What is Q-Day?
The day a cryptographically-relevant quantum computer can break the public-key cryptography that secures the modern internet. The arrival date is a moving target — but the data you protect today must already account for it.
It's not one date.
It's already three problems.
The arrival of Q-Day will not be a single, datable event — and waiting for it to be announced is the wrong frame entirely. Three independent pressures already oblige every regulated organisation to migrate, regardless of when Q-Day actually lands.
Harvest now, decrypt later
Adversaries already exfiltrate encrypted traffic and archives, planning to decrypt them after Q-Day. Long-shelf-life data is at risk today.
Regulatory deadlines
NIST FIPS 203/204/205 are finalised. CNSA 2.0 mandates PQC by 2030. NIS2 and DORA make cryptographic governance auditable today.
Cryptographic blindness
Few organisations have a complete cryptographic inventory across transit, runtime and at-rest. You cannot migrate what you cannot see.
The Q-Day roadmap, four checkpoints.
Mosca's inequality,
plain language.
If the time you need to migrate your cryptography (tp), plus the time your data must remain confidential (td), is greater than the time until Q-Day arrives (tq), then your data is already at risk — even if Q-Day is decades away.
For most regulated organisations, tp is measured in years, td in decades, and tq is conservatively a single decade. The arithmetic rarely flatters anyone.
Five concrete steps before next quarter.
1 · Build a cryptographic inventory
You cannot manage what you cannot see. ResilQ delivers a CBOM in 72 hours.
2 · Adopt crypto-agility
Decouple algorithm choice from application code. Make rotation a configuration change, not a release.
3 · Enable hybrid PQC where supported
Modern OpenSSH (with sntrup761x25519) and modern TLS stacks already support hybrid PQC. Turn it on.
4 · Re-encrypt long-shelf-life archives
Tape and cold-storage archives are the worst HNDL targets. Plan re-keying with quantum-safe wrapping.
5 · Brief your audit committee
QARS-NI gives you a single, defensible number for the conversation. Use it.
6 · Subscribe to NIST & ETSI updates
Standards are evolving quickly. ResilQ tracks them so you don't have to.