An educational migration-risk scenario calculator, not a Q-day prediction or compliance certificate.
In this article
LuniQ Risk: Plan a Post-Quantum Migration Without Pretending to Predict Q-Day
Some information must remain confidential for much longer than the system that first encrypts it. That creates a planning question: how long do your secrets need protection, how long could a migration take, and how much time are you assuming before cryptographically relevant quantum computers exist? LuniQ Risk turns those assumptions into an educational comparison, not a prediction or a compliance certificate.
What the comparison means
The tool uses a Mosca-style inequality: confidentiality lifetime plus migration time is compared with the assumed time until a quantum threat. If x plus y is greater than z, the chosen assumptions indicate an overlap that deserves attention. For a fictional example, ten years of confidentiality plus three years to migrate exceeds an assumed eight-year preparation window.
The arithmetic can be simple while the inputs remain uncertain. Nobody obtains a reliable Q-day date by choosing a preset from a dropdown. A scenario year is an assumption to test, and changing it can change the assessment. Migration time is also an estimate informed by the tool's questions, not an audit of your systems or supplier readiness.
Why long-lived secrets matter
The concern often called harvest now, decrypt later is that an adversary may retain encrypted material and exploit a future weakness in its protection. This does not mean every encrypted file is broken today, that every cryptographic algorithm is affected equally, or that a browser questionnaire can inspect your actual cryptographic dependencies.
A useful first pass is an inventory of categories and retention needs: which information remains sensitive for years, where asymmetric cryptography is involved, and which systems or vendors would have to change. The tool accepts category descriptions and editable sensitivity lifetimes. It does not discover keys, scan networks, identify all algorithms or verify a deployed migration.
Where standards fit
NIST finalized its first three post-quantum standards in August 2024: FIPS 203 for ML-KEM, FIPS 204 for ML-DSA and FIPS 205 for SLH-DSA. Those standards describe cryptographic mechanisms; they do not remove the work of integration, testing, inventory and operational change. See the NIST standards announcement.
NIST also published a finalized transition report in October 2026. Its guidance and timelines need to be read in their applicable organizational context rather than treated as a universal date generated by this tool. The NIST transition report announcement is a primary starting point. Verify the current documents and your actual obligations with the responsible specialists.
When a scenario becomes useful
A result is most useful when it leads to an actionable discussion. Which categories are most sensitive? Which dependencies have long replacement cycles? What evidence would make the migration-duration estimate more realistic? Who owns an inventory or supplier review? A repeated assessment should improve those inputs rather than merely produce a more reassuring color.
Compare an earlier and a later Q-day assumption. Keep the same data categories while varying migration time, then do the reverse. This shows which conclusions are robust and which depend on a narrow guess. A checklist can help organize follow-up, but it is not an assurance that the underlying system is secure.
How local handling differs from the planners
LuniQ Risk remembers its choices in this browser's local storage. Reset removes its saved state. That is different from the memory-only TestPlan and Project Planner workspaces, where an explicit plan file is needed to keep edits. On a shared browser profile, remembered categories may be visible to the next user.
Download or print a report when you want a dated discussion artifact. It records an estimate under selected assumptions, not measured attack probability, legal advice or a forecast of when a machine will arrive. Use the Risk guide to work through a harmless example before entering a real inventory description.