Enterprise MigrationAugust 12, 2026

The Mosca Inequality: How to Know If You're Already Too Late on Quantum

The Mosca inequality is a simple formula that tells you whether your quantum migration is already overdue. Here's how to apply it to your enterprise data.

Allison Seller

Chief Executive Officer

The Mosca Inequality: How to Know If You're Already Too Late on Quantum

What is the Mosca inequality?

The Mosca inequality is a simple risk formula, introduced by cryptographer Michele Mosca, that tells you whether your organization is already too late to protect its data from quantum computers. It compares three time spans: how long your data must stay secret (X), how long your quantum migration will take (Y), and how long until a quantum computer can break your encryption (Z). The rule is stark: if X + Y > Z, you are already too late.

What makes the formula powerful is that it reframes the entire quantum question. Instead of the unanswerable "when will quantum computers arrive?", it asks the answerable "does my data outlive my ability to protect it?", a question you can actually reason about using facts you already know about your own data and your own organization. It converts an intimidating, uncertain future into a concrete planning decision.

How does the formula work?

Break it into the three variables and the logic becomes intuitive. X is shelf-life: how long data must stay confidential, for example 10 years for medical, financial, or IP data. Y is migration time: how long it takes to become quantum-safe, often around 5 years across a large enterprise. And Z is the threat horizon: the time until a quantum computer breaks your cryptography, which is uncertain, perhaps 10 to 15 years.

Here is why X and Y add together. If your data must stay secret for 10 years (X), and your migration will take 5 years to complete (Y), then to have that data protected for its full confidentiality period you need to finish migrating 10 years before a quantum computer exists, which means you must start 15 years before. If a cryptographically relevant quantum computer might appear in 10 to 15 years (Z), the arithmetic already fails for your most sensitive data. You needed to have started already.

Why does data shelf-life change everything?

Because of the harvest-now-decrypt-later threat, the clock starts today: not when quantum computers arrive. Adversaries can capture encrypted data now, store it cheaply, and decrypt it the moment a capable quantum computer exists. So for any information that must remain confidential for years (health records, financial data, state secrets, trade secrets, intellectual property, long-term contracts) the exposure has already begun, even though the decryption is still in the future.

This is the insight that catches many leaders off guard. The instinct is to treat quantum as a distant problem to address when it gets closer. But the longer your X, the more urgent your migration, regardless of how far off Z might be. Data with a 25-year confidentiality requirement encrypted with today's algorithms is, in a real sense, already compromised the moment it is harvested: the decryption is just pending.

How do enterprises apply the Mosca inequality?

Turn it into a prioritization exercise rather than a single yes/no verdict. Estimate the shelf-life (X) of each major category of data you hold, and it will vary widely, which is the point. Estimate your realistic migration time (Y), which for a large organization is usually measured in years once you account for discovery, testing, and coordination. Use a conservative threat horizon (Z), erring toward "sooner" given the uncertainty. Then, for each data category, check whether X + Y approaches or exceeds Z. Wherever it does, that data is a migration priority now.

This calculation depends entirely on knowing what cryptography protects what data, which is exactly what a cryptographic bill of materials provides. Without that mapping, you can state the formula but not apply it. With it, the Mosca inequality becomes a practical triage tool that tells you where to spend your migration effort first.

What's the value of a formula built on an uncertain number?

It is fair to ask how a formula can be useful when Z (the arrival of a quantum computer) is genuinely unknown. The answer is that you do not need to predict Z precisely. You only need to see that, for your longest-lived data, the numbers already don't add up under any reasonable estimate. If X is 20 years and Y is 5, then even an optimistic Z of 15 years means you are late. The uncertainty in Z doesn't rescue you; it just widens the range of scenarios in which you are already behind.

That is the quiet power of Mosca's framing: it makes an uncertain future actionable by anchoring the decision to things you do know (your data's sensitivity and your organization's pace of change) rather than to a quantum timeline no one can pin down.

What should you do if X + Y > Z for your data?

Start migrating that data's cryptography now, in priority order, toward the NIST post-quantum standards. Being "too late" by the formula does not mean giving up: it means your highest-sensitivity data needs quantum-safe protection immediately, and every year of delay increases exposure. Focus first on the categories where X is longest and the data most valuable. The organizations that run this calculation honestly are the ones that start early enough for it to matter; the ones that avoid it are usually the ones the inequality was warning.

Frequently asked questions

A formula stating that if the time your data must stay secret (X) plus your migration time (Y) exceeds the time until quantum computers break your encryption (Z), you are already too late to fully protect that data.

It converts the uncertain quantum timeline into an actionable decision based on your own data's shelf-life and migration time, showing which data needs protecting now rather than later.

X comes from data classification (how long it must stay secret), Y from a realistic migration plan (often years), and Z from a conservative threat-horizon estimate for a cryptographically relevant quantum computer.

Prioritize immediate migration of your longest-lived, highest-value data. "Too late" signals urgency, not futility: every year of delay increases exposure.

Because you don't need a precise Z. For long-lived data, X + Y already exceeds any reasonable Z, so the conclusion holds across the range of plausible timelines. Project content Markdown conversion Created by you Add PDFs, documents, or other text to reference in this project. Content CONUX 10 Blogs.docx DOCX The Convergence: Why Quantum and AI Risk Are One Problem Most enterprises treat the quantum threat and AI risk as separate projects on separate roadmaps. They are the same problem wearing two faces. Walk into a typical enterprise and you will find two distinct initiatives: a quantum-readiness effort PASTED Crypto-Agility as a Business Capability, Not a Project Most organizations treat cryptographic change as a one-time migration. The ones that thrive will treat the ability to change as a permanent capability. The instinct when facing the quantum transition is to scope a project: migrate to new algorit PASTED The Board's New Fiduciary Duty: Cryptographic Oversight Boards oversee financial risk, operational risk, and cyber risk. Cryptographic risk is quietly becoming the next item they cannot afford to ignore. Corporate boards have steadily expanded their oversight as new categories of material risk emerg PASTED What “Quantum-Safe” Will Actually Mean in 2030 “Quantum-safe” is today's aspiration. By 2030 it will be a baseline expectation — and the definition will have moved well beyond swapping a few algorithms. Right now, 'quantum-safe' is a goal organizations are working toward, often understood narrowly a PASTED Your Zero-Trust Architecture Has a Cryptographic Blind Spot Zero-trust assumes nothing and verifies everything. But almost every zero-trust architecture quietly trusts one thing without question: the cryptography underneath it. Zero-trust has become the dominant security model for good reason. 'Neve PASTED What Is Post-Quantum Cryptography? A Guide for Enterprise Leaders Primary keyword: post-quantum cryptography Post-quantum cryptography (PQC) is a new generation of encryption designed to withstand attacks from quantum computers - machines powerful enough to break the cryptography that protects almos PASTED The Real Cost of a Trust Failure in the AI Era In the human era, a trust failure was a breach to be contained. In the AI era, a trust failure can propagate at machine speed before anyone is even aware it began. Organizations are used to thinking about the cost of a security incident in familiar term

The CONUX Briefing