The Most Trusted Skeptic in Quantum Computing Just Told the World to Act. Who Are You Still Waiting to Hear From?

If you have not heard of Scott Aaronson, here is what you need to know before you read another word.

Aaronson is the Schlumberger Centennial Chair and Founding Director of the Quantum Information Center at the University of Texas at Austin. He later spent two years working on model safety. He won the ACM Prize in Computing. He invented BosonSampling, PostBQP, and shadow tomography. He sits on Coinbase’s evidence-led advisory team for quantum computing and blockchain alongside Stanford’s Dan Boneh, the same Dan Boneh who co-authored the Google Quantum paper showing that elliptic-curve cryptography may break under significantly fewer qubits than previously estimated.

What makes him important is the tagline at the top of his blog, which has been there since 2005: quantum computers will not solve hard problems instantly by just trying all solutions in parallel. For two decades, Aaronson has been one of the field’s most conservative voices, telling the technology industry to calm down about quantum hype.

On April 28, 2026, Aaronson was elected to the United States National Academy of Sciences. On April 29, less than twenty-four hours later, he published a blog post titled ”Will you heed my warnings NOW?“

What He Said

The post opens with the NAS news. Then it pivots. Aaronson writes that some of the most reputable people in quantum hardware and quantum error correction, people whose judgment he trusts more than his own on those topics, are now telling him a fault-tolerant quantum computer capable of breaking deployed cryptosystems should be possible by around 2029.

He hedges, briefly. Maybe they are overoptimistic. Maybe it will take longer. Then he stops hedging: the companies racing to build fault-tolerant quantum computers have no plans to slow down to give cybersecurity time to adapt.

Aaronson then writes the line that matters. He tells readers ”this post is your warning” and instructs them to start switching to quantum-resistant encryption and to urge their company, organization, blockchain, or standards body to do the same.

Why This Matters More Than Any Other Voice

The cybersecurity industry has spent the last several years collecting warnings about post-quantum risk from interested parties: vendors, standards bodies, hardware companies, and government agencies. Every one of those voices is dismissible by a sophisticated CISO who wants to dismiss them.

Aaronson does not fit those categories. He is not selling a PQC migration product. His professional identity and reputation are built on the position that quantum computing claims should be approached with extreme rigor and skepticism.

He published the warning on the day after his election to the National Academy of Sciences. That timing makes the post a material signal for security leaders watching the field.

When the most rigorous skeptic in your field tells you to act within twenty-four hours of his election to the most prestigious scientific body in the country, the question is no longer whether to listen. The question is who you are still waiting to hear from.

The Wait-And-See Case Is Harder To Defend

For organizations still in a wait-and-see posture on post-quantum cryptography, the typical defense has been some version of ”we will act when the experts agree the threat is real.“ That defense has been getting harder to sustain as technical, standards, and policy signals converge.

What This Year Looks Like

For most organizations with long-lived sensitive data, regulated obligations, or public-sector exposure, the first serious move in 2026 is the same. You need a cryptographic inventory.

Without an inventory, migration plans are difficult to fund, risk assessments are difficult to defend, and procurement attestations are difficult to support. Most serious 2026 deliverables begin there.

That is what QScout was built to produce: external cryptographic exposure, an HNDL signal, a migration signal, and an external risk grade. If the signal is material, a scoped assessment can produce CBOM-style inventory, framework mapping, timeline modeling, and a board-ready evidence package.

Where To Start Today

If you are a security leader, start with a QScout public intake. It can provide an initial evidence point for budget, audit-prep, or board-risk conversations without pretending an external scan is a complete internal cryptographic inventory.

If you are forwarding this to a colleague who is still on the fence, send it with one sentence: a leading long-time skeptic in quantum computing just told the world to act.

Devil’s Advocate

A skeptical reader could argue that Aaronson is one voice, that his timing assessment is hedged, and that he himself acknowledges he is not a timing person. They could argue that the warning, while striking in its source, does not contain new technical information. The Google paper. The Caltech paper. The vendor responses. All of that was already public. Aaronson is interpreting, not reporting.

That is fair. It is also why the piece is significant rather than dispositive. Aaronson did not break news. He told the cybersecurity industry that, in his judgment, people inside quantum hardware whose technical opinions he trusts now believe the migration window is shorter than the last public consensus suggested.

For organizations whose data has a confidentiality horizon beyond 2030, the operational answer does not change either way. Cryptographic inventory is the prerequisite to every migration plan, procurement attestation, audit response, and insurance renewal.