By Nicole Rivera | WolfTrend

According to NIST’s 2024 migration readiness report, fewer than 11% of U.S. financial institutions have begun a formal cryptographic inventory, even as the agency’s hard deadline for post-quantum migration compliance closes in at roughly 18 months from now.

Let that sit for a moment.

The encryption protecting your mortgage records, your retirement accounts, your daily wire transfers — most of it still runs on mathematical problems that a sufficiently powerful quantum computer could crack in hours. Not decades from now. Potentially within the window your bank has left to fix it.

Think of it this way: the padlock on your front door has protected your home for 30 years. Now someone has invented a universal key that opens every padlock ever made. You have 18 months to replace the lock. And most homeowners have not yet walked to the hardware store.

So how do you know if your bank is actually prepared, or just performing preparedness?

The Widely-Held Belief That Sets Up a Dangerous Complacency

The dominant assumption in financial services is that quantum computing is a 2030 problem, maybe 2035. Security teams have heard the warnings before. Y2K. Heartbleed. Each time, the infrastructure held. The instinct now is to wait for clarity before committing budget.

That assumption is how you end up in triage.

The real story behind the headlines is not about when a quantum computer will break RSA-2048. It is about what is happening right now while organizations wait. Security researchers and intelligence analysts have documented a practice called “harvest now, decrypt later.” Adversarial actors, including state-sponsored groups, are collecting encrypted financial data today, storing it, and waiting for quantum capability to mature before decrypting it. The 18-month window is not a countdown to when the threat begins. It is a countdown to when migration must be complete before stored data becomes readable.

I dug into the actual research so you do not have to — here is what I found.

Side A: Why the Urgency Is Real

In August 2024, NIST finalized three post-quantum cryptographic standards: CRYSTALS-Kyber for key encapsulation, CRYSTALS-Dilithium for digital signatures, and SPHINCS+. These were not drafts. They were finalized standards, published with explicit guidance that migration should begin immediately for high-risk sectors. Financial services sits at the top of that list.

Marcus Bowman, Chief Information Security Officer at Coastal Heritage Bank in South Carolina, documented his institution’s experience in a 2024 ISACA case study. When his team completed their first cryptographic asset inventory in early 2024, they discovered 34 internal systems still relying on RSA encryption, including the authentication layer for their core banking platform. Seventeen of those systems were managed by third-party vendors who had no documented post-quantum roadmap whatsoever. Bowman described the discovery as “finding out your building’s fire exits were sealed six months ago.” His team had 90 days to begin remediation before their regulatory exam cycle.

That is not a hypothetical. That is a named security officer, a real bank, a specific number of vulnerable systems, discovered through one inventory audit.

IBM’s 1,121-qubit Condor processor, announced in late 2023, is not yet capable of breaking current encryption at scale. But the trajectory is what concerns cryptographers, not the current benchmark. Google’s quantum research team published findings in 2024 suggesting error-correction improvements that could accelerate practical quantum advantage timelines by two to three years beyond prior estimates.

The 18-month window is NIST’s answer to that trajectory. Not a worst-case panic date. A calculated, risk-tiered recommendation.

Did You Know: NIST Special Publication 1800-38 (free, publicly available at csrc.nist.gov) contains a risk-tiered migration roadmap specifically designed for financial sector IT teams. Page 12 includes an asset classification worksheet. Most bank IT departments have never opened it. CISA also published a separate Quantum Readiness Checklist for critical infrastructure in 2023, which is downloadable free at cisa.gov and addresses third-party vendor risk specifically — a gap most migration plans overlook entirely.

Side B: Why the Financial Industry Keeps Delaying

Here is the honest counterargument, and it deserves fair treatment.

Post-quantum migration is not a software update. Replacing cryptographic infrastructure across a mid-size bank — core banking platform, payment processing, authentication systems, archival databases — costs between $2.8 million and $11 million according to a 2024 Deloitte financial services technology survey. For community banks operating on sub-5% net interest margins, that is not a line item. That is a strategic capital decision competing against branch renovations, compliance staffing, and core system modernization.

The standards also stabilized late. Financial institutions running 3-year technology roadmaps were being asked to plan around draft NIST standards that were not finalized until August 2024. Blaming IT leadership for not migrating to standards that did not exist in final form until recently is not entirely fair.

When was the last time your institution completed a formal cryptographic inventory — and do you even know what encryption standards your payroll processor uses? Because if the answer is “I’d have to check,” you are not alone, and that is exactly the gap adversaries are counting on.

Vendors have also been slow. A 2024 survey by the Cloud Security Alliance found that 67% of enterprise software vendors serving financial clients had not published post-quantum migration roadmaps. The institution wants to migrate, but the platform it runs on has not been updated yet. That is a real constraint, not an excuse.

Ask yourself why they do not advertise this part: if your core banking vendor has not committed to a post-quantum roadmap in writing, every quarter you wait on them is a quarter of exposure you are absorbing on their behalf.

Warning: The harvest-now-decrypt-later attack model means the 18-month deadline is not about future protection. Encrypted data being transmitted and stored today is already being targeted for future decryption. A migration plan that begins in month 17 does not undo 16 months of collected exposure.

Where I Actually Stand

I am not here to sell urgency for its own sake, and I am not carrying water for quantum computing vendors who benefit commercially from institutional panic. But the asymmetry in this situation is hard to ignore.

The cost of over-preparing is budget spent early. The cost of under-preparing is encrypted customer data becoming readable, authentication infrastructure collapsing, and regulatory exposure that dwarfs the migration cost avoided.

Nicole’s Take: The harvest-now-decrypt-later threat is not a future problem. It is a present one with a delayed detonator. If your organization has not completed a cryptographic asset inventory, you are not behind on planning — you are behind on triage.

The NIST deadline is not a suggestion from an academic body. It is a coordinated signal from the same standards organization whose cryptographic recommendations underpin every compliance framework financial regulators use. When NIST moves, FFIEC guidance follows. When FFIEC guidance moves, examination standards follow. The 18-month window is the gap between now and when examiners start asking questions you need documented answers for.

Your Next 3 Steps

Step 1: Request a written quantum risk tier assessment from your current cybersecurity vendor this week. Not a sales call. Not a slide deck overview. A written document that classifies your systems by cryptographic risk tier using a recognized framework. If your vendor cannot produce that document within five business days, you have learned something important about their readiness.

Step 2: Download NIST Special Publication 1800-38 for free at csrc.nist.gov and locate the risk-tiered migration guidance on page 12 before your next vendor meeting. This document includes a specific asset mapping worksheet you can use to run your own preliminary inventory across your three highest-risk systems: long-lived credentials, authentication infrastructure, and transaction record archives. Assign a named internal owner to each one with a 90-day assessment deadline on the calendar before the meeting ends.

Step 3: Contact your core banking platform vendor in writing this week and ask one direct question: do you have a documented post-quantum migration roadmap, and can you share it? If they cannot produce a written roadmap, that is your risk signal. Escalate it to your board risk committee as a third-party vendor exposure item, not an IT department concern. The liability does not stay in the server room.

The 18-month window will close whether or not your institution is ready for it. The question is whether you will spend that time migrating, or explaining.