up:: The Human & Organizational Side MOC
The Quantum Checklist for Investors
The quantum checklist for investors is a set of diligence questions to put to a company you are funding or holding, and each one tests whether the cryptography its product and its data sit on will survive the years of your position: (1) “Can you show me your cryptographic inventory?” (a company that cannot produce one does not know its own exposure) · (2) “How long does your most sensitive data need to stay secret, and what is protecting it today?” (data with a multi-decade sensitivity life protected by today’s algorithms is a future breach already collecting) · (3) “If the cryptographic standards change, how fast can you swap your algorithms, and who owns that?” (a company that hardcoded one algorithm everywhere has a slow, expensive migration ahead, and a plan with no owner is not a plan).
The checklist exists because an investment is a multi-year bet and the clock on cryptography runs on an overlapping schedule. The public-key cryptography almost every company relies on, RSA and elliptic-curve, is the exact cryptography a large quantum computer is expected to break, and the replacement standards NIST finalized in 2024 (ML-KEM and its siblings) take most organizations years to adopt across a real estate. A company that has not started is carrying a cost and a risk that was never priced into the round, and an acquirer at exit will run this diligence even if the earlier investors did not.
This note is general education about market structure and technology risk, not investment, legal, or security advice. Whether and how any of this applies to a specific company is a determination made with that company and the appropriate advisers.
The short version:
- You are not migrating anything. You are finding out whether the company knows it will have to, the same way you ask about runway or data-privacy posture without doing the work for them.
- The three questions above return a verdict on whether the company has looked at this at all. The most useful answer is often the blank stare to question one, because an inventory a company cannot produce is the finding.
- The risk that makes this urgent rather than theoretical is harvest now, decrypt later: data exfiltrated today while it is still protected by old cryptography can be stored and decrypted once the capability arrives, so a company’s long-lived data is exposed from the moment it is collected, not from some future date.
- The companies where this is load-bearing rather than incidental are the ones whose product IS cryptography or whose value IS long-lived sensitive data: security and infrastructure, fintech and payments, health and identity, messaging, and anything holding records with a decade-plus secrecy life.
- A company can pass all three cleanly, and the checklist is built to let that happen. A named inventory, a clear-eyed read of its own data longevity, and an agility plan with an owner is exactly the answer you want to find.
What are the three questions that matter most?
If you only have room for three in a diligence conversation, ask these, each phrased so a real answer is a short concrete fact rather than a reassurance.
- “Can you show me your cryptographic inventory?” Asking whether a company is “thinking about quantum” invites a yes. Asking to see the inventory invites either a document or a pause, and the pause is itself the finding. A company that knows where its keys, certificates, and algorithms live can show you; one that cannot has no way to scope its own migration, which means neither do you.
- “How long does your most sensitive data need to stay secret, and what is protecting it today?” This separates a company whose data loses value in days from one holding records that must stay private for decades. The second kind has a harvest-now-decrypt-later exposure that is already running, and if the answer to “what protects it” is RSA or elliptic-curve with no migration in view, the exposure has a price.
- “If the standards change, how fast can you swap your algorithms, and who owns that?” This tests crypto-agility and ownership together. A company that can change its cryptography through configuration has a cheap migration ahead; one that hardcoded a single algorithm across its product has an expensive re-architecture. And a migration that no named person owns tends to stay an intention rather than become work.
What is the full investor diligence checklist?
| What to ask | A real answer | A non-answer | What it tells you |
|---|---|---|---|
| Inventory. Can you show me where your cryptography lives, keys, certificates, algorithms, and in which systems? | A cryptographic inventory they can actually produce | ”We use industry-standard encryption” or “our cloud provider handles that” | Whether the company can scope its own exposure at all |
| Data longevity. How long must your most sensitive data stay confidential, and what protects it now? | A clear read of which data is long-lived and what algorithm guards it | ”It’s all encrypted” with no distinction between a session token and a 30-year health record | The size of the HNDL exposure already in progress |
| Product dependency. Does your product’s security promise rest on cryptography a quantum computer breaks? | A map of where RSA and elliptic-curve sit in the product, and a plan for them | ”Our product isn’t really a crypto product” when it signs, encrypts, or authenticates | Whether the thing you are buying breaks when the math does |
| Agility. If an algorithm has to change, is that a config change or a rebuild? | Evidence of crypto-agility, abstraction, and the ability to swap | Cryptographic choices scattered and hardcoded across the codebase | The cost and speed of a migration you may have to fund |
| Vendor and supply chain. How much of your cryptographic exposure lives in your own vendors and dependencies? | A named list and an understanding that the contract is the migration lever | No awareness that most of the exposure is inherited from third parties | Where the migration work actually sits, which is often not in-house |
| Regulatory clock. Does your sector impose a migration deadline, and are you tracking it? | Awareness of the relevant mandate and its dates | ”We’ll deal with compliance when we have to” | Whether a compliance cost and timeline is already fixed and unbudgeted |
| Plan and owner. Is there a migration plan, and who owns it? | A plan, a named owner, and a sense of sequence and cost | A roadmap slide with no owner and no date | Whether any of the above turns into action or stays an intention |
Why does quantum belong in diligence now?
The thing that makes quantum different from most technology risk is that the exposure begins before the threat arrives. With harvest now, decrypt later, an adversary does not need a quantum computer today to harm a company whose data must stay secret for 10 or 20 years, they need only to copy the encrypted data today and wait. So a portfolio company holding long-lived sensitive data is accruing a liability right now, quietly, whether or not anyone in the deal noticed.
The second reason is timing. Migrating an estate off RSA and elliptic-curve onto the standards NIST finalized in 2024 (FIPS 203) is a multi-year program for most organizations, closer to a budgeted engineering effort than a patch. A company that starts late does not get to compress that work, it pays more and ships slower, inside the window you are holding the position. And at exit, a sophisticated acquirer or a regulated buyer will run exactly these questions, so an unmigrated company is a markdown waiting to be found by someone else.
None of this requires an investor to become a cryptographer. It requires the same instinct that already drives diligence on runway, security posture, and data practices: find out whether the company has looked squarely at a cost it will certainly face, and treat the ones that have as the better-run companies they are.
Where does this checklist stop?
This checklist tells you whether a company has confronted its quantum exposure and whether its answers hold together. It does not size that exposure in dollars or years for a specific company, judge whether a particular migration plan is credible against that company’s architecture, or turn a diligence finding into a remediation timeline and a budget line. That is company-specific work, and it begins where these questions end. The checklist for the vendors and products a company itself buys is the vendor-claims checklist, and a buy-side firm assessing its own exposure rather than a portfolio company’s should start from PQC for asset and investment management.
Questions people ask
Isn’t a quantum computer still years away? The exposure does not wait for the computer. Under harvest now, decrypt later, an adversary copies a company’s encrypted data today and decrypts it whenever the capability arrives, so a portfolio company holding data that must stay secret for a decade or more is already carrying the risk. The timeline that matters is the data’s secrecy life, not the hardware’s arrival date.
Do I need to understand the cryptography to use this? No. Every question returns a fact a non-technical investor can weigh: whether the company can produce an inventory, whether it knows which of its data is long-lived, whether a named person owns the migration. You are assessing whether the company has confronted a cost it will face, the same way you assess runway without being its CFO.
What if the company says its cloud provider handles encryption? That is a starting point rather than an answer. Most of a company’s cryptographic exposure is inherited from vendors and dependencies, and the lever there is contractual rather than an internal engineering project. The useful follow-up is whether the company knows which providers carry its sensitive data and what each one has committed to on post-quantum.
Related
- Harvest Now, Decrypt Later (HNDL): why a long-lived-data company is exposed today rather than later
- Cryptographic Discovery: the inventory a company has to be able to produce
- Crypto-Agility and The Agility Test: whether changing an algorithm is a config change or a rebuild
- What a PQC Migration Costs and Funding a PQC Program (The Business Case): the size and shape of the cost you are assessing
- The Vendor-Claims Checklist: the companion check for the products a company buys
- Brief Your Board: the same risk framed for the people the investor sits beside
Everything here is the map, given freely. When a fund or a portfolio company needs its actual exposure sized in dollars and years, or its vendor agreements rewritten to carry cryptographic terms, that’s the work I do.
Last verified 2026-10-26 · Updated 2026-10-26 · Maintained by Addie LaMarr, LaMarr Labs.