My Articles, Opinions and Analyses
Key Ceremonies: What They Are, What Good Looks Like, and What PQC Changes
A key ceremony produces the main evidence that a CA key was generated correctly. What the rules require and miss, what a good ceremony looks like, the skills it needs, and what PQC changes ...
I Rebuilt My Free PQC Readiness Assessment on the PQC Migration Framework v3.0
My PQC readiness scorecard now rates seven domains on the PQC Migration Framework's 0 to 5 scale and takes the weakest as your readiness level. It also lists your regulatory deadlines. Your answers never leave your browser ...
I Rebuilt the PQC Migration Advisor With 63 Algorithms, 18 Protocol Families and 20 Jurisdictions and Regimes
With version 2.0 of my free PQC Migration Advisor, you can compare your migration estimate with your earliest regulatory deadline and export a sourced, four-tier action plan as a PDF, CSV or Markdown file ...
Supervisors Can Measure a Sector’s Cryptographic Exposure Without Collecting Anyone’s Inventory
Under the EU's Cyber Resilience Act, authorities may collect software inventories before anonymizing them. Supervisors measuring cryptographic exposure can skip that step, with federated queries, secure aggregation and private set intersection run against each firm's own CBOM ...
Michael Saylor’s Quantum Claims About Bitcoin, Checked
Strategy's executive chairman says Bitcoin should wait for a quantum threat before upgrading. Its upgrade record, its draft proposals, the arithmetic of block space and his company's own SEC filings all say otherwise ...
PQC for MSSPs and Consultancies: Opportunity and Risk
Post-quantum migration will keep security consultancies and MSSPs busy for a decade, but the revenue is in PKI, legacy systems, vendors and governance, not in scans. Clients will also check each provider's own cryptography before they buy ...
Crypto-Agility for Digital Assets: Chains Are Planning One Post-Quantum Change When They Will Need Several
Zcash replaced a flawed proof circuit and sealed a pool then worth $1.7 billion within 60 days. Bitcoin and Ethereum are planning one post-quantum change. Crypto-agility means a chain can change its cryptography again, and retire what it replaced ...
Crypto-Agility Is the Goal. The PQC Migration Is Only Its First Test.
Post-quantum algorithm choices are already changing: a NIST candidate was withdrawn the day after an attack went public, and BSI advised against Classic McEliece in new developments. Build a crypto-agility program and make the PQC migration its first test ...
Clients Kept Asking Us to Train Their Teams, So I Started Quantum Academy
Applied Quantum has delivered hundreds of hours of private training, from board briefings to hands-on technical work. Quantum Academy moves that teaching into a separate company, with practitioner instructors, proctored exams and a flagship program for Chief Quantum Officers ...
What Quantum Computers Are For: A Mathematician’s Map of Quantum Advantage
The mathematician's answer to what quantum computers are for: three problem families where the advantage is real, the theorems that cap combinatorics at quadratic, and the open problems stated in your notation ...
Quantum Computing for Mathematicians: From Four Axioms to Shor’s Algorithm
Everything a mathematician needs to understand quantum computing: the four axioms, why "trying all answers at once" is wrong, how interference powers Shor and Grover, and where mathematicians are needed next ...
Several Vendors Now Supply Quantum Error Correction’s Classical Loop. The Qubits Are Still the Hard Part.
Riverlane, Qblox, Altera, Xanadu, AMD, NVIDIA and IonQ spent September turning error correction's classical loop into parts with published interfaces and measured latencies. What they tested, on what data, and how I now read fault-tolerance timelines ...
Paying for AI’s Data Centers Would Take 250 Million Jobs. America Has 159 Million
In 2020 I co-wrote that AI itself would become a commodity. Six years and $1.5 trillion of data centers later, I convert the build-out's revenue needs into jobs and ask how much of AI's value its makers must keep ...
Nobody Checked the Physics: How Venture Due Diligence Went Missing Where the Checks Are Largest
On Carta's platform the median startup waits 774 days for a Series A. The hottest deep-tech deals close in days on no product. Between those numbers is where nobody can see the physics checked, and quantum is paying for it ...
One Quantum Threat, Many Migrations: How and Why PQC Programmes Are Diverging Around the World
Fresh from GISEC in Dubai and ahead of a keynote in Maryland: the same quantum threat is being managed very differently across the US, Europe, the Gulf and Asia, and each migration has produced something the others could use ...
Data Centers in Space Don’t Work. Quantum AI Data Centers in Space Are an Absurdity.
An investor asked me to evaluate a pitch for quantum AI data centers in orbit. The physics, the engineering, and the economics all say the same thing: no ...
Every Headline RSA-2048 Estimate Assumes Qubits That Work. A Sydney Team Measured What Happens When They Don’t.
On a single IBM chip, a distance-5 surface code lost to a distance-3 even after the defective components were routed around. The headline estimates of what breaking RSA-2048 takes assume they all work ...
PQC Migration Framework v3.0: Build the Ability to Change Again
Crypto-agility is now the method, and the PQC migration is the first exercise of it. The program closes when the organization can change algorithms on a date it chooses. Two companion frameworks publish alongside version 3.0 ...
Alignment Is Whether AI Wants to Kill Us. Cybersecurity Is Whether We Let It.
The people who build frontier AI ask how a model could ever take power. The July 2026 intrusions answered the first step and half of the second. The rest run through controls organisations already own and already fail at ...
Google’s Multiverse Claim Was a Serious Argument Attached to the Wrong Experiment
Google attached a serious interpretation of quantum mechanics to a benchmark every standard interpretation predicted, and whose headline run was never directly verified. Ten months later the same lab kept the interference and left the metaphysics out ...
Regulators Can Inspect a Cryptographic Inventory Without Taking a Copy. The Rules Were Written for Weapons Inspectors.
Supervisors can test a firm's cryptographic bill of materials in place with managed access, inspector-chosen samples, yes-or-no tests and the IAEA's defect classes, while the inventory itself stays with the firm ...
Everything Called a Decoder in Quantum
A syndrome decoder has to keep pace with a microsecond syndrome stream. A syndrome decoding problem has to stay infeasible forever. Same two words, opposite requirements, and coverage that routinely cannot tell them apart ...
The GSMA’s Telco Quantum Playbook Misreports the McKinsey Report It Cites
A trade body published a vendor-contributed document, and the one exhibit anyone could verify turned out to misreport the report it names. What that costs the operators who will quote it in board papers ...
Proving Your Crypto Inventory Is Complete Without Handing Over the Map
Four research teams have built privacy-preserving validation systems for bills of materials. Each can prove something about a committed record, and none establishes that the record describes the estate it claims to cover ...
