Google: The quantum apocalypse is coming sooner than we thought

Google moved the target deadline for migrating to post-quantum cryptography (PQC) to 2029, accelerating the previously aligned NIST timeline of deprecation by 2030 and full disallowance by 2035. Estimates for qubits required to break RSA have fallen from ~20 million (2019) to 1 million (May 2025) and as low as 100,000 in a recent pre-print, increasing urgency. Industry readiness gaps are large: 91% of businesses lack a PQC roadmap, 80% report crypto libraries/HSMs are not ready, 39% have begun PQC assessments, and 61% lack full cryptographic visibility. Enterprises and hyperscalers must prioritize cryptographic inventories, agility, and accelerate PQC migration to mitigate 'store now, decrypt later' risks.

Analysis

The acceleration of PQC planning creates a multi-year demand wave that is not purely software — it flows into hardware (HSMs, secure silicon/TPMs), professional services, and network capacity. Expect a front-loaded capex cycle at cloud providers and HSM suppliers as they field-test hybrid stacks; this will show up first as line-item inventory and R&D spend, then as service monetization in the following 12–36 months.

Second-order winners will therefore be organizations that sell upgradeable, standards-compliant cryptographic plumbing and those with professional services desks able to perform large-scale key rollovers and cryptographic inventory projects; losers include embedded-device OEMs and legacy HSM vendors that require costly redesigns or firmware rewrites. The migration also creates predictable margin pressure for clouds (higher CPU/network overhead, subscription discounts for migration tooling) that can compress gross margins near-term while creating optionality for new security-priced services longer-term.

Key risks: a genuine cryptanalytic breakthrough or a NIST/standards reversal would compress timelines abruptly (weeks–months) and massively re-rate defence-sector and cloud-security exposures; conversely, slower-than-expected enterprise execution or prohibitive performance costs could push adoption beyond a 36-month horizon. Watchable catalysts over the next 3–18 months include hyperscaler PQC SDK/HSM product launches, third-party HSM shipment data, and major enterprise inventory disclosures — these will either validate a revenue ramp or signal adoption stall and a re-pricing event.

Key Decisions for Investors

• Long GOOGL via a 12–24 month call spread (buy 12–24m out-of-the-money call, sell a higher strike) sized 1–2% of portfolio: asymmetric upside if Google captures migration tooling and managed PQC services; defined premium loss if market delays adoption.
• Pair trade — Long GOOGL / Short MSFT (equal notional, 12 months): trade the re-rate if the market singles out a leader in PQC tooling and services. Risk: pair reduces macro exposure; reward: captures relative share shift in cloud security revenue streams.
• Overweight IT (cybersecurity/enterprise IT bucket or ETF) for 18–36 months focusing on HSM, secure-silicon and professional-services vendors: expect mid-teens revenue growth for suppliers that certify PQC stacks; allocate 3–5% of portfolio, expect 2–3x return if adoption accelerates, downside is ~15–25% in a slow-adoption scenario.