Notes from the
evidence side of quantum.

The post-quantum conversation gets distorted by timeline arguments: when does a cryptographically relevant quantum computer arrive, and is it five years out or twenty? It is the wrong question to plan around. Under harvest-now, decrypt-later, an adversary records encrypted traffic today and decrypts it whenever the capability lands. So the exposure that matters is set now, by the shelf-life of the data — not by a date on a roadmap.

That reframes prioritization into something you can act on without predicting the future. Inventory what you protect, mark how long each secret must hold, and migrate the long-lived ones first — long-retention records, root keys, firmware-signing keys — toward the finalized NIST standards (FIPS 203 ML-KEM for key exchange, FIPS 204 ML-DSA and FIPS 205 SLH-DSA for signatures). Build crypto-agility so the next swap is configuration, not re-engineering. A secret that must stay confidential for a decade is already inside the window; the headline date is a distraction from that fact.

Most quantum roadmaps mix two kinds of statements, and the trouble starts when readers treat them as one. The first kind is falsifiable: a qubit count, an error rate, a milestone with a date you could later check. The second is decorative: "transformative," "industry-leading," a logarithmic curve bending toward an unspecified breakthrough. Decorative claims are not lies — they are just not evidence. The first thing we do with a roadmap is sort every line into one bucket or the other.

Then we read the falsifiable lines against what they cost. Raw qubit count means little without an error rate and a notion of logical qubits; a demo means little without the problem size and whether a classical machine still does it faster. We weight past milestones the team actually hit over future ones they merely drew, and we treat a precise "not yet" as more credible than a confident "soon." A roadmap that hides its assumptions is not bullish — it is unreadable, and unreadable earns Require further diligence, not the benefit of the doubt.

Defense and dual-use buyers live with a specific failure mode: a genuine laboratory result gets read as a near-fielded capability, and a procurement decision rides on the difference. Technology Readiness Levels exist to stop exactly this, but only if applied honestly. A breakthrough at TRL 3 or 4 — validated in a controlled setting — is real and is also years and several un-de-risked steps away from a system that works in the field, at scale, under adversarial conditions. Conflating the two is the most expensive mistake in the category.

TRL-honest diligence means stating the level plainly, citing the evidence that supports it, and naming what each further level demands rather than assuming it follows. It means flagging where dual-use framing borrows credibility from a defense context the result has not actually earned. The honest output is often Monitor — promising, worth tracking, not yet deployable — and saying so is the value, not a hedge. A grade that rounds TRL up to please the reader is worse than no grade at all.