQC is becoming part of the network stack.

2.3 Google Cloud: PQC Enters Cloud Key Management

Google Cloud has introduced ML-Key Encapsulation Mechanisms in Cloud KMS preview, including key generation, encapsulation, and decapsulation. Google describes this as a foundational tool for quantum-resistant encryption experimentation.⁵

The company’s Cloud KMS documentation also explains why the shift matters. Quantum computers could eventually decrypt material protected by classical algorithms such as RSA and ECDSA, making it vulnerable to Harvest Now, Decrypt Later attacks.²

For enterprises already centralizing encryption operations in cloud key management systems, this is a practical development. PQC testing can begin closer to where many organizations already manage keys, policies, and application-level encryption workflows.

2.4 Microsoft: Quantum Safety Becomes a Strategic Security Priority

Microsoft’s Digital Defense Report 2025 includes a dedicated discussion of quantum technologies and their security implications. It states that a sufficiently powerful quantum computer could break widely used public-key algorithms, undermining the security of digital communications and data.⁶

The report also recommends that governments establish quantum safety as a national cybersecurity priority and embed quantum-safe cryptography into national cybersecurity frameworks.⁶

Microsoft’s broader security findings add urgency to data-protection planning. In the Digital Defense Report 2025, Microsoft reported that data collection was observed in 80% of reactive incident response engagements, while exfiltration was observed in 51%. The same report states that more than 97% of identity attacks were password spray or brute force attacks, and that identity-based attacks rose by 32% in the first half of 2025.⁸

Those numbers are not PQC-specific, but they matter. If modern attackers are already focused on identity compromise and data collection, long-lived encrypted data becomes part of the future exposure surface.

3. THE NEW QUANTUM-SAFE INFRASTRUCTURE STACK

The next phase of PQC adoption will not be defined only by cryptographic algorithms. It will be defined by where those algorithms must operate.

Security teams should think of the quantum-safe stack in six layers.

3.1 The Network Layer

Firewalls, routers, VPNs, IPsec tunnels, TLS inspection systems, and remote-access infrastructure all depend on encryption. Cisco’s roadmap makes this explicit by addressing IPsec, TLS, SSH, management access, VPN tunnels, and hardware-level trust.⁴

The network layer will likely become one of the first operational battlegrounds for PQC because it protects high-value traffic moving between locations, users, cloud environments, partners, and data centers.

3.2 The Cloud Key Management Layer

Cloud key management is becoming a natural test bed for PQC. Google Cloud’s ML-KEM support in Cloud KMS preview gives customers a controlled place to begin post-quantum experimentation.⁵

For many enterprises, this is more practical than starting with every application at once. Cloud KMS allows security teams to test new key workflows, understand API behavior, and begin building operational knowledge.

3.3 The Identity and Certificate Layer

Certificates are everywhere. They support TLS, domain authentication, device enrollment, code signing, service identity, and internal application trust.

Microsoft’s security guidance repeatedly emphasizes identity as a critical attack surface. In the Digital Defense Report 2025, more than 97% of identity attacks were password spray or brute force attacks, and identity-based attacks rose 32% in the first half of 2025.8

That identity pressure matters for PQC. If certificate infrastructure and identity systems are not modernized, organizations may struggle to deploy quantum-safe trust at scale.

3.4 The Software Integrity Layer

Digital signatures protect software updates, firmware, containers, applications, and hardware boot chains. Cisco’s firewall roadmap notes that ML-DSA is intended for device identity and software integrity, while SLH-DSA provides a hash-based signature option with a different mathematical foundation.⁴

This is where PQC intersects directly with software supply chain security. In a post-quantum environment, organizations will need confidence that signed code, firmware, and device updates remain trustworthy.

3.5 The Data Protection Layer

Data that remains sensitive for years requires special treatment. Google Cloud’s documentation notes that material encrypted with classical algorithms may be vulnerable to Harvest Now, Decrypt Later attacks.²

That risk is particularly important for regulated data, financial archives, intellectual property, health records, government records, and legal data.

3.6 The Vendor Dependency Layer

No enterprise owns its entire cryptographic stack. Every vendor product that uses encryption becomes part of the PQC migration plan.

That includes:

• Cloud platforms
• Firewalls
• Routers
• VPN appliances
• Identity providers
• SaaS platforms
• Hardware security modules
• Endpoint tools
• Certificate authorities
• Managed security services
• Embedded systems
• Firmware suppliers

This is why vendor questionnaires need to become more specific. “Are you preparing for PQC?” is not enough. Security teams need timelines, supported algorithms, product versions, compatibility notes, and migration paths.

4. WHY FINANCIAL SERVICES, HEALTHCARE, AND GOVERNMENT FACE HIGHER EXPOSURE

Some industries face more urgent PQC exposure because their data remains sensitive for longer.

4.1 Financial Services

Financial institutions depend on public-key cryptography across payment systems, API gateways, mobile banking, identity verification, settlement platforms, trading systems, and interbank communications.

Financial data also ages differently. A password may lose value quickly. A transaction history, institutional account record, high-net-worth client profile, or cross-border settlement archive may remain sensitive for years.

That makes financial services a natural early adopter for PQC planning.

Priority areas include:

• Payment processing
• SWIFT and interbank messaging
• Open banking APIs
• ATM and branch infrastructure
• Customer identity systems
• Mobile banking applications
• Digital signatures
• Regulatory archives
• Hardware security modules
• Internal certificate authorities

From a practitioner’s view, the difficulty is not knowing that migration is needed. The difficulty is sequencing it without breaking systems that run constantly.

4.2 Healthcare

Healthcare organizations hold some of the most durable sensitive data in the economy.

Medical histories, genetic information, insurance records, diagnostic data, clinical research, and patient identity records can remain valuable for a lifetime. If such data is harvested now, it may remain meaningful long after today’s encryption assumptions have changed.

Healthcare also faces a practical migration problem: legacy applications, medical devices, slow procurement cycles, and fragmented environments.

Priority areas include:

• Electronic health records
• Genomic data
• Insurance claims
• Telemedicine platforms
• Medical IoT devices
• Clinical research repositories
• Patient identity systems
• Third-party healthcare SaaS platforms

For healthcare CISOs, PQC should sit beside ransomware resilience, identity protection, and third-party risk as a long-horizon patient trust issue.

4.3 Government and Critical Infrastructure

Government agencies and critical infrastructure operators must protect records, communications, identities, and operational systems over long timeframes.

Microsoft’s Digital Defense Report 2025: Governments and Policymakers Executive Summary states that quantum leadership could affect the future integrity of secure communications and the global digital economy.⁶ It also recommends establishing quantum safety as a national cybersecurity priority.⁶

Priority areas include:

• Classified communications
• Diplomatic systems
• Public-sector PKI
• Citizen identity platforms
• Defense networks
• Emergency services
• Critical infrastructure operations
• Long-term archives
• Government cloud workloads

The public sector will not be able to migrate overnight. That is precisely why planning must begin before pressure peaks.

5. ENTERPRISE READINESS GAPS: WHAT SECURITY TEAMS STILL CANNOT SEE

The biggest PQC readiness problem is not always the budget. It is visibility.

Most enterprises cannot fully answer basic cryptographic questions:

• Where do we use RSA?
• Where do we use ECC?
• Which systems depend on ECDH or ECDSA?
• Which certificates protect long-life data?
• Which applications use hardcoded cryptographic libraries?
• Which vendors control our encryption dependencies?
• Which systems cannot support larger keys or signatures?
• Which business units own the migration risk?

This creates a gap between awareness and execution.

In board discussions, PQC can sound like a single transformation program. In engineering reality, it is a thousand small decisions across networks, applications, cloud platforms, certificates, APIs, hardware, and vendors.

This is why the first step is not to “replace everything.” It is a discovery.

A cryptographic inventory should include:

• Algorithms
• Certificates
• Keys
• Protocols
• Libraries
• Hardware security modules
• VPN tunnels
• API gateways
• Cloud KMS usage
• Code-signing workflows
• Firmware signing
• Identity systems
• Third-party services
• Embedded devices

The organizations that build this inventory early will have choices. The organizations that delay will have surprises.

6. HYBRID CRYPTOGRAPHY AS THE PRACTICAL BRIDGE

A sudden replacement of all classical cryptography is not realistic.

Hybrid cryptography is the bridge.

Hybrid models combine classical and post-quantum mechanisms so organizations can reduce quantum exposure while maintaining interoperability. Cisco’s firewall roadmap references hybrid key exchange capabilities through IKEv2-related RFCs and describes them as part of the transitional path for organizations preparing quantum-resistant protections for IPsec.⁴

Hybrid deployment is especially relevant for:

• IPsec VPNs
• TLS
• Remote access
• Site-to-site tunnels
• API gateways
• Cloud workloads
• Internal service mesh environments
• High-value application traffic

Hybrid cryptography is not a magic shortcut. It still requires testing, monitoring, change management, vendor support, and rollback planning. But it gives enterprises a controlled way to learn before large-scale migration.

A good pilot should answer practical questions:

• Does latency change?
• Do certificates grow beyond expected limits?
• Do monitoring tools understand the new handshake behavior?
• Do firewalls, proxies, and load balancers remain compatible?
• Can the help desk troubleshoot failures?
• Can teams roll back safely?
• Can vendors support the configuration in production?

The answers will vary by environment. That is why pilots matter.

7. NETWORK, CLOUD, AND PKI MODERNIZATION PRIORITIES

7.1 Network Security

Network teams should begin with encryption-heavy systems: VPNs, IPsec tunnels, firewall management, TLS inspection, remote access, and routing infrastructure.

Cisco’s Preparing for Post-Quantum Cryptography: The Secure Firewall Roadmap states that ML-KEM support for FTD 10.5 and ASA 9.25 is targeted for late 2026. It also states that ML-DSA support is planned for FTD/ASA 11.0 in the second half of calendar year 2027.⁴

This gives network teams a planning sequence:

1. Identify where firewall and VPN encryption are used.
2. Map platforms and software versions.
3. Review hardware support.
4. Align upgrade windows with PQC-capable releases.
5. Pilot hybrid key exchange where possible.
6. Update monitoring and logging.
7. Build PQC requirements into future procurement.

7.2 Cloud Key Management

Google Cloud’s Cloud KMS updates make cloud key management a practical PQC testing area. The company has introduced ML-KEM capabilities in preview, including generation, encapsulation, and decapsulation.⁵

Cloud teams should evaluate:

• Which workloads depend on Cloud KMS
• Which data has long confidentiality requirements
• Which applications can test ML-KEM workflows
• Which APIs require code changes
• Which teams own the encryption policy
• Which compliance controls may be affected

7.3 PKI and Certificates

PKI modernization may become one of the hardest parts of PQC migration.

Certificates touch almost everything: users, devices, applications, services, APIs, code signing, TLS, and internal trust. Any weakness in certificate lifecycle management will become more painful during PQC migration.

Security leaders should assess:

• Certificate inventory completeness
• Certificate authority readiness
• Automation maturity
• Code-signing dependencies
• Device enrollment workflows
• Internal TLS coverage
• Vendor certificate dependencies
• Support for larger signatures
• Testing environments for hybrid certificates

This is not glamorous work. But it is where many PQC programs will succeed or stall.

8. STRATEGIC ROADMAP FOR EXECUTING ENTERPRISE PQC READINESS 

Phase 1: Establish Ownership

PQC migration needs a clear owner, but not a single isolated team. The program should include security, infrastructure, cloud, application, identity, procurement, compliance, and legal stakeholders.

Executive sponsorship matters because migration will compete with other priorities.

Phase 2: Build the Cryptographic Inventory

Inventory first. Replace later.

Map algorithms, keys, certificates, protocols, libraries, VPNs, cloud encryption, software signing, and vendor dependencies.

Prioritize systems protecting data that must remain confidential for 10 years or longer.

Phase 3: Segment Systems by Risk

Classify systems into practical migration tiers:

• Long-life sensitive data
• Internet-facing encryption
• Regulated environments
• Identity and certificate infrastructure
• Vendor-controlled cryptography
• Legacy systems with upgrade barriers
• Low-risk short-life data

This avoids a flat migration plan that treats every system the same.

Phase 4: Test Hybrid Deployments

Begin with controlled pilots. VPNs, internal TLS, Cloud KMS experiments, API gateways, and noncritical services are good candidates.

The objective is not to declare victory. The objective is to learn safely.

Phase 5: Pressure Vendors

Ask vendors for evidence, not promises.

Useful questions include:

• Which products use RSA, ECDH, or ECDSA?
• Which product versions will support ML-KEM?
• When will ML-DSA support arrive?
• Will SLH-DSA be supported?
• What happens to older hardware?
• Are larger signatures supported?
• Will monitoring tools expose PQC metadata?
• Is hybrid key exchange supported?
• What is the migration path for existing customers?

Phase 6: Modernize PKI

Certificate lifecycle automation should become a core PQC readiness workstream.

Organizations with weak certificate visibility will struggle when post-quantum certificates, hybrid certificates, or new signing workflows become operational requirements.

Phase 7: Report Progress to Leadership

PQC readiness should appear in enterprise risk reporting.

Useful board-level metrics include:

• Percentage of cryptographic assets inventoried
• Number of high-risk systems using RSA or ECC
• Percentage of long-life data systems assessed
• Vendor PQC roadmap coverage
• Number of hybrid pilots completed
• PKI automation maturity
• Legacy systems requiring replacement
• Cloud KMS PQC testing progress

What gets measured will get funded.

Enterprise PQC Readiness Scorecard

Security leaders can use this scorecard to assess whether PQC readiness is moving from discussion to execution. A mature program should show measurable progress in cryptographic discovery, PKI modernization, vendor roadmap validation, hybrid testing, cloud readiness, and executive reporting. 

9. EXECUTIVE OUTLOOK

The next several years will separate organizations that planned for quantum-safe security from those that merely watched the market.

IBM’s June 2026 investment announcement shows that quantum computing is receiving serious long-term capital.³ 

Cisco’s 2026 firewall roadmap shows that PQC is moving into network infrastructure.⁴ 

Google Cloud’s Cloud KMS updates show that PQC experimentation is entering cloud key management.⁵ 

Microsoft’s Digital Defense Report 2025 shows that quantum safety is being framed as a strategic cybersecurity priority.⁶

The risk is not that every enterprise will be forced to migrate tomorrow. The risk is that migration will take longer than leaders expect.

There will be old systems that cannot be upgraded. There will be certificates nobody remembers issuing. There will be vendor products with vague roadmaps. There will be applications that fail when key sizes change. There will be business units that assume security owns the problem, even when the dependency sits inside their application.

That is the real shape of the challenge.

Post-quantum cryptography is not just about preparing for a future quantum computer. It is about regaining control over cryptography before the deadline becomes visible.

For executive teams, the most important PQC question is no longer whether quantum-safe migration matters. It is whether the organization has enough visibility, ownership, vendor accountability, and modernization capacity to execute the migration without business disruption. PQC readiness should therefore be measured like any other enterprise risk program: through asset coverage, maturity scoring, roadmap progress, vendor dependency tracking, and leadership-level reporting. 

CONCLUSION

The post-quantum transition has entered its execution phase.

Cisco is building ML-KEM, ML-DSA, and SLH-DSA support into Secure Firewall roadmaps.⁴ Google Cloud is enabling ML-KEM experimentation in Cloud KMS.⁵ Microsoft is placing quantum safety inside strategic cybersecurity guidance.⁶

For enterprises, the path forward is clear, even if the work is difficult.

Start with discovery. Prioritize long-life data. Build crypto-agility. Test hybrid deployments. Modernize PKI. Demand vendor roadmaps. Report progress to leadership.

The organizations that begin now will have time to make careful decisions. The organizations that wait may still get there, but under pressure, with fewer options and higher costs.

Quantum-safe cybersecurity is no longer a future-state ambition. It is a current governance responsibility.

Assess Your Enterprise PQC Readiness 

CyberTech Intelligence helps enterprise security leaders move from post-quantum awareness to measurable execution. Through the Enterprise PQC Readiness Assessment, organizations can identify cryptographic dependencies, evaluate vendor readiness, prioritize long-life data exposure, assess PKI maturity, and build a practical roadmap for quantum-safe modernization.

Security, infrastructure, cloud, identity, and risk leaders can also engage CyberTech Intelligence for:

• Enterprise PQC Readiness Assessment
• Cryptographic Discovery Workshop
• Executive Quantum Readiness Briefing
• Vendor PQC Readiness Review
  

Use this whitepaper as the starting point for a structured readiness conversation, not only as a research reference.

Get in touch with us

REFERENCES

1. Cisco (2025) Quantum-Ready Migration Guide. Cisco Systems, 2025. Available at: https://www.cisco.com/c/en/us/td/docs/solutions/CVD/Campus/Quantum-Ready-Migration-Guide.html 
2. Google Cloud Documentation (2025) Key Encapsulation Mechanisms | Cloud Key Management Service. Google Cloud, 2025. Available at: https://docs.cloud.google.com/kms/docs/key-encapsulation-mechanisms 
3. IBM Newsroom (2026) IBM Commits More Than $10 Billion to Quantum Computing, Funding Its Roadmap From Today’s Leading Systems to the World’s First Fault-Tolerant Quantum Computers. IBM Corporation, 2 June 2026. Available at: https://newsroom.ibm.com/2026-06-02-ibm-commits-more-than-10-billion-to-quantum-computing,-funding-its-roadmap-from-todays-leading-systems-to-the-worlds-first-fault-tolerant-quantum-computers
4. Cisco (2025). Preparing for Post-Quantum Cryptography: The Secure Firewall Roadmap. Cisco Systems, 2025. Available at: https://blogs.cisco.com/security/preparing-for-post-quantum-cryptography-the-secure-firewall-roadmap 
5. Google Cloud (2025). How We’re Helping Customers Prepare for a Quantum-Safe Future. Google Cloud, 2025. Available at: https://cloud.google.com/blog/products/identity-security/how-were-helping-customers-prepare-for-a-quantum-safe-future 
6. Microsoft (2025) Microsoft Digital Defense Report 2025: Governments and Policymakers Executive Summary. Microsoft Corporation, 2025. Available at: https://cdn-dynmedia-1.microsoft.com/is/content/microsoftcorp/microsoft/msc/documents/presentations/CSR/MDDR-2025-Government-Executive-Summary.pdf 
7. Cisco (2025) Cisco Quantum Safe Communications Roadmap. Cisco Systems, 2025. Available at: https://www.cisco.com/c/dam/en_us/about/doing_business/trust-center/docs/quantum-safe-communications-roadmap.pdf 
8. Microsoft (2025) Digital Defense Report 2025: Safeguarding Trust in the AI Era. Microsoft Corporation, 2025. Available at: https://cdn-dynmedia-1.microsoft.com/is/content/microsoftcorp/microsoft/msc/documents/presentations/CSR/Microsoft-Digital-Defense-Report-2025.pdf