More than 65 percent of network traffic reaching Cloudflare already uses post-quantum key exchange as of April 2026, a surprisingly high adoption rate suggesting the shift to quantum-resistant cryptography is further along than many realize. This migration is being driven by rapidly approaching deadlines.
Draft guidance from the U.S. National Institute of Standards and Technology proposes deprecating RSA and elliptic-curve algorithms by 2030 and disallowing them entirely by 2035. The urgency stems from a present-day data security risk, as encrypted traffic can be captured now and decrypted once quantum computers advance, a threat known as “harvest now, decrypt later.”
NIST & NSA Timelines Drive Post-Quantum Migration Urgency
The NSA’s CNSA 2.0 suite expects U.S. national security systems to use quantum-resistant algorithms by 2033. In Canada, federal departments must migrate high-priority systems by the end of 2031 and the remainder by the end of 2035. While large infrastructure providers are ahead of the curve, the pace of adoption varies significantly across the broader digital ecosystem. However, for many organizations, identifying where cryptography is even used remains the primary challenge, as security teams often lack a comprehensive inventory of cryptographic dependencies embedded within applications, libraries and network devices.
This lack of visibility hinders effective planning and prioritization of migration efforts. SuperQubit Inc. introduced SQP Assess, a browser-based tool designed to address this initial assessment gap, allowing teams to measure their readiness across seven domains, ranging from inventory management to cryptographic agility.
According to the company, the tool operates with a strong focus on data privacy, with all results encrypted and saved locally on the organization’s own devices. SQP Assess’s cryptographic exposure map covers over 60 algorithms and 18 protocol families, each paired with a recommended replacement, and incorporates timing checks that simulate “harvest now, decrypt later” scenarios to assess risk based on data lifespan and applicable deadlines.
The vendor tracker within the assessment records supplier commitments to cryptography, categorizing them as committed, forecast, announced, or unknown, providing information about supply chain risk management. The assessment’s overall maturity score is determined by the weakest domain, meaning a strong performance in one area cannot compensate for deficiencies in another, highlighting the need for a thorough and comprehensive approach to migration.
SuperQubit SQP Assess Maps Cryptographic Exposure & Readiness
SuperQubit’s SQP Assess incorporates timing checks that model “harvest now, decrypt later” and “trust now, forge later” scenarios, quantifying the risk associated with delayed cryptographic migration. The assessment’s design acknowledges that a comprehensive migration strategy begins with a detailed inventory of existing cryptographic assets and a clear understanding of current readiness levels.
The tool measures an organization’s post-quantum migration maturity across seven domains, ranging from initial inventory creation to achieving full cryptographic agility, on a scale from 0 to 5. This granular approach allows teams to pinpoint specific areas requiring immediate attention and resource allocation, rather than relying on broad, generalized assessments.
Seven sector-specific modules cater to financial services, telecommunications, operational technology, critical infrastructure, government, digital assets and cross-sector organizations, tailoring the assessment to unique industry requirements. “For many organizations, the most practical starting point is not a large migration programme but a clear, evidence-based answer to a simple question: where do we stand today?” the company states.
See today’s quantum computing news on Quantum Zeitgeist for the latest breakthroughs in qubits, hardware, algorithms, and industry deals.
