'Quantum ready' is a sales label, not a certification

'Quantum ready' and 'quantum safe' are marketing labels. No standards body defines either phrase, and no program certifies a product against them. Behind the label there is usually something narrower that a buyer can check: support for NIST's new post-quantum algorithms, most often the key-exchange standard ML-KEM, and often a 'hybrid' mode that pairs it with an older algorithm.

The labels are multiplying as government deadlines approach. On Palo Alto Networks' earnings call in November 2025, chief executive Nikesh Arora suggested that hostile nation-states could have quantum computers by 2029. According to The Register, he also said the company would soon offer a full range of quantum-safe products. Cisco, a competitor, wrote in June 2026 that "in the absence of certification programs and globally aligned standards" quantum-safe claims were spreading. Cisco said some vendors focus on data in transit, some on device integrity, and some make broad claims without naming specific risks. Its answer was a three-level framework of its own, which is one vendor's scheme and not an industry standard.

Official documents avoid the labels. NIST's final transition report, NIST IR 8547, published in October 2026, uses the terms 'quantum-vulnerable' and 'quantum-resistant' and does not use 'quantum ready' or 'quantum safe' at all. The NSA's guidance treats 'quantum-resistant', 'quantum-safe' and 'post-quantum' as interchangeable names for algorithms that are believed to resist both classical and quantum attack. Those terms describe algorithms. They say nothing about whether a whole product is protected.

What actually changes inside

The NSA says RSA and elliptic-curve cryptography are the main algorithms that need replacing. These are the public-key methods that let two machines that have never met agree on a secret key or verify a signature. On August 13, 2024, NIST published three replacement standards. FIPS 203 specifies ML-KEM, a key-encapsulation mechanism (a way for two parties to set up a shared secret key). FIPS 204 specifies the ML-DSA signature scheme, and FIPS 205 specifies a second signature scheme. NIST IR 8547 says ML-KEM is currently the only approved post-quantum method for setting up keys, and it recommends the ML-KEM-768 parameter set as the default.

Most products adopt key exchange first because of 'harvest now, decrypt later'. NIST uses that phrase for adversaries who record encrypted traffic today in order to decrypt it once quantum computers mature. Many products also use hybrid key exchange, which combines a classical and a post-quantum algorithm so that the resulting key stays secure as long as at least one of the two holds. NIST compares this to putting two padlocks on a door: it is more conservative, but it costs more computing power. NIST says it will accept hybrid modes in FIPS 140 validation as long as one component is an approved scheme.

Palo Alto Networks' own documentation shows how specific these features can be. It says PAN-OS 11.1 or later supports post-quantum IKEv2 VPNs under RFCs 8784, 9242 and 9370. In its decryption settings, a 'PQC-Standard' option allows the ML-KEM and Kyber families, and a 'PQC-Experimental' option allows the Frodo, BIKE and HQC families. On connections to servers, the firewall offers both classical and post-quantum key exchange, and it uses a classical one if the server does not support the post-quantum option. The company also describes 'Quantum-Safe Cipher Translation'. In that mode, the link between the user and the firewall is post-quantum, while the firewall connects to older internal applications using classical encryption. The company documents these design choices openly. They also show that a product can carry a quantum-safe feature while parts of the traffic behind it stay classical.

Signatures are a separate job. Cisco argues that device identity, secure boot and firmware checks also need quantum-safe protection. Cisco says it plans, by December 2026, to enable quantum-safe communications across most of its core portfolio and to launch new routers, switches and firewalls with quantum-safe secure boot. NIST also calls for cryptographic agility, meaning the ability to swap algorithms without redesigning a system, because the standards will keep changing.

The deadlines vendors are selling against

For US government, Executive Order 14412, signed June 22, 2026, requires federal high-value assets and high-impact systems to use post-quantum cryptography for setting up keys by December 31, 2030, and for digital signatures by December 31, 2031. It directs the FAR Council, which writes federal procurement rules, to propose a rule requiring covered contractors to comply with NIST's FIPS standards, including the post-quantum ones, by December 31, 2030. It also orders CISA to publish the minimum elements of a cryptographic bill of materials (an inventory of the cryptography a product uses) and orders NIST to speed up validation of cryptographic modules. NIST says it will deprecate quantum-vulnerable public-key algorithms after 2030 and disallow them after 2035. For national security systems, the NSA's CNSA 2.0 guidance asks that VPNs and routers support and prefer the new algorithms by 2026 and use them exclusively by 2030.

In Europe, the roadmap issued with Commission support on June 23, 2025 says all member states should begin the transition by the end of 2026 and should move critical infrastructure to post-quantum cryptography no later than the end of 2030.

Finance has targets but, so far, no binding rule. The G7 Cyber Expert Group, which advises G7 finance ministers and central bank governors, published a roadmap in January 2026 and said explicitly that it does not set guidance or regulatory expectations. The roadmap suggests migrating the most critical systems around 2030 to 2032. It notes that many jurisdictions point to 2035 as an overall target, and it warns that smaller institutions depend heavily on their vendors.

Healthcare has the least explicit pressure. A peer-reviewed review in Frontiers in Health Services (July 2026) found that the HIPAA Security Rule requires risk-based safeguards but does not currently prescribe post-quantum algorithms. The same review found that FDA medical-device guidance stresses secure design and updates but does not currently require a formal cryptographic bill of materials. The authors also note that many connected medical devices have limited memory, bandwidth and battery, so post-quantum upgrades for those devices must be engineered differently from upgrades for servers.

What to ask before believing the label

Which algorithms and parameter sets does the product use? Is it the standardized ML-KEM and ML-DSA, or pre-standard or experimental options?

Which functions are covered: key exchange only, or also signatures, certificates, secure boot and firmware updates?

Which connections are covered? Is every hop post-quantum, or only the edge? If the product falls back to classical encryption, is that fallback visible and logged?

Is the post-quantum code inside a module validated under FIPS 140 by NIST's Cryptographic Module Validation Program, and what is the certificate number? The NSA says it does not approve unvalidated versions of these algorithms, even in hybrid modes, for national security missions.

Can algorithms be changed with a software update, or is new hardware required? Will the vendor supply a cryptographic bill of materials? Will it commit in writing to dates that line up with the 2030 and 2031 federal deadlines, or with the dates your regulator uses?

On the central question, the public record is clear: there is no standard or certification behind 'quantum ready'. The formal checks that do exist apply to specific algorithms and validated modules, not to the label. That could change once the FAR rule, CISA's bill-of-materials guidance and faster NIST validation are in place, because buyers would then have a common checklist to hold vendors to.