Table of Contents
June 23, 2026 – The World Economic Forum released its Top 10 Emerging Technologies of 2026 report on June 23, 2026, at the Forum’s Annual Meeting of the New Champions in Dalian, China. The report includes two quantum-related entries: quantum simulation for drug discovery, listed eighth, and lattice-based cryptography, listed tenth.
Produced in collaboration with the scientific publisher Frontiers, this is now the report’s 14th edition. This year’s methodology replaced the expert survey used in previous editions with an AI-assisted nomination workflow that generated and refined more than 1,200 candidate technologies before expert consultations and an Advisory Council reduced the field to ten. The full list spans energy, materials, health, and computing, from everything-to-grid energy and PFAS destruction to personalized mRNA cancer vaccines.
Two out of ten is a strong showing for quantum. By my review of the WEF archive, this appears to be the first edition with two quantum-related entries (single entries appeared in 2017 and 2020). And the pairing is telling: one entry addresses what quantum computers will do (simulate molecules), the other addresses what we must do before they arrive (replace quantum-vulnerable public-key cryptography). That framing, whether intentional or not, mirrors the dual reality I cover every week on this blog.
My Analysis
The Good
The WEF report gets the big picture right. On the cryptography side, it names harvest-now-decrypt-later correctly, identifies the threat, and states plainly that the response is already under way. The deadlines are all there: the EU’s 2026 start date for quantum-safe migration, the NSA’s January 2027 requirement for all new national security system acquisitions, NIST’s standardization with ISO and ETSI alignment, SWIFT’s active migration planning, and Google’s commitment to complete its own transition by 2029. For a general audience encountering this topic for the first time, the core message comes through: encrypted data is being harvested today, the replacement cryptography exists, and institutional deadlines are driving adoption.
On the quantum simulation side, the broad thesis is similarly accurate. Drug development has a nine-in-ten failure rate in clinical trials. Classical computers approximate molecular behavior by reducing complexity, which introduces errors. Quantum simulation models molecular interactions using the same quantum mechanics that govern the molecules themselves. The supporting evidence is well chosen: the IBM and Moderna collaboration, the Pasqal and Qubit Pharmaceuticals partnership backed by the Wellcome Trust, and the observation that hybrid quantum-classical architectures are the bridge until fault-tolerant machines arrive.
Both technologies making the list sends a useful signal to the CISOs, CTOs, and policymakers who read WEF reports. Quantum is shaping how medicines will be designed and how data will be protected, and both transitions are happening now.
The Factual Errors
The lattice-based cryptography section contains a clear factual error. The WEF authors write that NIST “spent two years evaluating competing approaches to post-quantum encryption before finalizing its standards in 2024.” NIST’s PQC standardization ran for roughly eight years, from the project launch and 2016 call for proposals through the finalization of FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA) on August 13, 2024. NIST received 82 submission packages, accepted 69 first-round candidates, and involved 278 submitters from 25 countries. The selection of four initial algorithms occurred in July 2022, more than five years into the process. Even if the WEF authors intended to reference only the final standardization phase from draft to final publication, that period was roughly one year (August 2023 to August 2024), not two. The WEF’s own endnote for this claim links to NIST’s August 2024 announcement, which describes the full timeline.
This matters because the duration of the evaluation is part of the credibility argument. When I advise organizations to trust the NIST-selected algorithms, the eight-year open competition with multiple rounds of public cryptanalysis is the reason. Compressing that to “two years” understates the rigor.
A second error appears in the quantum simulation section, where the WEF describes the IBM and Moderna work as the “largest protein folding and mRNA simulation run on a quantum computer.” The underlying 2024 study is mRNA secondary-structure prediction formulated as a combinatorial optimization problem. No protein folding was performed. The distinction matters: protein folding and mRNA secondary-structure prediction are different computational problems with different resource requirements. The WEF conflates them.
One more: the strategic outlook recommends that developers “implement hybrid classical-quantum cryptography in all new systems.” The correct term is hybrid classical/post-quantum cryptography. Both the classical and the PQC algorithms are classical cryptographic constructions running on classical hardware. “Quantum cryptography” refers to technologies like quantum key distribution, which is an entirely different approach.
The Framing Problem
The larger issue with the cryptography entry is its title: “lattice-based cryptography.” This narrows the entire field of post-quantum cryptography (PQC) to a single mathematical family.
Two of the three NIST standards finalized in August 2024 are indeed lattice-based: ML-KEM (FIPS 203) for key establishment and ML-DSA (FIPS 204) for digital signatures. But the third, SLH-DSA (FIPS 205), is hash-based, and it was selected precisely to provide a fallback that does not depend on lattice assumptions. HQC, selected by NIST in March 2025 as a backup key encapsulation mechanism, is code-based. In May 2026, NIST advanced nine additional signature candidates to a third evaluation round, and several of them use non-lattice mathematics. The entire design of the PQC standard portfolio is built around not putting all the cryptographic eggs in one mathematical basket. Calling the field “lattice-based cryptography” misses that deliberate diversification.
Nowhere in the section do the WEF authors use the NIST standard algorithm names. No ML-KEM, no ML-DSA, no SLH-DSA. For a security professional trying to act on these recommendations, this is a gap. The standard names are how products, compliance mandates, and configuration guides identify these algorithms. The NSA’s CNSA 2.0 specifies ML-KEM-1024 and ML-DSA-87. Google’s Android 17 integration names ML-DSA. If a CISO reads the WEF report and then tries to match its recommendations to their vendor’s product documentation, the vocabulary mismatch adds friction.
What Is Missing from the Cryptography Section
Three substantive omissions weaken the lattice-based cryptography entry.
First, harvest-now-decrypt-later gets a mention but Trust Now, Forge Later (TNFL) does not. HNDL threatens confidentiality: encrypted data recorded today will be decryptable once a cryptographically relevant quantum computer (CRQC) arrives. TNFL threatens authentication: the digital signatures that verify software updates, authenticate financial transactions, and validate legal documents will become forgeable. The two threats require different migration strategies, different urgency assessments, and often different organizational owners. Omitting TNFL gives readers half the threat picture.
Second, there is no distinction between the two tracks of PQC migration: key establishment (protecting data confidentiality via algorithms like ML-KEM) and digital signatures (protecting authentication and integrity via algorithms like ML-DSA). As I detail in Quantum Ready, these tracks have different performance characteristics, different backward-compatibility challenges, and different deployment sequences. The key establishment track is further along: Cloudflare reported in April 2026 that over 65% of human-initiated traffic reaching its network used post-quantum key exchange, driven by Chrome’s default support. The signature track is harder and earlier in deployment. Collapsing both into one narrative obscures the practical reality that migration is two parallel engineering programs with different timelines.
Third, fully homomorphic encryption (FHE) appears as a capability enabled by lattice mathematics. The FHE example is interesting, but coupling it to the PQC discussion without clearly separating the two applications risks confusing readers about what lattice-based cryptography is for. PQC protects against a future quantum threat. FHE enables computation on encrypted data today, regardless of quantum. They share a mathematical foundation but serve different purposes and face different adoption barriers.
What Is Missing from the Quantum Simulation Section
The quantum simulation entry has a different problem: it overstates near-term capability while correctly describing the long-term thesis.
As noted above, the WEF mischaracterizes the IBM and Moderna result as “protein folding.” The actual work predicted the secondary structure of a 60-nucleotide mRNA sequence using 80 qubits of an IBM Heron processor, formulated as a combinatorial optimization problem. That is a genuine quantum-engineering milestone. But classical algorithms routinely handle mRNA sequences with hundreds or thousands of nucleotides (albeit with approximations), and the quantum results matched a classical CPLEX solver. The demonstration shows that a specific optimization algorithm can execute on current quantum hardware at this scale. It does not show that quantum simulation has produced a drug discovery insight unavailable to classical methods.
More broadly, the quantum simulation section says that “quantum simulation can now access that level of complexity” for previously undruggable disease targets. This conflates the theoretical advantage of quantum simulation (which is real and well established in the scientific literature) with the engineering state of today’s machines (which cannot yet simulate molecules of pharmaceutical relevance at the required fidelity). The report’s own strategic outlook section acknowledges that “hardware constraints, error mitigation and biological data encoding are still limiting factors” and that hybrid quantum-classical platforms are necessary until fault-tolerant machines arrive. Those caveats belong in the main technology description, not in a separate outlook section that many readers will skip.
Also absent is any discussion of what fault-tolerant resources would be needed for pharmaceutically relevant molecular simulation. Published estimates range from tens of logical qubits for compact active-space chemistry problems to thousands for harder protein-ligand electronic-structure calculations, and the corresponding physical-qubit overhead varies with architecture, error rates, and runtime constraints. Without those numbers, readers have no way to judge how far the field is from delivering on the promise. I covered this extensively in the Quantum Utility Map series. My assessment: consequential pharmaceutical quantum chemistry is many years away, plausibly a decade or more.
The Broader Signal
Despite these criticisms, placing two quantum-related entries on the same list sends a useful signal. Organizations face a quantum threat program (PQC migration) and a quantum opportunity program (quantum-enabled R&D), and the two are at very different stages. PQC migration is an operational engineering transition already affecting roadmaps, procurement, and platform design. Quantum simulation for drug discovery remains an experimental research direction without a demonstrated pharmaceutical quantum advantage.
The cryptography entry itself supports a point I have been making for years on this blog and in Quantum Ready: migration decisions are increasingly driven by policy roadmaps, vendor timelines, and industry pressure rather than by any single prediction of Q-Day. The EU’s 2026 start date, the NSA’s 2027 acquisition requirement, Google’s 2029 target: these instruments differ in legal force (the EU roadmap asks member states to begin, the NSA deadline is a scoped requirement for national security products, Google’s date is a corporate target), but together they create migration, procurement, and planning pressure regardless of the precise timing of a CRQC.
For CISOs and CTOs, the WEF report’s practical message is broadly right even where its technical account is imprecise. Begin replacing quantum-vulnerable public-key cryptography, and distinguish key establishment from signatures. Track pharmaceutical quantum computing as a potentially consequential fault-tolerant application. Just use the right algorithm names when you start your procurement conversations, and do not confuse research partnerships with a quantum-designed drug.
