Post-quantum work often competes with an existing security backlog, but the two queues speak different languages. Classical findings may be expressed as annualized loss while PQC programs use ordinal readiness or quantum-risk scores. A new research manuscript, Cost of Delay for Post-Quantum Migration, proposes putting both threats into the same unit—currency per year of delay—on the same asset.
Published October 6, the paper models harvest-now-decrypt-later exposure using data confidentiality lifetime, recordable traffic share, data turnover, and a probability distribution for the arrival of a cryptographically relevant quantum computer. It also couples classical and quantum risks so the same loss is not counted twice.
This is a research model, not a validated industry benchmark. The paper is unusually clear that its four case studies use assumed parameters from public documentation and are not validated against outcomes. The practical value lies less in adopting its exact formula than in challenging a common governance failure: maintaining a PQC list that cannot compete coherently for resources.
Separate scorecards create invisible tradeoffs
If a vulnerability team ranks findings by one method and a PQC team ranks migrations by another, leadership still has to choose which work happens first. That decision often becomes qualitative, political, or driven by whichever deadline is most visible.
A shared cost-of-delay frame asks a sharper question: what additional loss does one more year of waiting commit? For classical risk, delay extends exposure to present-day attack. For harvest-now-decrypt-later risk, delay allows more long-lived ciphertext to be collected under quantum-vulnerable protection. Both consume the same constrained engineering capacity.
Even organizations that do not monetize cyber risk can use the structure. A common ordered backlog can use consistent impact bands, time horizons, or service-criticality measures, provided the assumptions remain visible and comparable.
The model depends on inventory relationships
Quantification cannot repair missing evidence. To estimate delay on an asset, teams need relationships among data, flows, cryptography, business impact, and remediation effort. A certificate list alone cannot provide them.
Useful records include:
- asset, service, data class, owner, and consequence of disclosure;
- required confidentiality duration and retention basis;
- traffic paths, exposure points, and plausible recordability;
- cryptographic role, protocol, algorithm, implementation, and configuration;
- classical threat evidence and existing controls;
- supplier, partner, and technical dependencies;
- estimated migration duration and accountable team; and
- source, date, confidence, and known coverage gaps for every material input.
Unknown values should remain explicit. Discovery gaps are not proof that risk is absent, and a precise output from weak inputs is not strong evidence.
Uncertainty can change the order
The paper reports that its quantum term changed the asset order beyond input uncertainty for only one of four illustrative systems. It also finds that asset value and turnover drove more uncertainty than the modeled quantum-arrival date in those cases. Those results should not be generalized to every organization, but they highlight an important discipline: show when the ranking is stable and when it changes under plausible assumptions.
Teams should run sensitivity analysis on the inputs that matter most, document alternative orderings, and identify decision thresholds. If two items exchange position whenever a weak assumption moves slightly, the output should be presented as a range or decision boundary—not a definitive ranking.
Effort belongs beside cost
The paper discusses scheduling by cost of delay relative to the time required to complete an item. That reflects a familiar operational truth: a high-impact migration that takes five years cannot be compared directly with a high-impact configuration change that takes a week.
Backlog records should therefore include a defensible effort range, critical dependencies, testing capacity, and the earliest safe completion window. Leaders can then identify high-cost, short-duration actions while still starting long-lead migrations before their exposure becomes urgent.
What organizations should do next
First, stop reporting PQC as a disconnected maturity score. Link each migration item to the same asset, data, impact, owner, and resource process used for other security work.
Second, record confidentiality lifetime and data-flow exposure for priority systems. These facts help distinguish assets with similar technical cryptography but very different delay consequences.
Third, retain provenance and confidence for every input. Run sensitivity checks before presenting a ranking to leadership.
Fourth, compare the cost of waiting with the effort and lead time required. Do not postpone long projects simply because a short task appears first in a score.
Finally, update the order as evidence, systems, forecasts, and remediation estimates change. Prioritization is a governed process, not a one-time calculation.
How Vista Platform helps
Vista Platform is a self-hosted cryptographic system of record. Its operating loop—discovery, canonical inventory, evaluation, action, and proof—helps teams connect cryptographic evidence to assets, owners, assessments, prioritized actions, exceptions, and verified outcomes.
Vista Platform Core is free of charge and includes discovery, inventory, compliance and PQC assessment, and CBOM generation without asset, sensor, seat, or time caps. Vista tracks and governs post-quantum migration; it does not generate PQC keys or perform every migration. Selected-asset Active Scan is targeted rather than indiscriminate network scanning. Vista is not a vulnerability scanner, and discovery gaps are not proof of absence.
See Vista’s post-quantum and cryptographic inventory resources.
Where uncertainty remains
The manuscript has not established that its monetary calibration predicts real organizational loss, and its illustrative cases use assumed public inputs. Quantum-arrival distributions, recordability, turnover, and asset value can be difficult to estimate. Organizations should treat the approach as a testable decision framework, preserve the underlying evidence, and avoid turning a model into false precision.
Source
- Cost of Delay for Post-Quantum Migration: Putting Classical and Harvest-Now-Decrypt-Later Risk on One Ordered List, Animesh Shaw, arXiv, October 6, 2026.