MHP survey finds firms racing to prepare for Q-Day

MHP’s survey of 1,060 IT experts shows 86.6% of large German firms and 87.3% of US firms are already taking action on post-quantum cryptography, but only 14.3% and 15.4%, respectively, have completed migration of critical systems. More than half of US respondents (55.2%) and 45.3% in Germany expect Q-Day within five years, while migration timelines of two to five years are common, implying a tight window for action. The main barrier is legacy systems, cited by 33.8% in Germany and 35.0% in the US.

Analysis

The market is underpricing how capital-intensive this migration becomes once it moves from “crypto hygiene” to full-stack remediation. The bottleneck is not the algorithm swap; it is inventory discovery, firmware refreshes, and supplier coordination across years-old infrastructure, which means the revenue opportunity accrues to vendors that sit closer to the control plane than to pure software endpoints. That favors security platforms with asset discovery, identity, key management, hardware roots of trust, and managed services, while exposing firms that sell point solutions without a migration layer.

The second-order winner is likely the consulting/integration ecosystem, but the more durable trade is in infrastructure vendors with recurring upgrade cycles. Enterprises that are late will be forced into compressed spend windows, which tends to pull forward budget into the next 24-36 months and create a “compliance capex” wave rather than a smooth adoption curve. That is bullish for large installed-base vendors that can monetize professional services, but negative for customers with long-tail legacy exposure because they face both higher execution risk and higher switching costs.

The contrarian angle is that the headline urgency may still be too low rather than too high. If a credible quantum breakthrough or regulatory deadline appears, the market could re-rate cyber names with clean exposure and punish laggards in industrials, healthcare, and financials whose data retention and legacy estates are hardest to unwind. The real tail risk is not a single breach; it is staggered disclosure of historical data theft that forces repeated spending cycles and litigation over the next 3-7 years.

Key Decisions for Investors

• Long PANW vs short a basket of legacy-heavy vertical software/industrial names with large data retention needs; thesis is that asset discovery and identity/security platforms monetize the remediation cycle while laggards absorb unplanned spend. Horizon: 12-24 months; target 15-20% relative outperformance if PQC budgets accelerate.
• Initiate a starter long in CRWD or ZS on any broad market weakness, with a 6-12 month view. These names should benefit from endpoint-to-cloud migration spillage and elevated board-level security spend; risk/reward is attractive if the market starts pricing in a multi-year compliance upgrade cycle.
• Buy a call spread on IBM 9-15 months out. IBM has both legacy enterprise relationships and services breadth to capture migration work; upside comes from services attach and consultancy leverage, while downside is limited if adoption remains gradual.
• Pair long FTNT / short a more services-light cybersecurity peer if the market begins rewarding migration-enablement over pure product growth. The edge is in installed-base monetization and enterprise distribution, not just top-line growth.
• Avoid shorting the broad cyber space outright; instead, short exposed legacy data-heavy sectors on pullbacks, especially financials and healthcare IT. If PQC urgency becomes a board-level mandate, these sectors face the most expensive remediation paths and the highest litigation tail risk.