Four Conversations We Keep Having With CISOs About Quantum

Four sentences keep showing up in CISO advisory conversations. They are not the only objections, but they are recurring enough to plan around. Across market conversations, the setting changes but the friction points are familiar. Here they are, and here is what we have learned about answering them.

Conversation One: “It Is Not In The Budget.“

This is the first sentence. It is almost always the first sentence. The CISO is not wrong. Post-quantum cryptography migration is a multi-year capital program, and many enterprise security budgets are set before a new risk theme is fully operationalized. Asking for a new line item mid-cycle can read as bad planning.

The reframe is small and it changes everything. Stop asking for a migration. Ask for a discovery.

A cryptographic inventory is a 60 to 90 day operational exercise. It tells you what algorithms are running in your environment, where they live, what data depends on them, and what your real exposure looks like. It can be scoped as a discovery motion before a full migration program, and it produces something regulators and auditors are increasingly likely to ask for over the next 24 months. The UK National Cyber Security Centre published its migration timeline in March 2025, and the first phase due by 2028 is exactly this: discovery, assessment, and an initial migration plan.

You are not buying a program. You are buying a map. The CISO who walks into the next board meeting with a cryptographic bill of materials looks like a leader. The one who walks in with an estimate looks like a risk.

Conversation Two: “I May Not Be Around In Two Years.“

This one comes up more often than the industry admits. CISO tenure averages somewhere between two and four years depending on which study you read. The job is hard. People burn out, get pushed out, or move up. The honest version of this objection is, “Why should I sponsor a multi-year program when someone else will inherit it?“

Three reasons.

If you really are leaving, the work pays more, not less.

Conversation Three: “Model Security Is My Priority Right Now.“

This one appears constantly in board-facing security discussions. Intelligence-model governance, model risk, model security — these are problems from this morning. Quantum sounds like a problem from 2030. But the cryptographic layer underneath every model is already at risk.

The argument that intelligence-model priorities compete with quantum for attention is backwards. Every model you deploy depends on cryptographic primitives for model integrity, training data confidentiality, and inference authentication. The pipelines that move data into your models are encrypted with the same algorithms a future quantum computer will break. If your model strategy assumes today’s cryptography will hold for the operational lifetime of those systems, you have already made a quiet bet you cannot defend.

The two workstreams are starting to converge. Model security and cryptographic resilience meet in the same control plane. Treating them as separate categories creates a documentation gap when a board, auditor, or architecture review asks which cryptographic dependencies support the model systems leadership is funding.

Run the discovery once. It gives both workstreams a shared evidence base.

Conversation Four: “Nothing Moves In This Company.“

This one appears often in organizations with federal, regulated, or highly committee-driven operating models. The conclusion is that bureaucracy is the obstacle and the obstacle is permanent.

It is not permanent. It is just framed wrong.

Bureaucracies are loss-averse, not progress-averse. They move on the things that get framed as risk, not the things that get framed as opportunity. Right now post-quantum sits in the opportunity column in most companies. New spending. New vendor selection. New training. All of that reads as discretionary, which means it gets deferred.

Move it to the risk column. Add one line to your risk register: cryptographic inventory not performed; exposure unknown; regulatory deadlines beginning 2027. Now the question changes. The question is no longer whether to spend on this. The question is who signs the document saying the company chose not to look.

You do not need to convince your CEO that quantum is real. You need to put the regulatory calendar in front of them and let the calendar do the work.

The federal lesson transfers cleanly. Mandates beat persuasion. CNSA 2.0 sets timelines for national security systems. NSM-10 set the federal trajectory back in 2022. The European Commission published its coordinated implementation roadmap in April 2024. The UK NCSC framework runs through 2035. You do not need to convince your CEO that quantum is real. You need to put the regulatory calendar in front of them and let the calendar do the work.

The One Move That Works In All Four Conversations

You will notice the same answer surfaced in each of these. Not because we are repeating ourselves. Because the answer is the same.

Run the inventory.

Not the migration. Not the program. The inventory. It is small enough to fit inside a quarterly operating motion. It is short enough to finish inside any tenure horizon. It can include the cryptographic dependencies that support the model systems leadership is funding. And it gives your board, your auditor, your successor, and your future self something every other path lacks: evidence.

The CISOs who run it this year will spend 2027 making decisions. The ones who do not will spend 2027 explaining why.

Pick which conversation you want to be having.

Where To Start

If you want to start that inventory this quarter, the lowest-friction path is the QScout Free. Submit a domain. Verify a business email. Receive an initial browser-based executive snapshot after verification. It is an initial artifact for deciding whether a scoped assessment is warranted.

Devil’s Advocate

The honest counter to all of this is that quantum timelines have slipped before and could slip again. A cryptographically relevant quantum computer capable of running Shor’s algorithm at RSA-2048 scale does not exist today. The Google Quantum papers from 2025 and 2026 reduced the resource estimates dramatically, but reduced does not mean built. These estimates remain assumption-sensitive. They depend on error rates, gate fidelity, qubit connectivity, and architectural choices that have not yet been demonstrated at the scale required to break deployed cryptography.

If you run a mid-market organization with no regulated data, no long-shelf-life secrets, no government contracts, no defense supply chain exposure, and no near-term M&A activity, you can probably defer active migration spending until 2027 without career consequences. The discovery exercise still makes sense because it builds the foundation for everything that comes next. But the framing that the sky is falling in 18 months is overstated, and any CISO reading this should push back on it. The real risk in the next 24 months is regulatory and reputational, not cryptographic. Plan accordingly. The math has not changed. The deadline pressure has.