Mosca’s inequality revisited: a systematic review of quantum risk-timing models after the 2025–2026 reductions in quantum resource estimates

Introduction Estimates of the quantum resources required to break public-key cryptography fell sharply across 2025 and 2026, by enough to disturb the assumptions underlying the timing models organizations use to plan cryptographic migration. This review synthesizes published estimates for breaking RSA-2048, an integer-factoring target, and 256-bit elliptic-curve cryptography, a discrete-logarithm target, and examines what the revised figures do and do not imply for Mosca’s inequality, the standard risk-timing framework. Methods Following a protocol adapted from PRISMA 2020 conventions for a technical corpus, and after a search conducted in two rounds, 84 sources were included from preprint servers, standards repositories, and peer-reviewed venues, with 13 core studies charted in a structured extraction matrix of twelve fields that records the assumption set behind every physical-qubit figure. Results The headline physical-qubit estimate for factoring RSA-2048 fell from about one billion in 2012 to 20 million in 2019, to roughly 900,000 in 2025, and to figures between about 11,000 and 471,000 in 2026 depending on the operating point selected. Estimates for 256-bit elliptic-curve keys followed a comparable path. The reductions are attributable to arithmetic and circuit innovations, magic-state techniques, higher-rate quantum error-correcting codes, and changed architectural and hardware assumptions, and these contributions are decomposed separately here instead of being reported as a single trend. A synthesis restricted to peer-reviewed sources alone yields the same direction of travel but a materially weaker magnitude, and this is reported explicitly. Discussion A reduction in required qubits compresses a resource threshold, not a calendar. Because the relationship between a resource requirement and the date a machine meeting it is built depends on fabrication yield, achieved error rates, connectivity, decoder throughput, control systems, and sustained-runtime engineering, this review presents the consequences for Mosca’s inequality as conditional implications and supports them with scenario analysis across plausible confidentiality lifetimes, migration times, and threat horizons in place of a point forecast. The evidence reduces one barrier to feasibility and widens the uncertainty around the threat horizon; on a risk-management basis, not an evidentiary one, that combination favors prioritized migration of long-lived confidential data.