Post-Quantum Migration, Not QKD, Is the Real Economic Core of Quantum Cryptography

1. Executive Overview

Quantum cryptography is best modeled as a forced rebuild of trust infrastructure rather than as a point market for exotic hardware. Strictly defined, the term refers to security methods that use quantum phenomena, primarily QKD. In commercial usage, however, the spend pool now includes PQC, QRNG, quantum-secure networking, migration software, consulting, certificate and key lifecycle upgrades, and hardware roots of trust. That broader framing matters because the largest economic opportunity is likely to come from standards-based classical algorithms deployed into existing infrastructure, not from broad enterprise rollout of dedicated quantum links.

A future cryptographically relevant quantum computer would break the asymmetric algorithms that sit under TLS, VPNs, PKI, code signing, secure boot, machine identity, and long-lived credential chains. Larger RSA or ECC keys do not fix that problem. The near-term threat is harvest-now, decrypt-later. The larger spending cycle is the migration of authentication and trust anchors, because key exchange is only the first chapter. NIST finalized ML-KEM, ML-DSA, and SLH-DSA in 8/2024, selected HQC as a backup KEM in 3/2025, Chrome 124 enabled hybrid post-quantum key exchange by default on desktop in 2024, and U.S. government guidance is already pushing inventories, procurement planning, and quantum-resistant end states centered on 2030 to 2035. What changed materially in 2026 is that public threat framing tightened: Google disclosed ECDLP-256 resource estimates below 1,200 logical qubits in one circuit and below 1,450 in another, with fewer than 500,000 physical qubits under its assumptions, which does not prove a CRQC is imminent but does make passive waiting materially harder to justify.

The market implication is that quantum security should not be underwritten as a greenfield appliance category. It is more accurately a cross-cycle uplift to cloud, CDN, firewall, VPN, PKI, HSM, certificate lifecycle, consulting, and hardware refresh budgets. Near-term spend should skew toward cryptographic discovery, inventory, interoperability testing, hybrid key establishment, and crypto-agility tooling. The larger and more durable profit pool should emerge in authentication infrastructure, code signing, secure boot, long-lived credentials, and the hard-to-upgrade installed base of OT, IoT, telecom, and legacy systems. Meta's 2026 migration write-up is useful confirmation that large operators are no longer treating this as a speculative standards exercise, but as a staged engineering program with risk assessment, inventory, guardrails, hybrid deployment choices, and organizational migration levels.

• Most important market conclusion: PQC migration is likely to dominate the economic value pool over the next decade, while QKD remains a narrower sovereign and telecom-heavy niche.
• Most important commercial conclusion: the highest-probability winners are vendors already sitting in the trust path, not subscale pure plays selling isolated quantum-safe features.
• Most important timing conclusion: key exchange is already moving into deployment, but authentication, certificate chains, hardware roots of trust, and long-lived identities are the harder and more valuable second chapter, and 2026 resource-estimate compression has made delay risk more visible.
• Most important modeling conclusion: much of the revenue will not be disclosed as quantum cryptography. It will show up inside cloud security, CDN services, firewall and VPN upgrades, HSM and PKI spend, certificate automation, professional services, hardware-refresh cycles, and crypto-agility management layers.

2. Core Evidence: Technology Stack, Standards, and Economic Model

The critical analytical distinction is between QKD and PQC. QKD uses quantum states, usually photons over fiber or free space, to distribute key material and detect eavesdropping through elevated error rates. It solves key distribution, not the entire enterprise security problem, and still depends on classical authenticated channels plus operationally secure hardware. PQC is fundamentally different. It runs on classical hardware, replaces RSA, Diffie-Hellman, ECDH, ECDSA, and related schemes with new mathematical constructions, and can be deployed through browsers, TLS libraries, operating systems, VPN stacks, HSM firmware, SDKs, and cloud control planes.

That technical distinction determines TAM and margin structure. PQC is primarily a software, protocol, and lifecycle-management transition. QKD is primarily a hardware and transport-infrastructure transition. NSA's published position that PQC is generally more cost-effective and maintainable than QKD for national security systems, unless QKD's operational limitations are overcome, is commercially important because it pushes buyers toward standards-led migration inside existing stacks rather than toward generalized enterprise deployment of dedicated quantum links.

Standards are now concrete enough to support procurement. NIST finalized FIPS 203 ML-KEM, FIPS 204 ML-DSA, and FIPS 205 SLH-DSA on 8/13/2024. It selected HQC on 3/11/2025 as a backup KEM and continues developing FIPS 206 FN-DSA. The functional split matters. ML-KEM addresses key establishment, ML-DSA is the primary signature standard, SLH-DSA is a hash-based backup, HQC adds algorithmic diversity on the KEM side, and FN-DSA offers smaller signatures but greater implementation complexity. The investment takeaway is that crypto-agility, hybrid deployment support, and workflow orchestration matter more than any single algorithm brand name.

The architectural keyword that deserves more prominence is crypto agility. NIST NCCoE's migration program explicitly centers cryptographic discovery and interoperability, while CSWP 39 frames crypto agility as the discipline of being able to change algorithms, protocols, trust anchors, and implementations without breaking production systems. That matters commercially because the winners are not just vendors that support one NIST algorithm. They are vendors that can inventory exposure, orchestrate hybrid deployment, absorb standards evolution, and eventually disable vulnerable fallback paths with minimal operational damage.

3. History and Timeline: QKD Science vs PQC Commercialization

The QKD timeline is long and technologically credible. BB84 dates back to 1984, B92 followed in 1992, and entanglement-based QKD theory emerged in 1991. NIST references a 2004 secure fund transfer in Vienna between a bank and city hall using QKD. By 2021, researchers had reported an integrated space-to-ground QKD network spanning more than 4,600 km using more than 700 fiber links and 2 satellite links. By 2025, Nature described China's operational trusted-relay QKD network extending more than 10,000 km with 145 fiber backbone nodes, 20 metropolitan networks, and coverage across 17 provinces and 80 cities. The lesson is not that QKD is fake. The lesson is that its most durable commercial traction has appeared in state-backed, telecom-managed, or sovereign settings rather than in generalized enterprise deployment.

The PQC timeline is much shorter and much more economically relevant. NIST launched the PQC project in 2016, moved from 69 candidates to its first finalized standards in 2024, selected HQC in 2025, and by 2026 the market had already moved into product categorization, interoperability work, staged migration plans, and explicit execution playbooks. The internet-scale deployment sequence is especially important. Cloudflare enabled PQ encryption server-side in 2022. Chrome 124 enabled hybrid Kyber or ML-KEM key exchange by default on desktop in 2024. By 2025, Cloudflare reported that over 50% of human traffic on its network was protected against store-now, decrypt-later, while public-server support reached 39% of the top 100,000 servers but origin support lagged at 3.7%. In 2026, Google published materially tighter ECC attack-resource estimates and Meta published migration lessons and PQC migration levels, which together mark a shift from broad readiness rhetoric toward concrete urgency and operating-model design.

4. Threat Model and Migration Risk

The practical near-term offensive model is not real-time quantum decryption of ordinary sessions. It is passive collection of encrypted data today, followed by future decryption once a CRQC exists, plus targeted focus on long-lived credentials and signed artifacts whose trust lifetimes extend into the quantum era. That is why OMB highlights the risk that encrypted data can be recorded now and decrypted later, why Chrome prioritized key exchange first, and why Cloudflare and Google emphasize long-lived roots of trust, API authentication keys, and code-signing credentials. Assets with 10-plus-year confidentiality or integrity requirements are the first migration priority. Google's March 2026 disclosure on ECDLP-256 is important not because it turns cryptocurrency into the center of this note, but because it shows a concrete example of attack-cost compression. When credible public resource estimates move lower that quickly, the burden shifts toward proving why migration can wait rather than why it should start.

The second threat layer is migration risk itself. Hybrid PQC introduces larger handshakes, new algorithm identifiers, and new parsing paths across middleboxes, TLS terminators, DPI engines, proxies, agents, and inspection tools. Chrome's desktop rollout exposed pre-existing TLS middlebox bugs. AWS warns that intermediate DPI devices and firewalls can block new algorithms. Cloudflare's 2025 review also highlights implementation issues such as KyberSlash timing attacks. Meta's 2026 migration write-up reinforces the same point operationally: large organizations need staged migration levels, guardrails, and a deliberate choice between replacement and hybrid paths because the transition itself is a systems-engineering problem. In other words, the attack surface expands before it contracts, which raises the value of vendors that can operationalize protocol change without breaking traffic.

The third threat layer is QKD implementation risk. Theoretical security does not eliminate practical compromise. NIST points to detector inefficiency, multi-photon emissions, false detections, and hardware tampering as real-world loopholes. NSA notes that commercial QKD systems have been attacked, that implementation security depends heavily on hardware engineering, that trusted relays increase insider risk, and that QKD remains vulnerable to denial of service. QKD also does not authenticate message sources on its own, so it still depends on classical authentication or pre-positioned keys. That is why QKD is better understood as a specialized component inside a broader secure architecture than as a universal replacement for classical trust infrastructure.

5. How Networks Are Actually Being Secured in Practice

The dominant migration playbook has three steps. First is cryptographic discovery: identify where vulnerable algorithms are used, which vendors control them, which data have long confidentiality lives, and which systems are hard-coded or embedded. Second is interoperability testing: prove that standardized PQ algorithms work across browsers, CDNs, clouds, endpoints, VPNs, HSMs, and enterprise appliances. Third is phased disablement: remove fallback to vulnerable algorithms once confidence is high enough. NIST NCCoE frames discovery and interoperability as the core workstreams, OMB already requires federal inventories and annual updates through 2035, and CSWP 39 makes crypto agility an explicit design requirement rather than an optional feature.

At the internet edge, hybrid key establishment is already the baseline migration path. Chrome 124 enabled it by default on desktop. Cloudflare reports that over 50% of human traffic on its network is now protected against store-now, decrypt-later. AWS supports ML-KEM hybrid TLS on KMS, ACM, and Secrets Manager and is planning broader HTTPS rollout. The performance profile is manageable. Chrome estimated roughly 1 KB of additional key-exchange data per peer and observed about a 4% median desktop TLS handshake latency increase because the ClientHello often split into two packets. AWS measured roughly 1,600 additional bytes and 80 to 150 microseconds of extra compute, but only about a 0.05% TPS penalty in typical settings with connection reuse. That strongly favors scale incumbents that can spread migration friction across enormous traffic volumes.

Authentication is the harder second chapter and likely the larger profit pool. Google has said a naive ML-DSA substitution would add about 14 KB to a typical TLS handshake, which is operationally unattractive. The proposed answer is not simply larger certificates. It is architectural redesign, including Merkle Tree Certificates and a Chrome Quantum-resistant Root Store, with a staged path that begins around 2027 for CT and CA onboarding and a broader 2029 migration timeline. Cloudflare has likewise moved toward a 2029 target for full PQ security, including authentication. Meta's 2026 migration framework reinforces that this chapter demands phased governance, use-case segmentation, and disciplined choices between replacement and hybrid deployment. This is the layer where machine identity, CA software, certificate lifecycle automation, HSMs, root program governance, and trust-anchor agility become strategic spending categories.

Inside private networks, the transition is expanding from public TLS into VPNs, management planes, internal service traffic, and hardware refresh. Check Point R82 implements ML-KEM inside IKEv2 hybrid VPN exchange. PAN-OS 12.1 supports PQC for TLS 1.3 management connections and can detect, allow, block, and log PQC TLS sessions. Cisco's secure-firewall roadmap ties PQC support to secure-boot hardware requirements, which implies a tangible platform-refresh opportunity because many pre-2025 systems are not expected to qualify. Fortinet, F5, Zscaler, and Akamai are all extending PQC through existing network and application-delivery control planes. In OT, telecom, and embedded systems, the migration becomes partly a hardware-refresh market because long-lived field devices cannot always take simple software upgrades.

6. Competitive Landscape and Public-Market Positioning

The competitive landscape is unusually broad because PQC touches nearly every layer of digital trust. NIST's migration consortium includes hyperscalers, telecom operators, CDN and edge platforms, firewall vendors, PKI providers, HSM vendors, silicon vendors, migration specialists, and payment-network participants. That breadth is itself an analytical signal. The market is diffusing through incumbent platform layers, while specialized private companies are more likely to matter as component suppliers, acquisition candidates, or niche leaders in crypto-agility and migration tooling.

Among public hyperscalers and web-platform operators, Alphabet, Amazon, Microsoft, Meta, and Cloudflare appear best positioned because they control both protocol deployment and customer migration surfaces. Google has been working on PQ experiments since 2016, is redesigning web PKI for the authentication phase, and has set a 2029 migration target. AWS has already deployed hybrid ML-KEM support to security-sensitive services and plans to extend it. Microsoft has published a quantum-safe strategy with early adoption by 2029 and full transition by 2033, while shipping ML-KEM and ML-DSA APIs into Windows and .NET. Cloudflare already carries majority PQ traffic at the key-exchange layer and is pushing hard into authentication. Meta is newly useful as evidence that large-scale private infrastructure operators are formalizing staged migration frameworks rather than treating PQC as abstract future-proofing.

Among public network and security vendors, Cisco, Palo Alto Networks, Fortinet, Check Point, F5, Zscaler, and Akamai are the clearest direct beneficiaries. The revenue path is not a separate quantum product line. It is firewall refresh, VPN modernization, SSE and ADC upsell, origin-security features, inspection and logging of PQC traffic, and premium maintenance or support. The deeper point is that crypto agility itself becomes a sellable capability: policy-driven algorithm changes, hybrid coexistence, discovery, orchestration, and eventual disablement of vulnerable paths. Investors should therefore look for monetization inside existing large platforms and control planes, not for disclosed stand-alone quantum-safe revenue.

Among digital-trust and cryptography-infrastructure vendors, IBM and Thales are especially well placed because cryptographic discovery, lifecycle management, HSM firmware, and production PKI are the chokepoints of the authentication migration. IBM Guardium Cryptography Manager and IBM Z Crypto Discovery and Inventory attack the inventory and remediation problem directly. Thales is embedding NIST-standardized PQC into Luna HSM firmware and positioning Luna as a production HSM path for HNDL defense. These categories should gain strategic value as the market moves from transport encryption into signatures, key custody, machine identity, and secure boot.

QKD and quantum-networking exposure is much narrower and more speculative in public markets. IonQ became the clearest U.S. public proxy after acquiring roughly 86% of ID Quantique in 4/2025 and later expanding through quantum-networking acquisitions. But even there, security is only one part of a broader platform story, so direct QKD revenue cannot be inferred from headline revenue. Arqit's FY2025 revenue of only $530,000 from seven contracts is a useful corrective. Direct, disclosed, stand-alone quantum-safe revenue remains tiny relative to category attention. That does not invalidate the theme. It shifts the listed-market thesis toward incumbents embedding PQC into already-essential products.

7. Policy, Geography, and Market Size

Policy is now a primary demand driver. OMB M-23-02 requires federal inventories of CRQC-vulnerable cryptographic systems and annual updates through 2035. NSA's CNSA 2.0 framework points to new national-security acquisitions generally needing to support compliant algorithms by 1/1/2027, equipment unable to support CNSA 2.0 needing phase-out by 12/31/2030, and mandated algorithm use by 12/31/2031, with the broader objective of quantum-resistant national-security systems by 2035. The White House also directed CISA to identify product categories where PQC-supporting technologies are already broadly available and pushed agencies toward TLS 1.3 by 1/2/2030. This is no longer a theoretical standards exercise. It is entering procurement language and lifecycle planning.

Geographically, the world is bifurcating between PQC-led migration and QKD-led sovereignty projects. The UK NCSC has laid out a 2028 to 2035 roadmap for discovery, early migration, and completion. The EU is building EuroQCI with terrestrial and space components. China continues to scale trusted-relay QKD across telecom and metropolitan networks. The geopolitical split is clear. PQC is becoming the default for broad enterprise and public-sector migration, while QKD retains relatively stronger momentum in sovereign telecom, satellite, and critical-infrastructure corridors where governments are willing to subsidize hardware-heavy architectures.

Published market estimates vary widely because definitions are inconsistent. Some researchers are effectively measuring PQC software and services, others are blending them with photonics-heavy quantum communication and QKD infrastructure, and still others are mixing adjacent quantum-networking tools into the same bucket. The right interpretation is directional rather than literal. Direct category revenue is still small today, but growth is clearly high. For public-equity analysis, the bigger issue is that much of the economic value will be buried inside broader security and infrastructure revenue lines rather than disclosed as quantum cryptography.

8. Investment Implications

The first and most important investment conclusion is that the biggest winners are likely to be incumbent vendors already sitting in the trust path. Scale, installed base, protocol influence, standards participation, and the ability to hide complexity from customers are more valuable than selling a narrow quantum-safe algorithm. The market is moving toward integrated, hybrid, standards-based migration rather than toward wholesale replacement of the cybersecurity stack. The differentiated capability is increasingly crypto-agile orchestration, meaning the ability to discover cryptography in the field, support hybrid coexistence, update trust anchors, and disable legacy paths without breaking production systems.

The second conclusion is that authentication migration is likely to be more valuable than key-exchange migration. Key exchange is already becoming a software rollout inside browsers, CDNs, and cloud services. Authentication touches certificate chains, root stores, CT logs, HSMs, firmware signing, software supply chains, and machine identity. That should create a richer monetization window in CA infrastructure, HSM firmware, secure boot, identity platforms, certificate automation, and hardware refresh. Investors should also separate deployment evidence from monetization evidence here: many capabilities will exist before they are cleanly disclosed, so the best public signals may arrive first through product cadence, architectural disclosure, and attach-rate commentary.

The third conclusion is that QKD should be treated as a strategic niche, not as the base-case center of the market. It has real demand in sovereign communications, telecom backbones, metro data-center links, and potentially satellites, and those niches can produce important local winners. But broad enterprise budgets are still more likely to favor PQC because it is standards-led, software-centric, cloud-compatible, and easier to integrate into existing networks. Any equity thesis that assumes QKD captures the majority of enterprise security dollars should be treated skeptically unless it is explicitly tied to telecom, defense, or government-funded infrastructure corridors.

The fourth conclusion is that timing risk cuts both ways, but the asymmetry is now more uncomfortable for laggards. If CRQC timelines slip, some enterprises may delay deeper spending until authentication architectures mature further or later standards such as FN-DSA settle. If timelines pull forward, spending could accelerate sharply in authentication, secure boot, and critical infrastructure. Google and Cloudflare both pointing to 2029 targets, combined with Google's tighter 2026 resource estimates, suggest that some of the most important platform operators are already planning on a more aggressive timetable than many enterprise buyers publicly acknowledge.

9. Risks and Disconfirming Evidence

The cleanest disconfirming point is that direct, disclosed revenue remains tiny in the pure-play layer. Arqit's FY2025 revenue of $530,000 and seven contracts shows how far category excitement can run ahead of monetization. That is why the thesis has to be framed around incumbent absorption of the spend, not around pure-play reported sales.

A second risk is that CRQC timing remains uncertain. Even after the 2026 compression in public resource estimates, hardware-path assumptions still matter, and it remains possible that practical quantum timelines slip materially. In that scenario, many enterprises could continue to prioritize simpler transport-layer upgrades while delaying hard authentication work until standards, certificate architectures, and vendor interoperability improve further. That would push the fattest part of the spending curve to the right.

A third risk is that implementation and interoperability problems slow rollout or mute monetization. Hybrid handshakes stress middleboxes, DPI engines, inspection tools, and legacy systems. Some large incumbents may have to ship compatibility fixes without immediate pricing power, especially in highly competitive security segments. Meta's own emphasis on migration levels and staged guardrails is evidence that even sophisticated operators expect substantial execution complexity.

A fourth risk is that QKD does better than the base case in state-backed corridors, especially if sovereign subsidy, satellite networking, or critical-infrastructure mandates expand faster than expected. That would not invalidate the PQC thesis, but it would raise the relative importance of telecom, photonics, and national-security infrastructure suppliers.

10. Catalysts and Watchlist

The next several years should be tracked through implementation evidence rather than through broad quantum rhetoric. The highest-signal datapoints are whether authentication migration moves from design work into production architecture, whether network-security vendors can monetize compatibility and refresh cycles, whether resource estimates continue tightening, and whether sovereign QKD programs remain narrow corridors or begin to pull broader ecosystem budgets with them.

• Watch for new language in federal, defense, and critical-infrastructure procurement that shifts from inventorying and pilot work toward mandatory authentication and hardware-root upgrades.
• Watch whether 2029 targets from Google and Cloudflare pull broader enterprise planning forward rather than remaining confined to platform operators.
• Watch whether market estimates begin separating PQC migration from quantum-networking hardware more cleanly, because that will improve valuation discipline across the theme.