Towards a Quantum Risk Index: a risk-based framework for prioritizing Post-Quantum Cryptography Migration

Sakshyam Panda, Debasish Jena, Iakovos Pittaras +7 more

Ali Qureshi

Mangesh Gharote, Pankaj Sahu, Shubhro Roy +4 more

The advent of quantum computing poses significant challenges to classical cryptography and is a threat to secure communication protocols. This has created an urgent need to migrate networked applications to post-quantum cryptography (PQC). Enterprises operating large-scale networks must migrate thousands of applications that rely on cryptographic primitives, each requiring distinct remediation strategies and varying effort. Applications with higher risk profiles must be prioritized. However, budget limitations, skilled-resource availability, and application dependencies make PQC migration planning a challenging task. In this paper, we propose an optimization model that generates a migration plan for enterprise applications, determining which applications should be migrated in each time frame and in what order, such that the overall quantum risk exposure is minimal. We demonstrate the implications of delayed application migration on overall effort estimation and quantum risk exposure as well as the impact on application prioritization due to budget limitations and resource availability.

Marcin Niemiec, Miralem Mehić, Miroslav Vozn̆ák

Khadija Taki

Quantum computing creates a governance problem before it creates a cryptanalytic event. Information collected today may remain sensitive after a cryptographically relevant quantum computer becomes available, while long-lived operational technology and spacecraft may be unable to adopt new cryptography within conventional replacement cycles.This paper examines how operators of long-lived cyber-physical systems should prioritize post-quantum migration under uncertainty. It distinguishes the present confidentiality risk of harvest-now, decrypt-later collection from the prospective integrity and authentication risks that could follow scalable attacks against public-key cryptography.Building on Mosca's migration inequality, the paper introduces the Quantum Migration Priority Score, a transparent decision framework combining timing pressure, consequence, adversary exposure, and cryptographic agility. Illustrative applications to municipal water systems and proliferated low-Earth-orbit architectures demonstrate how migration priority depends on mission consequences, protocol boundaries, key management, supply-chain dependencies, and compensating controls.The paper concludes with a staged governance strategy centered on cryptographic inventories, crypto-agile procurement, testable migration pathways, accountable risk ownership, and explicit management of residual risk.

Yaser Baseri, Vikas Chouhan, Ali Akbar Ghorbani +1 more