Building the PQC Business Case
Quantify costs, model ROI, and build compelling investment cases for post-quantum cryptography migration.
Why this matters: Migration competes with everything else for budget; a quantified harvest-now-decrypt-later case is how PQC wins the funding.
Start here: Set systems in scope, IT budget, complexity and planning horizon with the sliders in the Cost Model Explorer: five costing methods price the same migration and the spread between them is shown.
For your role
- Executive / Business Leader
- See the six costing models diverge on one scenario, calculate the ROI, simulate breach costs today against quantum-enabled breaches, model the cost of delay and assemble the board brief: the funding case in five steps.
- Researcher / Academic
- The six costing models are stated with their assumptions and the breach simulator cites its baseline; the comparison shows how far estimates diverge on the same inputs.
Why Build a PQC Business Case?
migration is not just a technical initiative — it requires significant organizational investment. A well-constructed business case translates technical risk into financial language that executives and boards understand.
“Organizations that delay PQC migration face compounding costs: rising compliance penalties, increasing breach exposure from harvest-now-decrypt-later attacks, and the growing technical debt of maintaining legacy cryptographic systems.”
— Industry consensus from NIST, CISA, and leading CISOs
Without executive buy-in and adequate funding, PQC migration stalls. The business case bridges the gap between technical teams who understand the urgency and decision-makers who control budgets.
The Two Time-Bound Quantum Risks
A credible business case names two distinct, already-running risks — not one. They hit different systems, on different clocks, and they map to the two parallel migration tracks a program runs. Framing only the data-confidentiality risk leaves the signature-forgery half of the estate — and whole sectors like OT, PKI operators, and code-signing shops — out of the argument.
Adversaries capture encrypted traffic today and store it to decrypt once a quantum computer exists. The risk is active now — any data whose confidentiality must outlast the quantum threat horizon is already exposed.
Migration Track A: key exchange & confidentiality (TLS, VPN, data-at-rest).
Long-lived signatures and trust anchors signed today stay trusted for years. Once a quantum computer can forge them, an attacker can mint trusted software updates, certificates, or firmware. Signature migration has the longest lead times (PKI, toolchains, HSMs), so it must start in parallel — not after HNDL.
Migration Track B: signatures, PKI & authentication.
The decision point: data with a 10+ year confidentiality requirement in a regulated industry means HNDL alone justifies immediate action; where signature integrity is the primary risk (OT/ICS, PKI operators), TNFL drives the urgency on a different set of systems. Most enterprises carry both and therefore run both tracks at once.
Key Financial Concepts
Building a compelling case requires fluency in three financial frameworks that executives use to evaluate technology investments:
The complete cost of migration including software, hardware, training, consulting, downtime, and ongoing operational changes over the full lifecycle.
Return on investment weighted by the probability and magnitude of quantum-enabled breaches, regulatory fines, and competitive disadvantage from inaction.
Translating technical quantum risk into business language: revenue impact, market position, regulatory exposure, and fiduciary responsibility.
PQC Migration Cost Categories
PQC migration costs span four major categories. Each must be estimated and presented alongside the cost of not migrating:
- • Software upgrades and license fees
- • Hardware replacements (HSMs, accelerators)
- • Staff training and certification
- • External consulting and integration
- • Testing and validation effort
- • HNDL attack exposure (data already at risk)
- • Per-record breach costs (industry-specific)
- • Historical data retroactive exposure
- • Reputational damage and customer loss
- • Regulatory fines (GDPR, HIPAA, PCI DSS)
- • Government contract eligibility (CMMC, FedRAMP)
- • Industry mandate deadlines (CNSA 2.0, ANSSI)
- • Audit and remediation costs
- • Reduced operational complexity (crypto agility)
- • Market differentiation and trust signaling
- • Insurance premium reductions
- • Vendor and partner ecosystem alignment
Sizing the Spend: Eight Cost Drivers
Don't wait for precise numbers — estimate each cost driver separately and refine as discovery matures. A multi-year PQC budget breaks into eight categories:
Crypto-discovery platforms plus deployment, integration, and ongoing licenses.
Usually the largest category — PQC talent is scarce and commands premium rates.
Often a step change rather than a line item: price HSM firmware upgrades and any PQC feature licences with your own vendor, per module, before assuming a number.
Older HSMs may not support PQC key types; 6–12 month procurement lead times.
CA upgrades, automated certificate lifecycle, root-CA ceremonies — needed regardless of PQC.
CPU, memory, bandwidth, and storage increases from larger keys and signatures.
Production-mirror environments to validate before rollout.
QRPM, PMO tooling, SteerCo facilitation, training, compliance tracking, board reporting.
Combine independently justified investments — PKI automation for short certificate lifetimes, FIPS 140-3 upgrades for the FIPS 140-2 sunset, HSM refresh for end-of-life hardware, library upgrades for CVEs — into a single “cryptographic infrastructure modernization” program. Positioning PQC as the organizing wrapper for overdue security modernization avoids a big-bang budget spike and aligns spend to already-funded refresh cycles.
- • The only large-scale PQC migration cost figure published by an accountable body is the U.S. federal civilian estimate: $7.1B for 2025–2035 (OMB, Report to Congress). It was built bottom-up from agency cryptographic inventories — which is why it is quotable and most vendor figures are not.
- • Beware round numbers with no owner. Per-organization PQC program costs circulate widely (“$2–5M for discovery”, “$300–500M for a global telco”) and almost none of them trace to a published methodology. If you cannot name whose board approved a number, do not put it in front of yours.
- • Derive your own instead: count the assets you actually have (certificates, HSMs, applications, third-party integrations), price one representative unit of each with your own vendors, and multiply. The Cost Model Explorer in Step 1 does this across six model families so you can see the spread rather than a single number.
Present gross program cost and net incremental cost separately — much of the spend is modernization you needed anyway. And state which method produced each figure; a board can challenge a method, but it cannot challenge a number from nowhere.
Choosing a Costing Model
No published methodology yet gives a reliable top-down total for a full PQC migration — the field has too few completed programs to calibrate against. The defensible move is to estimate the same program in more than one way and treat agreement between methods as confidence, and divergence as a signal to dig deeper. Six model families are in use — the workshop's Cost Model Explorer (Step 1) lets you watch them diverge on one scenario:
Top-down: a share of IT or security budget, or a per-asset unit cost (per certificate, per HSM, per application). Fast sanity check on any bottom-up total.
Sum costs per phase and per asset class. The U.S. federal estimate — $7.1B for 2025–2035 — was built this way, aggregating agency-level cryptographic inventories (OMB).
Put distributions on the uncertain drivers and simulate to a confidence band (P10/P50/P90) instead of a single number. Best where the drivers are genuinely uncertain and a single point estimate would be false precision.
Expert-elicited optimistic / expected / conservative columns. Cheap, honest about uncertainty, and legible to a board.
Calibrate against prior cryptographic transitions — SHA-1→SHA-2, TLS 1.3, Y2K — adjusting for PQC’s larger keys and longer-lived assets.
The benefit side: annualized loss expectancy (impact × likelihood) plus harvest-now-decrypt-later exposure scored by data longevity, sensitivity, and current crypto strength.
Under deep uncertainty, cross-checking a bottom-up buildup against an independent second estimate is stronger than precision within any single method. The workshop's ROI Calculator does this for you: it reconciles your per-product estimate against an independent assessment-derived one and flags when the two disagree — still pair the result with your finance team's discounted-cash-flow model before committing capital.
- • Full migration runs 5–7 years (small), 8–12 (medium), and 12–15+ (large enterprises) — against a fault-tolerant quantum window of 2028–2033 (Campbell, Computers 2026, 15(1):9, peer-reviewed).
- • Mosca's inequality (X + Y > Z): if migration time (X) plus data secrecy shelf-life (Y) exceeds time-to-quantum (Z), you are already late — the arithmetic, not a Q-Day prediction, is what justifies starting now.
- • The hardest cost driver is legacy systems with cryptography hardwired in hardware or firmware — the OMB report attributes a significant share of the federal total to replacing exactly those.
Benefit Arguments That Strengthen the Case
Beyond avoiding the two quantum risks, four arguments turn a defensive ask into a positive investment case:
A quantum-focused inventory surfaces deprecated TLS, weak keys, expired certs, and CVE-laden libraries you can fix now — making the discovery spend self-funding on classical grounds alone.
A documented CBOM, risk assessment, and roadmap signal proactive risk management to regulators and can smooth supervisory review of new products.
Quantum readiness is increasingly a procurement criterion; demonstrable PQC infrastructure wins bids that laggards cannot answer.
PQC and crypto-agility work is frontier engineering — a serious program is a recruiting and retention asset in a scarce-skills market.
Workshop: Build Your Business Case
The workshop guides you through five steps to create a complete, data-driven PQC investment case:
See how the six costing models diverge on one scenario — build the instinct not to trust any single number.
Score migration cost, breach avoidance, and compliance, then cross-check the total against your assessment.
Model the financial impact of classical vs. quantum-enabled breaches with industry-specific cost data.
Quantify the compounding cost of delaying migration — breach risk, complexity premiums, and penalties over five years.
Assemble a professional board memo, populated from the previous steps’ outputs.
Related Resources
Calculate ROI, model breach scenarios, and build a board-ready investment case.
Check your understanding
11 questions on PQC Business Case, each with its answer and the reason.
Take the quizNext step
Produce the artifact: ROI CalculatorThis module belongs to phase 0 (Executive Mandate); ROI Calculator produces a deliverable of that phase in the Command Center.
Learning module content can be inaccurate. Please double-check its information. Report inaccuracies in PQC Today GitHub Discussions.