Key Takeaways
- The Bain-IBM partnership divides the PQC engagement into two non-overlapping functions — risk framing and technical execution — and the firm controlling execution controls the decade-long client relationship.
- ISACA's 2025 survey found only 5% of organizations have a defined quantum strategy despite 62% expressing concern about quantum threats to encryption, signaling a massive near-term demand surge for PQC advisory services.
- PE portfolio companies face cascading cryptographic exposure from shared managed services infrastructure, making them simultaneously the most vulnerable and the most commercially concentrated first-mover targets.
- The PQC market is projected to exceed $15 billion by 2030; strategy firms that stall at the roadmap stage will cede the highest-margin migration work to IBM Consulting, Accenture, and quantum-safe specialists.
- After 2028, as NSA CNSA 2.0 application migration deadlines approach, clients will stop paying for risk strategy and start paying for execution — and the firms without cryptographic implementation talent will lose the renewal conversation.
The Bain-IBM post-quantum cryptography partnership, announced in March 2026, is the consulting industry's clearest signal that the PQC mandate is too large and too technically specific for any single firm to own end-to-end. ISACA's 2025 survey of over 2,600 security professionals found 62% are concerned quantum computing will compromise current encryption, while only 5% have a defined quantum strategy. NIST finalized its first three post-quantum cryptography standards (FIPS 203, 204, 205) in August 2024, and the NSA's CNSA 2.0 framework mandates quantum-safe algorithms for new classified systems by January 2027 and full infrastructure migration by 2035. The market for PQC services is projected to exceed $15 billion by 2030. What Bain and IBM have announced is a joint bid for that mandate — and in doing so, they have exposed the structural fault line that will define PQC consulting for the next decade: strategy firms can sell the risk story, but only technologists can execute the fix. The firm that controls the migration phase controls the client.
Why the Bain-IBM Deal Is a Confession, Not a Power Move
The press release anatomy is diagnostic. Bain contributes "market-leading due diligence capabilities" and deal risk assessment expertise. IBM Consulting contributes "quantum-safe transformation services" and the technical capacity to identify vulnerable assets and execute remediation. These are sequential functions, not overlapping ones. Bain frames and sells the risk; IBM fixes it.
Chuck Whitten, Bain's Global Head of Digital Practices, framed the rationale precisely: "Quantum computing is moving from theory to reality. It also brings a hard deadline: many of today's encryption standards won't hold forever. Our collaboration with IBM strengthens our ability to help acquirers spot cryptography risk early and take action."
"Spot cryptography risk" is a due diligence function. "Take action" belongs to IBM. A firm confident in its end-to-end capability does not need a co-brand. The partnership has set the template for a new class of hybrid engagement the industry has not had to manage at this scale, and every strategy firm that lacks credentialed cryptographic talent — which is nearly all of them — will need a similar arrangement to credibly pursue PQC mandates beyond the assessment phase.
Private Equity's Blind Spot: Shared Infrastructure, Zero Migration Roadmaps
PE portfolio companies are simultaneously the most exposed and the least prepared cohort in the enterprise market. The harvest-now, decrypt-later (HNDL) attack vector is operational today: adversaries are capturing encrypted data at scale and storing it for future quantum decryption. Google's 2025 research revised the estimated qubit count required to break RSA-2048 from roughly 20 million down to under one million, a 20-fold reduction achieved through software optimization alone. A February 2026 preprint reduced that estimate further, to under 100,000 physical qubits.
PE-backed businesses face a structural compounding problem: portfolio companies frequently share cryptographic infrastructure through centralized IT managed services, standardized ERP deployments, and common identity management platforms rolled out by the fund's operating team. A single cryptographic vulnerability in a shared managed services stack can cascade across dozens of portfolio companies simultaneously. Ropes & Gray's 2026 portfolio cyber readiness analysis found that 54% of risk managers and CISOs at PE firms reported that up to a quarter of their portfolio companies had suffered a cyber incident in the prior year. The quantum layer compounds that exposure without yet appearing in most risk registers.
This is the commercial logic behind Bain's PE focus. Assessment fees are replicable across an entire fund's portfolio in a single engagement cycle. The conversation fits naturally into deal due diligence, portfolio risk reviews, and value creation planning. For a fund managing 20 portfolio companies, a standardized PQC assessment program generates meaningful revenue before a single line of cryptographic code is touched.
The Assessment-to-Migration Revenue Ladder
The PQC engagement follows a predictable and lucrative three-stage structure. The initial cryptographic asset inventory and risk assessment (6-12 weeks) identifies which systems rely on public-key cryptography — RSA, ECC, Diffie-Hellman — that will become vulnerable to quantum attack. The output is a risk-tiered asset map. That assessment feeds the roadmap phase, which sequences migration priorities, estimates remediation costs, and defines a governance framework aligned to NIST and NSA deadlines. The roadmap then generates the migration program itself: re-engineering cryptographic implementations across infrastructure, applications, and data pipelines to comply with FIPS 203, 204, and 205.
BCG has stated publicly that "starting in 2030 will already be too late" for organizations with complex cryptographic estates. The NSA's CNSA 2.0 framework establishes January 2027 as the deadline for quantum-safe algorithms in new classified systems, 2030 for full application migration, and 2035 for complete infrastructure transition. Each deadline is a billable engagement phase. For a PE portfolio company of moderate scale, the migration program alone runs 18-36 months. Across a fund with 20 portfolio companies, the revenue opportunity is large enough to define a firm's cybersecurity practice for a full decade.
The Credentialing Gap Has a Winner
Strategy firms can sell the quantum risk narrative compellingly. They have C-suite access, risk framework vocabulary, and the relationship infrastructure to make an assessment look authoritative. What they lack are post-quantum cryptographers.
Executing a PQC migration requires practitioners fluent in lattice-based cryptography (the mathematical foundation for FIPS 203's ML-KEM), hash-based signatures (FIPS 205's SLH-DSA), and module lattice digital signatures (FIPS 204's ML-DSA). These skills are not available in a standard cybersecurity consulting bench. IBM has them, built through its quantum computing research division. Accenture has been developing a parallel capability through its partnership with AWS on quantum-safe implementation. McKinsey and BCG have published authoritative research on quantum timelines but have not demonstrated technical implementation depth at scale.
When a PQC engagement moves from assessment and roadmap into active migration, the firm with the cryptographic practitioners takes control of the work. In the Bain-IBM model, that is IBM Consulting. The strategic advisor who sold the engagement becomes a governance oversight function while the technical partner executes the billable hours. This is a margin and client ownership problem for strategy firms, and most have not yet solved it.
Why Every Major Consulting Firm Will Announce a PQC Practice by Q4 2026 — and Why Most Will Stall
The commercial incentive to announce a PQC advisory practice is obvious. The market is growing at a 39% compound annual rate, regulatory urgency is unambiguous, and NIST's finalized standards have removed the primary objection to starting migration planning. Accenture has published PQC whitepapers and built an AWS-integrated delivery model. McKinsey has published its PQC readiness framework. Deloitte's 2025 Tech Trends coverage flagged PQC as a near-term enterprise priority. Announcements will continue through the year.
What will separate the practices that scale from those that produce slide decks is migration delivery capability. A firm that generates a polished quantum risk assessment and a credible roadmap is not in a differentiated position by the end of 2026; every major firm will have that capability. The differentiation is in execution: the cryptographic engineers who can re-architect a financial institution's PKI infrastructure, migrate a healthcare network's data-at-rest encryption, or re-key an industrial control system without operational downtime.
Strategy firms that announce PQC practices without solving the technical talent question will stall at the roadmap stage. They will charge for assessments, deliver roadmaps, and watch clients turn to IBM, Accenture, or a specialized quantum-safe integrator for the actual migration. The assessment is the loss leader. The migration is the margin.
Who Owns the Client When the Engagement Scales
The defining commercial question is client ownership at migration scale. When an engagement spans three years and tens of millions in fees across a PE portfolio, the relationship follows the primary services agreement and the executive sponsor contact — and those two things will not always sit with the same firm.
IBM Consulting has a structural advantage in the migration phase because it controls the technical talent and can construct a managed quantum-safe services wrapper around the migration deliverable, effectively converting a project engagement into a recurring revenue relationship. That is an invoice architecture a pure strategy firm cannot replicate.
The PE market will play out differently from corporate clients. Fund managers care about deal risk and valuation impact, which keeps Bain central through the portfolio review cycle. But as portfolio companies exit and new owners inherit migrated cryptographic estates, the technical implementation partner's work becomes the lasting artifact. IBM's brand is on the architecture. Bain's brand is on the assessment deck that may be three years old at closing.
The firms that own the post-quantum consulting mandate across its full lifecycle are those that can credibly sign the migration services agreement. Right now, that cohort is IBM Consulting, Accenture, and emerging quantum-safe specialists. Bain's bet is that the assessment relationship is sticky enough to keep it at the table when the migration contract is structured — a reasonable position for the next 24 months. After 2028, as migration programs accelerate toward NSA's 2030 application deadline, clients will stop paying for strategy and start paying for execution. The firms without cryptographic implementation depth will lose that conversation.
Frequently Asked Questions
What did NIST finalize in 2024 and what are the key migration deadlines enterprises face?
NIST finalized three post-quantum cryptography standards in August 2024 — FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA) — ending an eight-year global evaluation process. The NSA's CNSA 2.0 framework sets January 2027 as the deadline for quantum-safe algorithms in new classified systems, 2030 for full application migration, and 2035 for complete infrastructure transition. These hard deadlines are driving the current surge in PQC assessment demand across enterprise and government clients.
Why are PE portfolio companies particularly exposed to quantum cryptographic risk?
PE-backed companies frequently share cryptographic infrastructure — centralized managed services, standardized ERP platforms, common identity management systems — deployed across entire fund portfolios by operating teams seeking efficiency. A single cryptographic vulnerability in that shared stack can cascade across dozens of companies simultaneously. Ropes & Gray's 2026 analysis found that 54% of risk managers at PE firms reported that up to a quarter of their portfolio companies suffered a cyber incident in the prior year, and the quantum exposure layer has yet to appear in most risk registers.
Is the harvest-now, decrypt-later threat real today, or is it a future risk?
HNDL is an active attack vector, not a speculative future risk. Adversaries are capturing encrypted network traffic today and storing it for decryption once cryptographically relevant quantum computers are available. Google's 2025 research reduced the estimated qubit count to break RSA-2048 from 20 million to under one million through software optimization alone, and a February 2026 preprint reduced that estimate further to under 100,000 physical qubits — compressing the timeline significantly from prior projections.
Which consulting firms currently have the technical depth to execute PQC migration, beyond just the assessment and roadmap phases?
IBM Consulting and Accenture are the most credentialed at the implementation layer. IBM brings its quantum computing research division's cryptographic expertise, while Accenture has built a delivery model integrated with AWS's quantum-safe services. McKinsey, BCG, and Bain have published authoritative research and can deliver risk assessments and strategic roadmaps but have not demonstrated the cryptographic engineering bench required to execute large-scale migration programs independently.
How large is the PQC consulting and migration market, and how fast is it growing?
Analysts project the post-quantum cryptography market will exceed $15 billion by 2030, growing at approximately 39% CAGR from its current base of under $1 billion. McKinsey's estimates are more conservative, projecting a $2.4-3.4 billion market by 2035 as the migration wave matures. The consulting and services segment led the market in 2024, and PRNewswire's February 2026 analysis characterized the full PQC transition as "the largest infrastructure refresh cycle since the Y2K remediation."