One person, and that is the point

That is where most institutions sit, and it is a defensible read of the evidence. The threat has been announced for a decade, every vendor has an urgent-sounding deck, and you have a finite budget against risks that are hurting you today.

The question worth putting in its place is not when a cryptographically relevant quantum computer appears. It is how long the data you are protecting right now has to stay confidential. Mortgage files, medical underwriting, KYC records, long-dated contracts — some of that has to hold for twenty years, and traffic captured today can be decrypted whenever the capability lands. That turns a forecast into arithmetic, and the exposure check runs it in ninety seconds.

Send me what you have and I will tell you where it holds and where it thins out. That reading costs nothing and often settles the question either way.

Where I add something, it is usually the same gap. A firm that has read the standards can name the approved algorithms. It is harder for them to say what breaks when you swap a primitive out in your estate — the HSMs that will not hold the new key sizes, the counterparty integration that stops negotiating, the certificate chain nobody has owned since 2019. I have made those choices in production, and got some of them wrong the first time.

Both, deliberately. The most common failure I see is an institution left holding a roadmap with nobody to execute it, and an assessment that dies in a drawer has cost money and bought nothing.

The assessment stands on its own. Beyond it, the work continues in whatever shape helps: selecting and onboarding a technology partner, taking the roadmap into solutioning and architecture design, prototyping the difficult part, or hands-on development assistance where the cryptographic work needs the experience. One route from the problem to a working system, without a handover gap in the middle.

Three things keep the assessment independent: the fee is fixed before the work starts and does not move with what it concludes; anything beyond it is separately scoped and separately decided; and no vendor or partner pays me anything.

Fixed fee, quoted in a one-page written scope after we have talked. What drives it: the size of your cryptographic estate, the number of jurisdictions it spans, and how much is already documented. An institution that knows where its keys live is a materially smaller piece of work.

No day rates. A day rate pays for time instead of for the answer, which leaves you unable to budget and me with no reason to finish early. The scope is free, so you get a real number and can compare it before committing.

I run a small number of engagements at once, which is what allows me to be in the detail rather than reviewing someone else’s slides. You will get a real date on the call. If your board date is fixed, say so first and we will work backwards from it.

Based in Kolkata, working with institutions in the US, UK, GCC and India. Most of the work is remote — document review, architecture sessions, interviews with the people who run the systems — with travel for the workshops early on and the presentation at the end, where being in the room changes the outcome.

Weekly written updates throughout. Contracts are entered personally and invoices raised in my own name; if your procurement needs a particular structure, raise it early and it gets sorted before it becomes a delay.