The CRQC Scorecard: How Close Is Each Quantum Modality to Breaking Your Encryption?

(Updated June 4, 2026)

Last week in March 2026, two papers landed that set social media on fire.

Google Quantum AI published a landmark resource estimate showing that fewer than 500,000 superconducting qubits could break Bitcoin’s elliptic curve cryptography in under nine minutes. Hours later, a team from Oratomic, Caltech, and UC Berkeley — including some of the most credible names in fault-tolerant quantum computing — dropped a paper claiming that Shor’s algorithm can be executed at cryptographically relevant scales with as few as 10,000 neutral atom qubits.

Predictably, the reaction was a mix of breathless hype and genuine concern. “Q-Day is around the corner!” proclaimed dozens of posts. Crypto Twitter panicked. Vendors rushed to sell quantum-safe solutions.

And the pace hasn’t slowed. Days after I first published this scorecard, QuiX Quantum demonstrated below-threshold error mitigation on a photonic quantum computer – the one modality I had assessed as having “effectively the entire journey remaining.” The field is moving faster than anyone can keep scorecards updated.

I understand the alarm. These are serious papers from serious researchers. The numbers are genuinely lower than anyone expected. And they come on top of a cascade of resource estimation breakthroughs over the past year that have collectively reduced the estimated cost of breaking RSA-2048 by over 2,000× — from 20 million physical qubits to potentially under 10,000.

But the gap between “a paper says 10,000 qubits could work” and “a machine actually breaks your encryption” remains vast. Not because the papers are wrong, but because actually building a quantum computer that meets the paper’s assumptions is an engineering challenge of extraordinary complexity.

This article provides the reality check. Using my CRQC Quantum Capability Framework and its three executive-level metrics — LQC, LOB, and QOT — I’ll map every major resource estimation paper published in the past year against the latest hardware achievements from each quantum computing modality. I’ll show you the gap in concrete, quantified terms that a CISO can take to their board.

My bottom line, though, is nuanced. The gap is real and significant today. But I also believe we’ve crossed a threshold: the remaining challenges are primarily engineering problems, not fundamental scientific ones. And when this much money, talent, and geopolitical urgency is flowing into solving engineering problems, those problems tend to fall — one after another, and often faster than anyone predicted. I do believe we will see a cryptographically relevant quantum computer (CRQC) within a few years. Which is precisely why the time to act is now.

The Three Metrics That Define the CRQC Threat

Before diving into the numbers, a word on methodology. My CRQC Quantum Capability Framework decomposes the path to a CRQC into nine interdependent hardware capabilities across four layers — from foundational physics (quantum error correction, syndrome extraction, below-threshold operation, qubit connectivity) through logical gates (Clifford gates, magic state production) to system-level execution (algorithm integration, decoder performance, continuous operation) plus the cross-cutting challenge of engineering scale and manufacturability.

Tracking all nine capabilities individually is essential for researchers and engineers. But for executive communication — and for the kind of cross-modality comparison this article attempts — I compress them into three aggregate metrics, as I described in my CRQC Readiness Benchmark:

Logical Qubit Capacity (LQC) — How many error-corrected logical qubits can the system maintain simultaneously? This is the “workspace” for the algorithm. For RSA-2048, current best estimates require roughly 1,399 logical qubits. LQC is primarily driven by QEC code efficiency, below-threshold operation, qubit connectivity, and raw physical qubit count.

Logical Operations Budget (LOB) — How many non-trivial logical operations (Toffoli/T-gates) can the machine execute before accumulated errors corrupt the result? Think of this as computational endurance. For RSA-2048, the requirement is roughly 6.5 billion Toffoli gates at error rates so low that the entire computation has a >93% chance of completing without a single logical error. LOB depends on logical gate fidelity, magic state production quality, decoder accuracy, and code distance.

Quantum Operations Throughput (QOT) — How fast can those logical operations be performed? This determines whether the computation finishes in days or centuries. For RSA-2048, the machine needs to sustain roughly a million error correction cycles per second for approximately five continuous days. QOT is driven by physical gate speed, decoder latency, syndrome extraction speed, and the ability to operate continuously without interruption.

I want to be transparent about the limitations of this approach. Compressing nine deeply interdependent capabilities into three metrics requires assumptions — and those assumptions can be wrong. Different QEC codes produce different LQC-to-physical-qubit ratios. Different architectures distribute the LOB burden differently between magic state factories and logical gate layers. Different modalities have fundamentally different QOT profiles. This three-metric framework is a deliberate simplification — useful for executive comparison, but no substitute for the full capability-level analysis when making detailed risk assessments.

Mapping individual experimental papers to these aggregate metrics is also inherently imperfect. I may have missed relevant papers, or there may be better ways to link specific achievements to these complex, interdependent metrics. The relationships between the nine underlying capabilities are non-linear — a breakthrough in one can shift the requirements on others in ways that are hard to predict. This is, in fact, one reason why predicting Q-Day is so difficult: we don’t know which engineering challenge will fall first, and when it does, it may dramatically reshape what the remaining challenges look like. I welcome corrections and suggestions from readers — please reach out via my contact page.

The Shrinking Target: How Resource Estimates Have Evolved

Before evaluating how close hardware is, we need to understand what it’s aiming at. The “demand side” of the CRQC equation — the algorithmic resource requirements — is a moving target, and it’s been moving in the wrong direction for defenders.

Gidney & Ekerå 2021: The 20-Million-Qubit Baseline

The foundational modern estimate established that breaking RSA-2048 would require roughly 20 million physical qubits, approximately 6,189 logical qubits (LQC), about 3 billion Toffoli gates (LOB), and around 8 hours of runtime — using surface codes on a square grid of superconducting qubits with 0.1% physical error rates and 1 µs cycle times.

Gidney 2025: Under One Million Qubits

In May 2025, Google’s Craig Gidney published “How to factor 2048 bit RSA integers with less than a million noisy qubits,” combining approximate residue arithmetic, yoked surface codes, and magic state cultivation to achieve: approximately 897,864 physical qubits, only 1,399 logical qubits (LQC — a 4.4× reduction from 2021), 6.5 billion Toffoli gates (LOB), and about 4.96 days runtime. Same physical assumptions as 2021.

Gidney himself noted that he saw “no way to reduce the qubit count by another order of magnitude” under the same assumptions. He couldn’t plausibly claim a hundred thousand noisy qubits would suffice. As he wrote, “attacks always get better.”

The Pinnacle Architecture (February 2026): Under 100,000 Qubits

Nine months later, Iceberg Quantum proved Gidney wrong. The Pinnacle Architecture used quantum LDPC (qLDPC) codes instead of surface codes to achieve RSA-2048 factoring with fewer than 100,000 physical qubits.

But — and this is a crucial nuance that many commentators missed — Pinnacle didn’t simply make the problem easier. It shifted the challenge. The 10× reduction in physical qubits came from assuming efficient qLDPC codes with much higher encoding rates than surface codes. These codes require non-local connectivity between physical qubits (not just nearest-neighbor), sophisticated “magic engines” for continuous T-gate production, and fast, accurate decoders for codes with much more complex syndrome structures than surface codes. None of these have been demonstrated on real hardware at the required scale. So while Pinnacle reduced the demand on physical qubit count (Capability E.1), it increased the demands on qubit connectivity (B.4), magic state production (C.2), and decoder performance (D.2). The total difficulty didn’t vanish — it migrated. This is a perfect illustration of why predicting Q-Day is so difficult: breakthroughs in one capability can shift — not eliminate — requirements onto others.

Critically, Pinnacle also provided estimates for non-superconducting hardware. With millisecond cycle times (typical of trapped-ion or neutral-atom platforms), factoring is feasible in about one month at ~100,000 physical qubits and 10⁻⁴ error rates. This opened the CRQC conversation beyond superconducting-only architectures.

Google Quantum AI (March 31, 2026): Breaking Cryptocurrency in Minutes

The Google paper on ECDLP-256 achieved a 10× reduction in the resources needed to break elliptic curve cryptography. Using surface codes on superconducting qubits, the team estimated fewer than 500,000 physical qubits could solve the ECDLP on 256-bit curves in under 9 minutes. Google’s optimized circuits require no more than 1,200–1,450 logical qubits (LQC) and just 70–90 million Toffoli gates (LOB) — roughly 100× fewer gates than the earlier Chevignard et al. estimates, which is why the runtime drops from hours to minutes.

Oratomic/Caltech/UC Berkeley (March 31, 2026): 10,000 Qubits

Published the same day, this paper claims Shor’s algorithm can run with as few as 10,000 reconfigurable neutral atom qubits — using Google’s optimized circuits on a fundamentally different architecture with high-rate qLDPC codes at approximately 30% encoding rate. Their largest code encodes 1,480 logical qubits in just 5,278 physical qubits. For RSA-2048, the underlying algorithmic requirements remain similar to Gidney 2025: ~1,399 logical qubits (LQC) and ~6.5 × 10⁹ Toffoli gates (LOB).

The same trade-off dynamic applies here as with Pinnacle: the dramatic physical qubit reduction comes from assuming qLDPC codes that have never been implemented on any hardware, and that place even greater demands on qubit connectivity and decoder complexity.

The qLDPC Revolution: A Cross-Cutting Trend

What ties the Pinnacle and Oratomic papers together — and connects to IBM’s independently developed bicycle codes and Photonic Inc.’s SHYPS codes — is the rise of quantum low-density parity-check (qLDPC) codes. These codes encode multiple logical qubits per code block with far higher efficiency than surface codes, potentially reducing physical-to-logical overhead by 10–20×. This is the single most impactful cross-cutting trend in quantum error correction today. But it comes with a trade-off: qLDPC codes require non-local qubit connectivity that is challenging for fixed-grid architectures like superconducting chips, and their decoding is significantly more complex.

Update, June 2026: In June 2026, IonQ demonstrated qLDPC breakeven on a 40-ion trapped-ion device (arXiv:2606.06455), achieving logical error rates 4–9× lower than the only prior superconducting qLDPC experiment (Wang et al., Nature Physics 2026). This is the first experimental evidence that high-rate qLDPC codes can reach breakeven performance on any platform, though the scale (40 qubits, 4 logical qubits) remains far from what the architectures above require.

Summary: The Demand Curve Is Falling Fast

Figure 1: Resource estimation trend — physical qubits over time” scatter chart showing the 2,000× drop from 20M (2021) to ~10K (2026), log scale, with RSA-2048 and ECC-256 estimates as separate series. Caption: “Figure 1: The shrinking target — estimated physical qubits needed to break cryptography have fallen by over 2,000× in five years, driven primarily by algorithmic optimizations and the shift from surface codes to qLDPC codes. Note: lower physical qubit counts come with trade-offs in runtime and architectural complexity.

Since this scorecard was first published, one additional demand-side result has appeared. A team from Peking University and Tsinghua University published a space-efficient quantum algorithm for elliptic curve discrete logarithms (Han Luo et al., arXiv:2604.02311, April 2, 2026) that reduces the logical qubit requirement for ECC-256 from 2,124 (Häner et al.) to 1,333, using a new modular-inversion circuit requiring only 3n+4⌊log₂n⌋+O(1) logical qubits. This is a meaningful algorithmic optimization: 791 fewer logical qubits for the same cryptographic target. The Toffoli gate count is 204n²log₂n+O(n²), comparable to prior estimates. This result further tightens the gap between demonstrated hardware and algorithmic demand, though the supply-side picture remains unchanged.

In short, the algorithmic target has shrunk dramatically — but only on paper. The hardware supply side has not kept pace.

The Supply Side: What Has Each Modality Actually Achieved?

Now let’s measure the hardware against those targets. For each modality, I assess the latest demonstrated achievements on Logical Qubit Capacity (LQC), Logical Operations Budget (LOB), and Quantum Operations Throughput (QOT) — and quantify the gap to the CRQC requirement.

Superconducting Qubits

Key players: Google Quantum AI, IBM, Rigetti, USTC (China)

Logical Qubit Capacity (LQC): 1 logical qubit demonstrated

The maximum number of simultaneously operating logical qubits demonstrated on superconducting hardware is one. Multiple groups have achieved this milestone using different error correction codes, but none have gone beyond it:

Google’s Willow processor (105 physical qubits, published in Nature, February 2025) demonstrated the first below-threshold surface code memory at distance 7 — a single logical qubit encoded across 101 physical qubits. The error suppression factor was Λ = 2.14 ± 0.02 per distance-2 increase, the per-cycle logical error rate was 0.143%, and the logical qubit lifetime exceeded its best physical qubit by 2.4×, surpassing the break-even point. USTC’s Zuchongzhi 3 achieved comparable distance-7 results using a microwave-based leakage suppression approach. A separate team demonstrated a color code scaled from d=3 to d=5 with a logical error suppression factor of 1.56 and transversal Clifford gates exceeding 99% fidelity — still one logical qubit but demonstrating a different, potentially more efficient, code family. Alice & Bob demonstrated a cat qubit repetition code at distance 5, below threshold — again one logical qubit, using a bosonic approach.

IBM’s qLDPC architecture (announced June 2025 with the Starling roadmap) targets 200 logical qubits on 10,000 physical qubits by 2029, but no logical qubits have been demonstrated on IBM production hardware yet. The Kookaburra processor (2026) will be the first QEC-enabled module; Cockatoo (2027) will demonstrate entanglement between modules.

The Logical Qubit Capacity (LQC) gap: ~1,399×. From 1 to ~1,399 simultaneously active logical qubits.

Logical Operations Budget (LOB): No fault-tolerant logical gates at Willow-class distances

Willow demonstrated that a logical qubit can be stored with below-threshold error suppression across millions of QEC cycles, but it did not implement logical gates on that distance-7 code. Other superconducting experiments have demonstrated logical Clifford gates and magic state injection in smaller codes — notably the color code d=3→d=5 result with transversal gates exceeding 99% fidelity — but these remain at lower code distances and shallower depths than the trapped-ion and neutral-atom logical gate results. IBM’s current Heron processors execute approximately 5,000 physical gates per circuit.

The Logical Operations Budget (LOB) gap: Effectively infinite — from zero demonstrated logical gates to 6.5 billion required. IBM’s Starling target (10⁸ gates by 2029) would still be 65× short.

Quantum Operations Throughput (QOT): ~1 µs cycle time — matches the CRQC target

This is where superconducting shines and where it has the strongest competitive advantage. Google’s Willow achieved a ~1.1 µs surface code cycle time with real-time decoding — matching the physical assumption in Gidney’s resource estimates. Physical gates operate at 10–100 ns, roughly 1,000× faster than any competing modality. Recent work demonstrated end-to-end QEC decoding-feedback latency of just 446 nanoseconds for a distance-3 code. IBM achieved a 10× speedup in classical decoding to under 480 ns.

The Quantum Operations Throughput (QOT) gap: ≈0 for cycle speed. The ~1 µs cycle requirement is already met. The limitation is sustained operation — running continuously for five days, not seconds to minutes. This maps to Capability D.3 (Continuous Operation), which remains undemonstrated at the required scale.

What Would a Superconducting CRQC Actually Require?

Superconducting qubits occupy a paradoxical position in this scorecard. They hold the only metric that already meets the CRQC target (QOT, at ~1 µs cycle time) while simultaneously trailing every other gate-based modality on the metrics that matter most (LQC and LOB). The path from here to a superconducting CRQC is, in engineering terms, the most thoroughly mapped of any modality, but every step on that map involves solving problems at scales nobody has attempted.

The first and most immediate challenge is demonstrating more than one logical qubit. Google’s Willow showed a single logical qubit at distance 7 with below-threshold error suppression; IBM’s Starling roadmap targets 200 logical qubits on 10,000 physical qubits by 2029 using qLDPC codes. The gap between those two numbers is where the difficulty concentrates. IBM has demonstrated the component technologies for qLDPC on superconducting hardware: c-couplers for non-local connectivity (the Loon processor), multi-layer wiring for routing syndrome data, and sub-480-nanosecond Relay-BP decoding. What IBM has not done is combine these into a single working system that produces even one qLDPC-encoded logical qubit with error rates below its constituent physical qubits. That integration step is the critical near-term milestone to watch. If Kookaburra (expected 2026) delivers a working multi-chip qLDPC module, the superconducting path to hundreds of logical qubits becomes substantially more credible. If it slips or underperforms, the 2029 Starling target looks increasingly aspirational.

The second challenge is LOB, and this is where the superconducting path encounters its deepest deficit. Willow ran millions of QEC cycles on a single stored logical qubit, but it performed zero logical gates on that qubit at distance 7. The color code d=3→d=5 result demonstrated transversal Clifford gates exceeding 99% fidelity, and Google’s separate magic state cultivation work addresses the T-gate pipeline. But running billions of logical gates on hundreds of logical qubits, while correcting errors in real time, at ~1 µs per cycle, for five continuous days? That is an engineering program measured in years, not months, even with the strongest team and the most generous funding.

The third challenge is physical qubit count, and here the cryogenic wiring problem looms large. A superconducting CRQC using surface codes needs roughly 900,000 physical qubits (per Gidney 2025); with qLDPC codes (per Pinnacle), perhaps 100,000. Even 100,000 superconducting qubits would require a dilution refrigerator ecosystem that does not exist today. The largest deployed systems run ~1,200 qubits. Scaling to 100,000 requires either modular multi-cryostat architectures with quantum interconnects between modules (IBM’s approach) or a radical rethinking of cryogenic packaging. IBM’s roadmap envisions this through Kookaburra multi-chip modules linked via microwave interconnects, scaling to Blue Jay (2,000 logical qubits, 2033). QuantWare’s VIO-40K targets 10,000 physical qubits by 2028 through chiplet stacking with 3D wiring.

I assess the superconducting path as having the highest engineering confidence for reaching CRQC-class LOB, conditional on the qLDPC integration step working. The ~1 µs cycle time is a genuine structural advantage: if the logical error rate can be pushed low enough through higher code distances and better decoding, the speed at which superconducting hardware can execute correction cycles means it can maintain a LOB that slower modalities would need orders of magnitude more qubits to match. The binding constraint is whether the multi-chip, multi-cryostat scaling path can deliver 100,000+ physical qubits with the error rates and connectivity that qLDPC codes demand. My estimate: a superconducting CRQC remains 5-10 years away, with the IBM Starling milestone (200 logical qubits, 2029) as the critical waypoint. If Starling delivers on schedule and on specification, the upper end of that range contracts significantly.

Trapped-Ion Qubits

Key players: Quantinuum (Helios), IonQ, Oxford Ionics

Logical Qubit Capacity (LQC): 94 error-detected / 48 error-corrected logical qubits

Quantinuum’s Helios system (98 barium-137 ions, launched November 2025) achieved a remarkable encoding efficiency. Using iceberg codes, the team produced 94 error-detected logical qubits, or 48 fully error-corrected logical qubits, from just 98 physical qubits — a roughly 2:1 encoding ratio that was considered impossible a few years ago. All demonstrated “beyond break-even” performance, meaning encoded operations were more accurate than raw physical operations. Two-qubit gate fidelity: 99.921% across all qubit pairs. Single-qubit: 99.9975%.

Earlier, in collaboration with Microsoft, Quantinuum had demonstrated 4 logical qubits with 800× error rate improvement (April 2024), then 12 logical qubits with a 22× circuit error rate improvement (September 2024) on the H2 system.

Growth factor: LQC has grown from 4 (April 2024) → 12 (September 2024) → 48–94 (November 2025–March 2026) on Quantinuum’s platform — roughly a 12–24× improvement in under two years.

The Logical Qubit Capacity (LQC) gap: ~15–29×. From 48–94 to ~1,399. The smallest gap of any modality. But scaling to 1,399 logical qubits would require ~2,800–3,000 physical ions — far beyond any demonstrated trapped-ion system. IonQ targets 2 million physical qubits by 2030 but has not published comparable logical qubit demonstrations.

Logical Operations Budget (LOB): ~10⁻⁴ logical gate error → ~10⁴ operations before failure

Quantinuum is the only platform to have demonstrated a complete universal fault-tolerant gate set at the logical level — including logical Clifford gates, magic state generation via code switching (Daguerre et al., Phys. Rev. X, October 2025), and a below-threshold non-Clifford controlled-Hadamard (CH) gate at ≤2.3 × 10⁻⁴ error. The March 2026 paper showed logical gate error rates of approximately 10⁻⁴ across dozens of logical qubits. Oxford achieved a world-record single-qubit gate error of <10⁻⁷ — the most accurate qubit operation ever recorded. IonQ (Oxford Ionics) demonstrated 99.99% two-qubit gate fidelity.

At a 10⁻⁴ logical gate error rate, the expected number of operations before failure is roughly 10,000.

The Logical Operations Budget (LOB) gap: ~650,000×. From ~10⁴ to ~6.5 × 10⁹. To bridge this, logical error rates would need to drop to ~10⁻¹⁰ or below, requiring higher code distances and significantly more physical qubits per logical qubit.

Quantum Operations Throughput (QOT): ~55 ms per circuit layer

Trapped-ion gates operate at roughly 100 µs to 1 ms — about 1,000× slower than superconducting. The Helios system’s benchmarked “depth-1 time” is approximately 55 ms per dense program layer, implying roughly 18 layers per second. All-to-all connectivity reduces the SWAP overhead that plagues fixed-grid architectures, partially offsetting the raw speed disadvantage.

The Quantum Operations Throughput (QOT) gap: ~1,000× for raw cycle speed. At current speeds, the ~5-day RSA computation would take ~13 years. The Pinnacle and Oratomic papers help here: with ms cycle times and parallelization, factoring is feasible in months at trapped-ion error rates (10⁻⁴). But even months-long computations require continuous, uninterrupted operation.

What Would a Trapped-Ion CRQC Actually Require?

Trapped-ion systems hold the strongest demonstrated LQC position (48–94 logical qubits), the best demonstrated LOB (~10⁴ logical gate operations), and the only complete universal fault-tolerant gate set at the logical level. The path from here to a CRQC is, in some respects, the most straightforward conceptually: more ions, better codes, higher code distances, and faster gates. In practice, each of those steps runs into a distinct engineering wall.

The scaling wall is the most immediate. Quantinuum’s Helios system operates with 98 barium-137 ions. Reaching the ~1,399 logical qubits required for RSA-2048 at the current ~2:1 encoding ratio would demand roughly 2,800–3,000 physical ions, all confined, shuttled, and individually addressed with the same fidelity that Helios achieves today. No trapped-ion system has operated at even 300 ions. Quantinuum’s roadmap calls for Apollo (expected around 2029–2030) to reach ~1,000 physical qubits and universal fault-tolerant quantum computing, but the architecture for getting from 98 to 1,000 ions requires either much larger trap chips with more complex junction-based routing, or photonic interconnects between multiple trap modules. IonQ’s acquisition of SkyWater Technology and Oxford Ionics gives it a semiconductor-fab path to dense ion-trap manufacturing, with a stated target of 200,000-qubit QPUs and >8,000 logical qubits by 2028–2029. That timeline is aggressive, and IonQ has not published logical qubit demonstrations comparable to Quantinuum’s.

The speed wall is more fundamental. At ~55 ms per dense circuit layer, Helios executes roughly 18 layers per second. A CRQC running Shor’s algorithm on RSA-2048 at superconducting assumptions (Gidney 2025) needs ~10⁶ QEC cycles per second for ~5 days. At trapped-ion speeds, the same computation would take roughly 13 years. The Pinnacle and Oratomic papers offer partial relief: with millisecond cycle times and heavy parallelization, the RSA-2048 factoring runtime drops to ~1 month at ~100,000 physical qubits. A month-long continuous computation is within the realm of conceivable operations, but it places extreme demands on system stability, ion loss rates, and the classical control infrastructure supporting it. Whether trapped ions can sustain coherent, error-corrected operation for a full month without fatal interruption is an open question that no experiment has begun to address.

The LOB gap is shared with every modality but is particularly well-defined for trapped ions because Quantinuum has the clearest demonstrated logical gate performance. At ~10⁻⁴ logical gate error, the system can execute roughly 10,000 operations before failure. Bridging to 6.5 billion requires driving logical error rates to ~10^-10, which means operating at code distances of roughly d=15–20 or higher. At a 2:1 encoding ratio, that implies tens of thousands of physical qubits per logical qubit at higher distances, pushing the total physical qubit count well beyond the 3,000-ion minimum suggested by the current encoding efficiency. Higher-rate qLDPC codes could help, but trapped-ion qLDPC demonstrations remain limited to Quantinuum’s Skinny Logic (iceberg codes) and have not been shown at the higher distances the LOB gap demands.

I consider trapped ions the modality most likely to demonstrate the first complete, small-scale fault-tolerant quantum computation that produces a verifiably correct answer to a problem requiring logical depth beyond 10⁴ operations. Quantinuum’s team has demonstrated every component of the fault-tolerant stack individually, and combining them is a matter of engineering execution rather than scientific discovery. The question is whether trapped ions can scale to CRQC-class qubit counts and runtimes, or whether their path peaks at a few hundred logical qubits running computations of practical value but insufficient depth to threaten cryptography. My estimate: a trapped-ion CRQC is possible in the 7–12-year range, with the Apollo system (~2029–2030) as the key proof point. If Apollo delivers ~1,000 physical qubits with demonstrated logical depth beyond 10⁶ operations, the timeline compresses. If scaling stalls at a few hundred ions, trapped ions may end up as the highest-quality but not the largest quantum computers, valuable for applications but not a cryptographic threat at the RSA-2048 scale.

Neutral-Atom Qubits

Key players: QuEra Computing, Harvard/MIT (Lukin group), Oratomic, Pasqal, Atom Computing

Logical Qubit Capacity (LQC): 96 logical qubits (below-threshold); 3,000+ physical qubits continuously

The Harvard/MIT/QuEra collaboration delivered arguably the most complete fault-tolerant architecture demonstration of 2025. Using reconfigurable arrays of up to 448 rubidium atoms, the team demonstrated all core elements of universal fault-tolerant computation in a single system (published in Nature, November 2025): below-threshold surface code QEC (2.14× error suppression), up to 96 logical qubits with error rates that improved as the system scaled, transversal gates, lattice surgery, and teleportation-based universality. Atom Computing separately demonstrated 24 entangled logical qubits using a Bacon-Shor code.

In a separate experiment, a 3,000-qubit array operated continuously for over two hours (Nature, September 2025) with mid-computation atom replenishment at 300,000 atoms/sec — over 50 million atoms cycled through. A Caltech team demonstrated a 6,100-qubit array, though for only ~13 seconds.

The Oratomic paper’s architecture theoretically encodes ~1,480 logical qubits in ~5,278 physical qubits — but this is a paper estimate using qLDPC codes never demonstrated on neutral-atom hardware.

Growth factor: Physical qubit count has grown from 256 (2023 Harvard logical qubit paper) → 448 (2025 fault-tolerant demo) → 3,000 (continuous operation) → 6,100 (Caltech pulsed) in about two years — roughly 10× per year.

The Logical Qubit Capacity (LQC) gap: ~15× from demonstrated hardware. The physical qubit scaling is the most favorable of any modality, but current two-qubit (Rydberg) fidelities of ~99.5% are below the ~99.9% level that enables efficient error correction at high code distances.

Logical Operations Budget (LOB): Below-threshold logical gates; magic state distillation achieved

The 448-atom architecture demonstrated transversal logical gates (27 transversal CNOTs in 17.7 ms) and the first logical magic state distillation on a neutral-atom platform. The Algorithmic Fault Tolerance (AFT) framework (QuEra/Harvard/Yale, Nature September 2025) demonstrated that runtime overhead of error correction can be reduced by 10–100× by performing logical gates with a single error-checking round instead of d rounds.

In May 2026, Pasqal demonstrated that logical qubits outperformed physical qubits on a complete practical application: a continuous [[4,2,2]] error-detecting code applied to quantum kernels solving 1,000 differential equations, reducing median error by more than 50%. This is an application maturity milestone rather than a new LOB record, but it reinforces that neutral-atom logical qubits are crossing the threshold from laboratory curiosities to operationally useful tools.

The Logical Operations Budget (LOB) gap: ~5–6 orders of magnitude (comparable to trapped-ion).

Quantum Operations Throughput (QOT): ~655 µs per transversal CNOT; massive parallelism; 2+ hours continuous

Individual gate speeds are in the ~100 µs–1 ms range. But neutral atoms offer two unique advantages: massive parallelism (hundreds of gates simultaneously across the array) and demonstrated continuous operation. The Harvard team projects that 3–5× gate error reduction and ~10× clock speedup are achievable with known techniques, which would enable hundreds of logical qubits with ~10⁻⁸ error rates.

In June 2026, Atom Computing demonstrated sustained quantum error correction using a toric code on its ¹⁷¹Yb neutral-atom processor (arXiv:2606.04079), running 90 rounds of syndrome extraction with continuous atom reloading from a magneto-optical trap. This is the first neutral-atom demonstration of continuous operation within a fault-tolerant QEC circuit, and the first implementation of a non-local topological code (requiring connectivity beyond nearest-neighbor) on any platform. Sub-threshold scaling was observed at short cycle counts (Λ = 1.9 for the Z-type observable at 4 cycles; Λ_avg = 1.30 across both observables), though the error suppression factor converged toward 1.0 at longer cycle counts. A repetition code logical memory persisted for over three minutes (225 seconds), exceeding the physical atom lifetime by more than 20×. The toric code requires non-local connectivity that superconducting platforms cannot natively provide, offering the first experimental validation of neutral atoms’ structural advantage for qLDPC-family codes.

The Quantum Operations Throughput (QOT) gap: ~100–1,000× for raw speed, but partially offset by parallelism, AFT, and — uniquely — the demonstrated ability to run for hours. Continuous operation addresses Capability D.3 in a way no other modality has demonstrated.

What Would a Neutral-Atom CRQC Actually Require?

Neutral atoms present what I consider the most plausible near-term path to a CRQC, though “near-term” in this context still means the better part of a decade. Three structural advantages set this modality apart: demonstrated qubit scaling at a pace no other platform matches (~10× per year in physical qubit count over 2023–2025), room-temperature operation that eliminates the cryogenic scaling bottleneck, and continuous multi-hour operation with mid-computation atom replenishment. The Oratomic paper’s claim that 10,000 neutral-atom qubits could execute Shor’s algorithm at cryptographic scales rests on these structural advantages, and it is worth being precise about what separates that paper’s assumptions from demonstrated reality.

The fidelity gap is the binding constraint. The best demonstrated two-qubit (Rydberg) gate fidelities on neutral-atom hardware sit at approximately 99.5%. The Oratomic paper assumes 10⁻³ physical error rates (99.9% fidelity). That 0.4-percentage-point gap sounds small, but in QEC terms, it is the difference between an error correction code that suppresses errors exponentially as distance increases and one that barely breaks even. The Harvard/MIT team projects that 3–5× gate error reduction and ~10× clock speedup are achievable using known techniques (better laser stabilization, optimized Rydberg pulse sequences, improved atom cooling), and there is no known physical principle preventing it. But “achievable with known techniques” and “demonstrated in a laboratory” are separated by years of painstaking engineering. The error budget for a CRQC is extraordinarily tight: every operation in a circuit of billions must work almost perfectly, and the error rate determines how many physical qubits are needed per logical qubit, which in turn determines whether 10,000 physical qubits suffice or whether the actual number is 50,000 or 100,000.

The qLDPC implementation gap is the second major challenge. The Oratomic paper’s headline number (10,000 qubits) relies entirely on high-rate qLDPC codes with ~30% encoding efficiency.

No qLDPC code has been implemented on any neutral-atom hardware, though Atom Computing’s June 2026 toric code demonstration is the first experimental implementation of a non-local topological code on a neutral-atom platform, validating the connectivity advantage that qLDPC codes would require. The Harvard/MIT Nature paper used a [[16,6,4]] high-rate code, which is a step in the right direction, and neutral atoms’ reconfigurable connectivity (atoms can be physically moved to create non-local connections) is a structural advantage for implementing qLDPC codes compared to fixed-grid superconducting chips. QuEra’s recent simulation of a [[1152,580,≤12]] code with ~50% encoding rate and 10⁻¹³ per-round error is encouraging on paper, but simulations of quantum memory codes are not the same as demonstrated logical gate operations on those codes.

The runtime challenge is unique to neutral atoms among the leading modalities because their gate speeds (~100 µs–1 ms) mean that CRQC-class computations take months, not days. The Oratomic paper’s RSA-2048 estimates range from ~97 days (time-efficient, ~102,000 qubits) to ~27 years (space-efficient, ~11,000 qubits). A 97-day continuous quantum computation is conceivable given the demonstrated 2-hour continuous operation with atom replenishment, but it places extreme demands on long-term stability. Atom loss, laser drift, environmental fluctuations, and the classical control infrastructure must all remain within tolerance for three continuous months. The Algorithmic Fault Tolerance (AFT) framework reduces runtime overhead by 10–100× by performing logical gates with a single error-checking round instead of d rounds, which could shorten some of these runtimes significantly, but AFT has been demonstrated only at small scale.

What gives me the most confidence in neutral atoms is the scaling trajectory. Physical qubit arrays have grown from 256 (2023) to 448 (2025) to 3,000 (continuous operation, 2025) to 6,100 (Caltech, pulsed, 2025) in about two years. QuEra targets 10,000 physical atoms in 2026, and no one in the field considers that implausible. If the Rydberg fidelity improvement from 99.5% to 99.9% is achieved concurrently with scaling to 10,000+ atoms, the neutral-atom platform enters the regime where the Oratomic paper’s assumptions become testable rather than theoretical. The combination of massive parallelism (hundreds of simultaneous gate operations across the array), continuous operation, and room-temperature compatibility gives neutral atoms a path to CRQC that does not require solving the cryogenic wiring problem, the multi-module interconnect problem, or the ion-shuttling scaling problem that constrain the competing modalities.

My estimate: a neutral-atom CRQC is possible in the 4-9-year range, making this the modality I consider most likely to produce the first CRQC. The critical milestone is a demonstration of qLDPC-encoded logical operations on a neutral-atom array of 1,000+ atoms at ≥99.9% two-qubit fidelity. If that happens before 2028, the lower end of that range becomes plausible. If Rydberg fidelities remain stuck near 99.5%, the timeline stretches to the upper end or beyond, and superconducting or trapped-ion platforms may close the gap through sheer code distance and speed.

Photonic Qubits

Key players: Xanadu, PsiQuantum, Photonic Inc., ORCA Computing

Logical Qubit Capacity (LQC): 0 demonstrated logical qubits

No photonic system has demonstrated a logical qubit. Xanadu’s Aurora (Nature 2025) is the first universal photonic quantum computer — a 12-qubit machine integrating all fault-tolerant subsystems in a single architecture (published in Nature). Xanadu also demonstrated on-chip GKP state generation (Nature, June 2025) — error-resistant photonic qubits on silicon nitride chips with >99% detector efficiency. Photonic Inc. introduced SHYPS qLDPC codes (March 2025) claiming 20× fewer physical qubits than surface codes. PsiQuantum was selected by DARPA for its US2QC program but no public experimental results have been released.

All gaps: effectively the entire journey remains — from 0 to CRQC targets on every metric. Photonic has potentially the fastest raw throughput (GHz range in theory) and room-temperature operation, but these advantages are unrealized at the logical level.

Update (April 5, 2026): Days after this article was first published, QuiX Quantum demonstrated below-threshold error mitigation on a photonic quantum computer for the first time – using photon distillation on a 20-mode silicon-nitride processor, in collaboration with NASA QuAIL, the University of Twente, and Freie Universität Berlin. The technique reduced photon indistinguishability error by 2.2× (1.2× net after gate noise), and modeling suggests it could reduce photon source requirements per logical qubit by up to 4×. This is a genuine milestone for Capability B.3: Below-Threshold Operation – the first time photonics has demonstrated any form of below-threshold error reduction. However, photon distillation operates at the pre-QEC physical layer: it is not a logical qubit, not a logical gate, and does not change the LQC, LOB, or QOT gap assessments above. Photonics is now on the board, but the journey remains effectively the same.

What Would a Photonic CRQC Actually Require?

Photonic quantum computing occupies a unique position in this analysis. It is simultaneously the modality with the largest gap to CRQC on every demonstrated metric (LQC, LOB, and QOT are all effectively zero) and the one with arguably the most favorable theoretical scaling properties: room-temperature operation, the potential for GHz-class gate speeds, and — through measurement-based architectures — a fundamentally different computational model that sidesteps some of the challenges facing gate-based platforms.

The gap between those theoretical properties and demonstrated reality is, at present, larger than for any other modality. Xanadu’s Aurora, the first universal photonic quantum computer, operates at 12 qubits. PsiQuantum’s Omega chipset (manufactured at GlobalFoundries) is designed for fault-tolerant operation but has no published experimental results demonstrating logical qubits or below-threshold error correction. Xanadu’s GKP state generation (Nature, June 2025) produced error-resistant photonic qubits on silicon nitride chips at >99% detector efficiency, and QuiX’s below-threshold photon distillation (April 2026) showed the first photonic error suppression. These are genuine building blocks, but the distance from building blocks to a working fault-tolerant logical qubit, let alone 1,399 of them operating simultaneously, is immense.

For photonics to reach a CRQC, several currently unsolved challenges would need to fall in sequence. Deterministic, high-rate single-photon sources would need to replace the probabilistic sources that currently limit scalability. Photon loss rates, which compound with every optical element in the circuit, would need to be driven low enough for error correction to work. A full measurement-based QEC demonstration would need to show below-threshold operation on at least one logical qubit. And the classical processing required to interpret measurement outcomes and feed corrections forward in a measurement-based architecture would need to operate at speeds compatible with the photonic clock rate. Each of these is an active area of research; none has been solved at the scale required.

Photonic Inc.’s SHYPS codes claim 20× fewer physical qubits than surface codes, which would put photonics in the same qLDPC-advantage territory as the neutral-atom and superconducting roadmaps. But SHYPS is a code-design paper, not a hardware demonstration. PsiQuantum’s DARPA QBI selection and its billion-dollar-plus manufacturing investment at GlobalFoundries and the Queensland site signal serious institutional confidence, but institutional confidence does not substitute for experimental evidence.

I assess photonics as the modality least likely to produce the first CRQC, but also as the one most likely to produce a surprise that invalidates the assumptions underlying the other modalities’ roadmaps. If the measurement-based approach works at scale, photonic computers could bypass the gate-depth bottleneck that constrains gate-based platforms. If PsiQuantum’s manufacturing-first strategy pays off and the Omega architecture delivers fault-tolerant logical qubits at semiconductor-production scale, the qubit-count advantage could be decisive. These are large “ifs.” My estimate: a photonic CRQC is 15+ years away under current demonstrated trajectories, with a non-trivial probability of either a breakthrough that compresses that timeline dramatically or a determination that the loss and indistinguishability challenges are harder than projected, pushing it further out. The first photonic logical qubit, whenever it arrives, will be the event that allows a more precise assessment.

Silicon Spin Qubits

Key players: Intel, Diraq/imec, SQC/UNSW, QuTech, SIQSE

I include silicon in this analysis because, despite being the least mature modality for logical qubit demonstrations, it is arguably the dark horse of quantum computing — the only platform where the path to millions of qubits runs directly through existing semiconductor fabrication lines that already produce billions of transistors per chip.

Logical Qubit Capacity (LQC): 2 logical qubits (error-detected)

In March 2026, researchers at SIQSE published the first universal logical operations in silicon (Nature Nanotechnology) — using five phosphorus-donor nuclear spins to encode two logical qubits via the [[4,2,2]] code. They demonstrated fault-tolerant state preparation, a complete universal gate set including the T gate via gate-by-measurement, and executed a VQE algorithm on the logical qubits. SQC/UNSW demonstrated an 11-qubit processor with 99.9% two-qubit gates (Nature, December 2025) that maintained performance as qubit numbers increased. Diraq/imec showed >99% fidelity on standard 300-mm CMOS wafer lines (Nature, September 2025) — a manufacturing milestone with 95% yield and 24,000+ devices per wafer.

The Logical Qubit Capacity (LQC) gap: ~700×. Logical Operations Budget (LOB) and Quantum Operations Throughput (QOT) gaps are comparably large. Silicon’s coherence times are exceptional (T1 up to 9.5 seconds in isotopically purified silicon), and gate speeds are moderate (~1–10 µs). The long-term bet is manufacturing: if CMOS fabs can produce millions of qubits per wafer, silicon wins on scale.

What Would a Silicon Spin CRQC Actually Require?

Silicon spin is the dark horse I keep returning to in my analysis, because its CRQC path depends on answering a different question than the other modalities face. For superconducting, trapped-ion, and neutral-atom systems, the question is: can we scale the physics? For silicon spin, the question is: can we transfer the physics to an industrial manufacturing process that already scales? If the answer is yes, silicon’s path to millions of qubits runs through the same 300-mm CMOS fabrication lines that produce billions of transistors per chip. No other modality can make that claim.

The current state of silicon spin is roughly where superconducting qubits were in 2018–2019: small qubit counts (the largest published processor is SQC’s 11-qubit device), competitive gate fidelities (>99% two-qubit gates on industrial 300-mm wafers via the Diraq/imec collaboration), and the first logical qubit demonstration (SIQSE’s two error-detected logical qubits using the [[4,2,2]] code, March 2026). The coherence times are among the best of any platform: T1 up to 9.5 seconds in isotopically purified ²⁸Si, and T2 values in the millisecond range. Gate speeds of ~1–10 µs are comparable to neutral atoms and only one order of magnitude slower than superconducting.

For silicon spin to reach a CRQC, three things would need to happen. First, qubit counts need to scale from ~10 to tens of thousands, and the semiconductor manufacturing path is the entire argument for why this is possible. Diraq’s demonstrated fabrication on imec’s 300-mm line with 95% yield and 24,000+ devices per wafer shows the manufacturing is already working at small scale. Intel distributes 12-qubit Tunnel Falls chips to academic partners. But fabricating thousands of spin qubits on a chip and wiring them into a coherent quantum processor are distinct problems. The classical control wiring for spin qubits scales poorly at room temperature, and cryo-CMOS control (placing the control electronics at the 1–4 K stage near the qubits) is the leading proposed solution, though no cryo-CMOS controller has been integrated with a production-scale spin-qubit array.

Second, the two-qubit gate fidelities need to cross the ~99.9% threshold that enables efficient surface-code or qLDPC error correction at meaningful code distances. The Diraq/imec result of >99% is close, but the last 0.9 percentage points in the quantum regime are harder than the first 99. The SIQSE logical qubit demonstration used the [[4,2,2]] code, which detects but does not correct errors; getting to correctable code distances (d=5 or higher) requires both more qubits and higher fidelities.

Third, silicon spin needs to demonstrate QEC at scale. The longest path here is not the physics (which appears sound) but the systems engineering: integrating spin qubit arrays with cryo-CMOS control, high-bandwidth readout, and real-time decoding at the cryogenic temperature stages where the qubits operate. This is an integration challenge comparable in complexity to the superconducting multi-module problem, with the added complication that the entire silicon-spin QEC toolchain is less mature.

My estimate: a silicon spin CRQC is 15–20 years away under current trajectories, the longest estimate in this scorecard. But the distribution of outcomes is unusually wide. If a major semiconductor foundry (TSMC, Samsung, Intel, or imec) commits to a full-scale quantum fabrication program using its existing process technology, the manufacturing advantage could compress the scaling timeline in ways that are difficult for lab-built modalities to match. The Diraq CHIPS Act investment ($38M Letter of Intent, May 2026) and Intel’s continued Tunnel Falls work are early signals. Silicon spin is the modality I am least confident about on a 10-year horizon but most confident about on a 30-year horizon, because semiconductor manufacturing tends to win in the long run.

The Complete Gap to CRQC Analysis

Figure 2: The gap to CRQC across five modalities. Each badge shows how many times current demonstrated performance must improve to reach the CRQC target for that metric. Green = target met; blue = within 100×; amber = 100–99,000×; red = over 100,000×. The Logical Operations Budget (LOB) is the universal bottleneck: every modality shows red, with a minimum 650,000× gap even for the best-performing platforms. Superconducting is the only modality to meet any target (QOT) but trails on both LQC and LOB. Neutral atom and trapped ion lead on LQC but share the same LOB deficit.

*Photonic has since demonstrated below-threshold photon distillation (QuiX Quantum, April 2026) – a pre-QEC error mitigation milestone. No logical qubits demonstrated.

**Neutral atom QOT gap partially offset by massive parallelism and AFT.

LOB Is the Universal Bottleneck

The most important insight from this analysis: across every modality, the Logical Operations Budget is the binding constraint — and it’s not close. The best demonstrated logical circuit depth on any platform is roughly 10,000 operations (Quantinuum, March 2026). The CRQC needs 6.5 billion. That’s approximately 650,000×, or nearly six orders of magnitude. For ECC-256, the picture is more concerning: Google’s optimized circuits need only 70–90 million Toffoli gates, shrinking the LOB gap to roughly 7,000–9,000× — still large, but only four orders of magnitude rather than six. This is why elliptic curve cryptography is the more immediate quantum target.

Bridging this requires exponentially better error rates at the logical level — which means higher code distances, more physical qubits per logical qubit, and faster, more accurate decoders running in real time. No modality is close.

What Should CISOs Do About It?

I enjoy these discussions immensely. Analyzing resource estimates, tracking modality progress, debating Q-Day predictions — it’s intellectually stimulating, and I believe it’s important for cutting through both Q-FUD (the quantum panic industry) and quantum denialism. I love clarifying the misconceptions that surround all of this.

But the bottom line for anyone responsible for organizational security is this: the precise date of Q-Day shouldn’t be your risk management approach. The ecosystem has already moved. NIST has finalized post-quantum cryptography standards. NSA’s CNSA 2.0 mandates migration by 2030–2033. Harvest Now, Decrypt Later (HNDL) attacks are happening today. And Trust Now, Forge Later attacks against digital signatures are an emerging concern.

As I’ve argued in detail: forget Q-Day predictions — regulators, insurers, investors, and clients are your new quantum clock. The 650,000× LOB gap is reassuring if you’re asking “will my data be broken tomorrow?” It is not reassuring if you’re asking “will data I send today be readable in 2035?” — because PQC migration typically takes 5–10 years, and the gap is closing from both directions simultaneously.

Start your migration. The quantum computer that breaks your encryption doesn’t exist yet. The deadline to protect against it already does.

Try It Yourself: The Q‑Day Estimator

The scorecard above gives you a snapshot — here’s the tool to run your own scenarios. Pick a resource estimation paper on the left (the “demand” — how many logical qubits, operations, and throughput a specific cryptographic attack requires) and a quantum modality on the right (the “supply” — where that technology stands today). The tool calculates a Composite CRQC Readiness Score and projects when it crosses 1.0 — the estimated Q‑Day.

Each modality comes pre-loaded with the values from my scorecard above and per-metric growth factors. Where a growth rate is derived from observed hardware progress (e.g., trapped-ion LQC scaling ~12×/year), it’s shown as-is; where I’ve used a default assumption, it’s flagged with ⚑. Adjust any value to test your own assumptions — what if neutral-atom LOB grows faster than I’ve estimated? What if Gidney’s 2025 resource estimates are further optimized?

For the full methodology behind the three metrics and scoring, see the CRQC Readiness Benchmark — Methodology & Assumptions. For the permanent version of this tool with additional context, visit the CRQC Readiness Benchmark (Q‑Day Estimator) page.