The cost of waiting: a decision-theoretic synthesis of early versus late post-quantum migration under uncertainty

The migration from quantum-vulnerable public-key cryptography to post-quantum cryptography (PQC) is now governed by formal standards and binding deadlines; yet, when an organization should migrate remains contested. Published treatments diverge, and the disagreement traces less to data than to modeling choices. This article synthesizes the decision-analytic and economic models used for migration timing, extracting from each its objective, parameters, threat-arrival assumption, cost treatment, and discount rate. Four model families are compared: the Mosca risk inequality; expected-value and net-present-value cost models; real-options models adapted from the information-security investment literature; and risk-prioritization or portfolio models, with decision-making under deep uncertainty as a cross-cutting criterion. A qualitative comparison indicates that recommendations depend most on three contestable inputs: the assumed distribution over the arrival of a cryptographically relevant quantum computer (CRQC), the discount rate applied to deferred costs and harms, and whether the harm from the “harvest now, decrypt later” interception is modeled at all. Early migration is the robust choice whenever confidentiality requirements outlast the plausible CRQC horizon, when interception harm is included, or when a robustness criterion replaces expected-value optimization. The case for deferral strengthens only under short data lifetimes, high discount rates, and no adversary collecting ciphertext today, a narrow set of conditions. We conclude that migration timing is better treated as a decision under Knightian uncertainty than an expected-value optimization, and that the discount rate and arrival distribution should be stated openly as the value judgments they are.