Quantum Security Blog · PQC, CBOM & Regulation

Research and insights on post-quantum cryptography, regulatory deadlines (NIST, IRDAI, RBI, MAS, CBUAE, EU, G7), CBOM, HNDL attacks, and migration strategy.

• India's Insurers Now Need a Cryptographic Inventory. What IRDAI's 2026 Guidelines Ask For, and What to Do First. 2026-10-24
  IRDAI's Information and Cyber Security Guidelines 2026 ask insurers and intermediaries to keep an up-to-date inventory of cryptographic assets to prepare for post-quantum security. It is the first Indian financial-sector rule to make that inventory an obligation rather than advice.
• October 2026: Regulators Moved From Warnings to Expectations. What Changed for Financial Institutions. 2026-10-23
  Switzerland expects board-approved post-quantum roadmaps by mid-2027, the UK and Singapore compared supervisory approaches, RBI's Q-SAFE report is coming due, MAS's expectations are still pending, and Quantinuum reported its best error-correction result yet.
• Europe's Three Financial Supervisors Just Named Quantum a Top Risk. The EU Deadline Is End-2026. 2026-09-27
  On 23 September 2026 the EBA, EIOPA and ESMA put quantum computing in their joint autumn risk report, warning the threat could arrive before any commercial benefit. Behind it sits an end-2026 EU deadline to start the transition. What it means, and why banks outside Europe should care.
• An AI Broke a Post-Quantum Candidate in 60 Hours. The Lesson Is Crypto-Agility, Not Panic. 2026-09-26
  On 28 July 2026, Anthropic showed its Claude Mythos Preview model finding a key-recovery attack on HAWK, a NIST post-quantum signature candidate. HAWK was withdrawn. ML-KEM and ML-DSA are unaffected. Here is what actually happened, and what it means for banks.
• Washington's Signal to Banks: No Mandate Yet, but Inventory First. What Treasury and NIST Said This Month. 2026-09-25
  Treasury launched a financial-sector Quantum-Readiness Task Force built around inventory, agility and interoperability. On 25 September NIST's director said its standards are "being implemented at scale as we speak." Neither is a rule for banks. Both tell you what supervisors will ask first.
• Singapore Just Put Dates on Quantum-Safe Migration. Banks Have Until March 2027 to File a Plan. 2026-09-24
  CSA's Quantum-Safe Migration Handbook v1.0 sets three milestones for critical infrastructure: a plan by 31 March 2027, quantum-safe procurement from 2028, and migration complete by end-2031. MAS is layering supervisory expectations on top. Here is what regulated FIs need to know.
• Three Regulators, Three Timelines: A One-Page PQC Calendar for Banks in India, Singapore and the UAE 2026-09-21
  RBI has a Q-SAFE committee, Singapore has dated milestones, the UAE has a binding national encryption policy. If you operate across all three, here is one calendar and one sequence of work that satisfies them together.
• The UAE Made Cryptographic Inventory a Legal Requirement. Gulf Banks Should Read It Closely. 2026-09-16
  The UAE National Encryption Policy requires approved post-quantum transition plans, automated cryptographic inventory, and crypto-agility by design. It targets government entities first. Here is why regulated banks should treat it as their blueprint.
• From 20 Million Qubits to About 10,000: Why Every Big Platform Moved Its Quantum Deadline to 2029 2026-09-11
  In March 2026, Google Quantum AI and a Caltech/Oratomic team published resource estimates that cut the qubits needed to break ECC and RSA by one to two orders of magnitude. Within three months, Google, Cloudflare and Microsoft all set 2029 targets. Here is the chain of events.
• The G7 Roadmap Gives Finance Until 2034. The Phases in Between Are Where Banks Fall Behind. 2026-09-08
  The G7 Cyber Expert Group's financial-sector roadmap lays out six overlapping phases from awareness in 2025 to validation in 2035. Discovery is meant to be finished by 2028. Here is what each phase asks for, and where most banks actually are.
• EO 14412 Put Real Dates on Post-Quantum: 2030 and 2031 2026-09-03
  On 22 June 2026, the US signed Executive Order 14412 - "Securing the Nation Against Advanced Cryptographic Attacks." It sets a 2030 deadline for key establishment and 2031 for authentication. Vague guidance just became hard deadlines.
• CISA and the G7 Just Told Enterprises to Move on PQC. Here Is What That Means. 2026-09-02
  In August 2026, CISA published "Preparing for the Post-Quantum Era: A Call to Action" alongside G7 partners. When intelligence agencies coordinate messaging like this, the discovery clock has already started.
• The Quantum Threat Reached Blockchain in 2026 - and the Signatures Are the Weak Point 2026-09-01
  In August 2026, Circle warned that the compute needed to break common digital signature schemes had dropped sharply, and Ripple set a 2028 quantum-defense target for the XRP Ledger. The signature problem is not just a crypto-industry problem.
• India Has a National Quantum-Safe Roadmap Now. Your Bank Is on the Clock. 2026-08-28
  A 140-page national roadmap, an RBI Q-SAFE committee, SEBI CSCRF, and India's first C-SAFE certified algorithm. India's quantum-safe transition moved from talk to policy in 2026 - and BFSI is first in line.
• Everyone Has a PQC Plan. Almost No One Has Deployed. Here Is the Gap. 2026-08-22
  87% of organizations say they are planning or implementing PQC. Only 7% have actually deployed it. And 46% have no single person leading the migration. The 2026 readiness data is a warning.
• The Quantum Clock: Why 2029 Changes Everything 2026-07-28
  Microsoft, Google, and Cloudflare have set 2029 as their PQC migration deadline. If you run security for a large enterprise, the next few years matter more than the next decade.
• What Is a CBOM - and Why Your Auditor Will Ask for One 2026-07-22
  A Cryptographic Bill of Materials is becoming a regulatory requirement. Learn what it includes, which frameworks mandate it, and how to generate one automatically.
• HNDL Attacks: Your Data Is Already Being Harvested 2026-07-15
  Harvest Now, Decrypt Later is not a theoretical attack - it's happening at scale. State-sponsored actors are stockpiling encrypted traffic today, waiting for quantum computers to break it open.
• PQC Migration Roadmap: A Step-by-Step Guide for CISOs 2026-07-08
  A practical, phased approach to post-quantum cryptographic migration. From cryptographic inventory to full PQC deployment in 18 months.
• NIST PQC Standards: ML-KEM, ML-DSA, and SLH-DSA Explained 2026-07-01
  A plain-language guide to the three NIST post-quantum cryptographic standards. What they replace, how they work, and when to deploy each one.