Quantum threat indicators: what to watch, and when to revisit your plan
On this page
Every few months a quantum announcement makes the news, and someone on the board asks the same question: does this change our timeline? Most of the time the honest answer is no. But "no" is only defensible if someone is watching the right numbers and has agreed in advance what would turn it into a yes. This piece sets out those numbers, where to find them, and how a risk function can turn them into indicators with clear review triggers. It doesn't predict when a quantum computer will break today's cryptography. Nobody can, and the point of monitoring is to avoid needing to.
Why most headlines don't change the plan
Mosca's inequality frames the question. Data is at risk if the time it must stay secret, plus the time your migration will take, is longer than the time until a capable quantum computer exists. Two of those three numbers are yours: how long your data must stay confidential, and how long your migration takes. Only the third, the arrival of a cryptographically relevant quantum computer, comes from outside, and it can't be known precisely.
That's why monitoring matters, and also why it rarely changes much. For a bank with long-lived data and a multi-year migration, the inequality usually says "start now" whatever the outside estimate is. Monitoring tells you whether that urgency should increase. In practice, the number most likely to move your answer is your own migration time, if it slips.
The gap, in one picture
The clearest single indicator is the distance between the machines that exist and the machine published estimates say would be needed. Here it is for physical qubits, the raw hardware count that headlines usually quote:
Two things in that picture deserve equal attention. The gap is still very large: even the lowest estimate needs more than 80 times as many qubits as the largest chip shown. That understates the challenge, because the design also needs sustained error correction and specific connections between qubits that no machine has shown at that scale. And the target has moved towards today's hardware faster than the hardware has moved towards it. Each drop came from better algorithms and error-correction methods on paper, not bigger machines. That's why resource estimates are an indicator in their own right.
The indicators worth tracking
Six indicators cover what matters. The first five track the outside world, from science to regulation; the sixth is your own organisation's exposure.
1. Published resource estimates
These are research papers that work out what machine would be needed to break a specific key, such as 2048-bit RSA. In 2019, Craig Gidney and Martin Ekerå estimated about 20 million noisy qubits running for about eight hours. In 2025, Gidney estimated under a million noisy qubits running for under a week. In February 2026, Paul Webster and colleagues at the company Iceberg Quantum proposed a design using under 100,000 qubits running for about a month. It relies on a newer family of error-correcting codes that needs connections between qubits beyond their immediate neighbours, a combination not yet demonstrated at anything like this scale. A May 2026 revision put the figure at about 94,000 qubits. In September 2026 the same company adapted the design to the fixed connections of superconducting chips and estimated about 120,000 qubits for a one-month run. The difference shows why qubit counts have to be read alongside connectivity and architecture, not on their own. These resource estimates all assume hardware where each operation fails about once in a thousand, with an error-correction cycle every microsecond. Notice the trade-off: fewer qubits, longer runs. These are alternative designs on paper, not forecasts of when such hardware will exist. What to watch is a credible new estimate that's materially lower than the last one, and how it holds up under independent review: the 2025 and 2026 designs are preprints.
2. Hardware quality: error rates and speed
Raw qubit counts are the least informative number in most announcements. The estimates above depend on error rates and speed. On error rates, the best hardware is now at or near the level they assume, for individual operations: Google's 2024 Willow chip reports average two-qubit error rates of about 0.33% for one type of gate on its error-correction chip and 0.14% for another type on a second chip, and Quantinuum's 2025 Helios reports 99.921% fidelity, an error rate of about 0.08%. What hasn't been shown is that quality across hundreds of thousands of qubits at once. Speed matters too. The estimates assume superconducting-chip speeds; trapped-ion operations are typically hundreds to thousands of times slower, so the same attack on that hardware would need a different design or a much longer run.
3. Error-corrected (logical) qubits
Breaking RSA needs on the order of a thousand or more logical qubits, each built from many physical ones, running billions of operations. This is where the most meaningful progress shows up. In 2024 Google showed errors falling as its error-correcting codes grew larger, the "below threshold" result error correction depends on. Harvard and QuEra ran 48 logical qubits in 2023, and Quantinuum reported 48 error-corrected logical qubits on Helios in 2025. These counts aren't directly comparable: they use different codes and methods, some catch errors without correcting them, and none yet runs the long calculations an attack would need. Roadmaps are part of this indicator: IBM's targets a machine with 200 logical qubits running 100 million operations in 2029. Whether such milestones arrive on time, early or late tells you more than any single announcement.
4. Expert judgement
The Global Risk Institute, a Toronto-based organisation, publishes a Quantum Threat Timeline Report based on a survey of quantum experts, written by Michele Mosca and Marco Piani. Its 2025 edition, published in March 2026, surveyed 26 experts and says their timeline has accelerated compared with previous reports. A survey isn't a forecast you can plan to the year, but the direction it moves between editions is a useful cross-check on the technical indicators.
5. Regulator and standards dates
These don't measure the technology, but they can change what you're expected to do, depending on whom they apply to and whether they bind. NIST's initial public draft transition plan (IR 8547) proposes deprecating quantum-vulnerable public-key algorithms at the 112-bit security level, such as RSA-2048, after 2030, and disallowing the quantum-vulnerable public-key algorithms in NIST's standards after 2035. These are draft NIST dates, not an OSFI deadline for Canadian banks. Canada's federal roadmap and OSFI's 2026 bulletin are summarised in Post-quantum in Canada. A new or moved date is a trigger in itself, whatever the hardware is doing.
6. Your own numbers
How long your data must stay confidential, and how long your migration will take. These belong on the same dashboard as the external indicators. A migration that slips by two years changes your exposure more than most announcements will.
Turning them into key risk indicators
The table below is a starting point that a second-line risk function can adapt. The thresholds are illustrative; what matters is that they're agreed before the news arrives, not after.
| Indicator | Where it comes from | Review | Example trigger for an early review |
|---|---|---|---|
| Resource estimates | Peer-reviewed papers and preprints | Twice a year | A credible estimate that halves the qubits or run time needed for a key size you use |
| Hardware quality | Vendor specifications and peer-reviewed results | Twice a year | Error rates at the estimates' assumed level, shown across thousands of qubits at once |
| Logical qubits | Peer-reviewed experiments and vendor roadmaps | Twice a year | Hundreds of logical qubits running long calculations, or major roadmap milestones met early |
| Expert judgement | Global Risk Institute survey | Each edition | A clear shift towards earlier arrival compared with the previous edition |
| Regulator and standards dates | NIST, Cyber Centre, OSFI, G7 and payment networks | Quarterly | Any new, moved or newly binding date |
| Your own exposure | Data inventory and migration plan | Quarterly | Migration milestones slipping, or new long-lived data entering scope |
These indicators feed the wider re-planning triggers in the banking guide, which also cover weaknesses found in the new algorithms, supplier roadmap changes and major system changes; see A phased roadmap.
An external development is an input, not a risk measure in itself. What turns it into one is a recorded assessment. For each trigger that fires, it helps to record five things: what changed, how strong the evidence is (a preprint, a peer-reviewed paper, an independent replication), which of your systems or data it affects, the decision taken (hold the plan, accelerate a workstream, commission deeper analysis, or re-plan), and who is accountable.
Who does what will vary, but a workable split looks like this. The security or cryptography team watches the sources and writes a short note when something moves. Second-line risk owns the indicators and their thresholds, and challenges the note. The steering committee receives a brief summary on a fixed cycle, with an early report if a trigger fires. Internal audit checks that the process exists and is followed: that reviews happened on schedule, that triggers were assessed, and that each assessment was recorded with its decision.
Reading the next announcement
When a headline lands, map it to the indicators rather than reacting to it as a whole. Four questions do most of the work, and How to read a quantum breakthrough headline covers them in more depth:
- Is this about physical qubits or logical qubits?
- Does it report error rates and speed, and across how many qubits?
- Does it change a resource estimate, or just hardware?
- Has anyone independent checked it?
A record qubit count, a demonstration of "quantum advantage" on a task with no link to cryptography, or a vendor's claim without independent results will rarely move an indicator. A lower resource estimate that survives review, or logical qubits running long calculations, might. In either case the response is a recorded assessment against agreed triggers, not a change of plan by headline.
- Watch resource estimates, error rates, logical qubits, expert surveys and regulator dates; qubit counts alone say little.
- Agree the triggers for an early review before the news arrives, and record each assessment.
- Your own migration time is the indicator most likely to change your exposure.
Sources and further reading
Tags show what kind of source each one is. A standard or government guidance is an official document; a peer-reviewed paper has been checked by other experts; a preprint has not been peer-reviewed yet; an experiment reports a real-world demonstration; a company announcement is the company's own account; vendor documentation is a supplier's own technical guide; expert commentary is a specialist's published analysis or opinion; a news report is a journalist's account. Dates and figures were checked against these sources on 17 October 2026. Spotted an error? Email hello@plainquantum.com and it will be corrected, with a note.
- Peer-reviewed paperCybersecurity in an era with quantum computers: will we be ready?Michele Mosca, IEEE Security & Privacy, 2018
- Peer-reviewed paperHow to factor 2048 bit RSA integers in 8 hours using 20 million noisy qubitsCraig Gidney and Martin Ekerå, Quantum, 2021
- PreprintHow to factor 2048 bit RSA integers with less than a million noisy qubitsCraig Gidney, 2025
- PreprintThe Pinnacle Architecture: reducing the cost of breaking RSA-2048 to 100 000 physical qubits using quantum LDPC codes (version 2, May 2026)Webster et al. (Iceberg Quantum), arXiv, 2026
- PreprintThe Pinnacle Architecture with fixed connectivity of degree eight (about 120,000 qubits on superconducting-style fixed connections)Webster, Peham and Cohen (Iceberg Quantum), arXiv, 2026
- Vendor documentationWillow spec sheet (qubit count, error rates, error-correction cycle time)Google Quantum AI, 2024
- Company announcementIntroducing Helios (98 qubits, 99.921% two-qubit fidelity, 48 error-corrected logical qubits)Quantinuum, 2025
- News reportIBM says new 1,000-plus processors help advance industry toward quantum utility (Condor, 1,121 qubits)The Quantum Insider, 2023
- Peer-reviewed paperTrapped-ion quantum computing: progress and challenges (gate times)Bruzewicz, Chiaverini, McConnell and Sage, Applied Physics Reviews, 2019
- ExperimentQuantum supremacy using a programmable superconducting processorArute et al. (Google), Nature, 2019
- ExperimentQuantum error correction below the surface code thresholdGoogle Quantum AI and collaborators, Nature, 2024
- ExperimentLogical quantum processor based on reconfigurable atom arraysBluvstein et al. (Harvard, QuEra), Nature, 2023
- Company announcementIBM Quantum roadmap (Starling: 200 logical qubits, 100 million gates, planned for 2029)IBM, 2026
- Industry guidanceQuantum Threat Timeline Report 2025Michele Mosca and Marco Piani, Global Risk Institute, 2026
- Government guidanceNIST IR 8547 (Initial Public Draft): Transition to Post-Quantum Cryptography StandardsNIST, 2024
- Government guidanceTechnology Risk Bulletin: Quantum Readiness Phases and TimelinesOffice of the Superintendent of Financial Institutions (OSFI), 2026
- Government guidanceRoadmap for the migration to post-quantum cryptography for the Government of Canada (ITSM.40.001)Canadian Centre for Cyber Security, 2025