DeployQuantum Briefings

Software Ate the World. Now Services Are Eating Software.

Sun, 07 Jun 2026 08:00:00 GMT

Quick answer: Enterprises spend roughly six dollars on services for every dollar on software. AI now performs work instead of assisting it, so the next defining companies will sell outcomes, not logins: services businesses on the invoice, software companies underneath. The test is the cost curve. If the second customer costs materially less to serve than the first, the business compounds like software. Fragmented markets such as quantum reward this deployment layer most.

For every dollar companies spend on software, they spend roughly six on services. That ratio, repeated across several independent market estimates, explains where venture capital is moving in 2026.

In 2011, the claim that software was eating the world sounded contrarian. It turned out right. A decade ago there were 15 SaaS unicorns; Foundation Capital now counts more than 400. Software won. The question now is what comes next, and the answer is services, though not in the traditional sense.

How much bigger is the services market than software?

When an investor at Sequoia says the next trillion-dollar company will be "a software company masquerading as a services firm," many people picture consultants, hourly billing, and slide decks. That is the wrong mental model. The reason capital is moving is size.

Source	Estimate
NFX	~$5 trillion in knowledge work vs ~$230 billion in B2B software
a16z	~$6 trillion in white-collar services
Foundation Capital	$4.6 trillion opportunity
J.P. Morgan	$3 to $5 trillion
HFS Research	$1.5 trillion

The estimates differ. The conclusion does not: services dwarf software.

Salesforce illustrates the gap. It generates roughly $35 billion in annual revenue while companies spend around $1.1 trillion every year on sales and marketing salaries. Software captured a fraction of the value surrounding the work. The work itself stayed outside the product.

Until now.

What changed in how the work gets done?

AI increasingly performs tasks instead of assisting with them. Sequoia describes the transition as moving from copilots to autopilots. Greylock frames it as the agent completing most of the work while a human reviews the output. NFX reverses the acronym: software as a service becomes service as software.

The strategic consequence matters more than the labels. A company that sells software watches every improvement in the underlying models compress its differentiation. A company that sells outcomes watches every improvement make its delivery faster, cheaper, and more scalable. The technology stops being the product and becomes the engine behind it.

The model providers have reached the same conclusion. OpenAI launched a dedicated deployment company backed by more than $4 billion and acquired Tomoro to build a large forward-deployed engineering organization. Anthropic has made similar moves with partners including Blackstone, Hellman & Friedman, and Goldman Sachs, on the argument that enterprise demand exceeds any single delivery model. Both resemble the approach Palantir established years earlier: embed engineers with customers, solve the problem, then turn bespoke deployments into reusable products. Gravel roads become paved highways, as Palantir put it.

Investors are rewarding that model with software valuations. Sierra, Harvey, Abridge, EvenUp, and Decagon each own outcomes in a single vertical rather than selling seats, and most operate in regulated industries: law, healthcare, accounting, insurance.

What separates a deployment layer from services with AI on top?

The objections deserve a hearing. Better Tomorrow Ventures argues that AI makes services firms more efficient without turning them into software companies, because clients still pay for trust, credentials, and liability. Valere makes the same point in margin terms: a business that depends entirely on rented foundation models keeps its margin pinned to the spread between what customers pay and what the models cost. Software businesses run gross margins of 70 to 85 percent. Traditional professional services often run closer to 30 to 40.

The distinction is the cost curve, and one test captures it. Does serving the second customer cost materially less than serving the first? If yes, the business is accumulating proprietary advantage and starting to behave like software. If not, it is a services business with AI layered on top.

Three elements have to be present for the test to come out yes.

A technology stack that performs the work, rather than people assisted by tools.
Reusable product modules that make every deployment easier than the last. By the third or fourth engagement, software carries most of the delivery and humans supervise exceptions. That is when a services cost curve starts behaving like a software cost curve.
Value capture across the funnel: a free layer that identifies the problem, a paid layer that executes the work, and a product layer that compounds knowledge into reusable IP after the engagement ends.

We call that combination the deployment layer. A deployment layer sells outcomes instead of logins.

Why is quantum the clearest case?

The trend is global. One market makes it unusually clear.

AI is converging around a handful of dominant architectures. Quantum is diverging: multiple hardware modalities, sensing platforms, software stacks, post-quantum cryptography schemes, and industry-specific applications, with no standard toolchain connecting them. McKinsey estimates the sector attracted $12.6 billion in 2025. Very little of that capital has gone toward making the technology deployable inside enterprises.

For buyers, fragmentation is the bottleneck, not hardware. Building qubits is one problem. Integrating systems, managing migrations, producing evidence, and satisfying regulators is another, and that second problem exists today regardless of future hardware progress. DORA is already in force across EU financial institutions, and post-quantum cryptography migration is already on regulatory timetables. That second problem is deployment work, the kind our build engagements are scoped to deliver.

The more fragmented a market becomes, the more valuable its deployment layer becomes.

Software ate the world by replacing tools. Services are eating software by owning outcomes. The defining companies of the next decade will look like services businesses to their customers and operate like software companies underneath. The rest will be consulting firms with better marketing. In a market as fragmented as quantum, that difference is worth the most.

The $7.1 billion floor: what the US federal PQC migration estimate leaves out

Wed, 20 May 2026 08:00:00 GMT

Quick answer: The US federal estimate for migrating civilian systems to post-quantum cryptography is $7.1 billion, per the OMB and ONCD report of July 2024 mandated by the Quantum Computing Cybersecurity Preparedness Act. Defense and intelligence are excluded, so the figure is a floor. With Gartner dating current asymmetric cryptography unsafe by 2029 and Google targeting 2029 internally, the binding constraint is calendar: inventory, dependency mapping, and firmware replacement do not compress.

$7.1 billion is the federal estimate for migrating US civilian systems to post-quantum cryptography. The figure comes from the OMB and ONCD report mandated by the Quantum Computing Cybersecurity Preparedness Act, published July 2024. Defense and intelligence are excluded; national security systems are scoped separately and their costs are not disclosed.

The conversation has moved past whether to migrate, and past when. What remains open is the sequencing, and who still has room on the calendar to sequence at all.

Why is the figure a floor, not a ceiling?

The estimate covers civilian agencies over the 2025 to 2035 window, per the same report. Classified systems sit outside it. So does every private-sector system, and the report flags inventory-driven uncertainty in its own number. Each exclusion pushes the true total in one direction: up.

Which clocks set the schedule?

Per Gartner research, current asymmetric cryptography is dated unsafe by 2029 and fully breakable by 2034. Per the Google security blog of March 2026, Google has set its internal migration target to 2029. The NIST IR 8547 transition plan deprecates RSA-2048 and ECC P-256 by 2030 and phases them out by 2035.

Clock	Year	Source
Current asymmetric cryptography dated unsafe	2029	Gartner research
Google internal migration target	2029	Google security blog, March 2026
RSA-2048 and ECC P-256 deprecated	2030	NIST IR 8547
Current asymmetric cryptography fully breakable	2034	Gartner research
RSA-2048 and ECC P-256 phased out	2035	NIST IR 8547

The 2030 deprecation and the 2035 phase-out now sit downstream of the 2029 clocks, not upstream.

What does waiting actually cost?

Waiting reprices the project. The same migration, started later, runs inside a compressed window with fewer vendors available, and the difference shows up in three places.

An organization starting today has time to identify legacy systems where cryptographic functions are buried in firmware and cannot be patched in place. A late starter does not. The early mover chooses between three certificate authorities; the 2028 entrant takes whoever has capacity. Piloting, measuring, and retiring approaches that do not work is a calendar privilege; the compressed alternative ships once.

What is the structural work?

The standards are settled, so algorithm selection is not the project. The project is the cryptographic inventory, the dependency map, the embedded-firmware replacement, and the supply-chain coordination. None of those scale linearly with budget. They scale with calendar.

The federal estimate carries an explicit note about uncertainty driven by inventory. Most organizations do not yet know which of their systems use which cryptographic algorithms, where the keys live, or how dependencies cascade through their supply chain. That uncertainty does not improve with time; it compounds. A free PQC assessment is one way to start replacing that uncertainty with a list.

$7.1 billion is what one government has put in writing as a floor, for civilian systems alone. The private-sector total is not yet costed at that resolution. When it is, the math will not flatter the late movers.

CNN's Q-Day story of 17 May 2026 moved post-quantum migration into the mainstream

Mon, 18 May 2026 08:00:00 GMT

Quick answer: CNN published a Q-Day explainer on its science vertical on 17 May 2026, putting harvest-now-decrypt-later and the 2029 migration targets of Google and Cloudflare in front of a general audience. More than 90% of businesses still lack a quantum-security roadmap, per a McKinsey figure cited in the piece. The bottleneck has moved from awareness to execution: turning roadmaps into deployed code and signed audits.

CNN published a Q-Day explainer on its science vertical on 17 May 2026. The numbers inside the piece were familiar to anyone working on post-quantum migration. The placement was the news: when a mass-market outlet runs the story, the conversation is no longer specialist.

What did the CNN piece cover?

For most of the last decade, post-quantum cryptography lived inside infosec teams, standards bodies, and a small ring of academic centres. The audience was self-selected and the deadlines were soft.

The CNN piece walks a general reader through harvest-now-decrypt-later, the NIST PQC standards, Google's 2029 internal migration target, Cloudflare's 2029 target, and a McKinsey figure that more than 90% of businesses still do not have a quantum-security roadmap. It also quotes the NIST PQC lead on precedent: historical cryptographic migrations have taken 10 to 20 years. By the middle of the article, a general reader holds the vocabulary a CISO held two years ago.

Why does mainstream coverage matter for boards?

Boards, innovation committees, and family-office principals read CNN. The lag between a topic appearing in general business news and a chairman raising it on a Monday morning is brief. Once a topic is mainstream enough to land in an inbox, it is mainstream enough to land in a board paper, and the first question that follows is whether a plan exists.

Directors building that vocabulary from a standing start can work through the free quantum readiness courses at their own pace.

What is already settled?

Awareness was the bottleneck for a decade. The record below shows why it no longer is.

Date	Milestone	Source
2022	White House memo sets a 2035 PQC target for federal agencies	M-23-02
2024	NIST finalises the PQC standards, FIPS 203 (ML-KEM) and FIPS 204 (ML-DSA)	NIST
25 March 2026	Google publishes a 2029 internal migration target	Google blog
March 2026	Cloudflare publishes a 2029 migration target	Cloudflare roadmap
April 2026	Meta publishes its migration framework	Meta Engineering blog
17 May 2026	Q-Day reaches a mass-market science vertical	CNN

The reference clock moved from 2035 to 2029 inside four years, and operators set the new pace ahead of regulators.

Where is the gap now?

Execution. The distance between deciding to migrate and having migrated is the work that does not make press releases: turning a roadmap into deployed code, a signed audit, and a migration plan a custodian will accept.

That work is the deployment layer. The category exists because the standards are finished, the demand is now visible from the general press, and the in-house teams to run the work are scarce. CNN coverage is the demand signal; what happens after the reader closes the tab is the supply question. Both sides of that equation became visible in the same week.

The next question a chairman asks is whether there is a plan. The useful preparation is having the answer ready before the question arrives.

LayerQu, the post-quantum readiness reference for L1 and L2 chains

Tue, 12 May 2026 08:00:00 GMT

Quick answer: LayerQu, the post-quantum readiness reference for L1 and L2 chains, launched on 12 May 2026. 67 chains were scored under the v3.1 methodology at launch (May 2026). The methodology, the scores, and the evidence behind every score are open, sourced only from public artefacts: client code, governance proposals, foundation announcements, and peer-reviewed papers. There are no paid listings and no sponsored upgrades.

LayerQu, the post-quantum readiness reference for L1 and L2 chains, launched on 12 May 2026. 67 chains were scored under the v3.1 methodology at launch (May 2026), with the methodology, the scores, and the evidence behind every score published in the open. DeployQuantum is the deployment company for the quantum era; LayerQu is the part of that work aimed at public chains.

Why do public chains fall out of quantum-readiness roadmaps?

Most quantum-readiness work assumes a familiar shape: a CISO who owns the cryptographic estate, an audit committee that asks for a plan, a board that signs the budget. Almost every published methodology fits that shape. Public blockchains do not.

Ethereum has no CISO. No audit committee reads Solana's GitHub. Bitcoin holds no quarterly governance call where a vendor presents the migration plan. A chain has a foundation, a developer community, a DAO, and a hard fork process that is not a procurement question.

The cryptography is not what differs. The same elliptic-curve and hash assumptions everyone else depends on sit at the bottom of every Layer 1 and Layer 2. What is missing is the governance container for the migration: the named owner, the audit deadline, and the public scorecard an institutional buyer can quote. So blockchain quietly drops out of most quantum-readiness roadmaps.

What does LayerQu publish?

Open scores, an open methodology, and the evidence behind every score. Everything is sourced from public artefacts the chain itself has already published: client code, governance proposals, foundation announcements, and peer-reviewed papers. There are no paid listings, no sponsored upgrades, and no foundation reviewers behind the curtain.

Launch fact	Value
Chains scored at launch (May 2026)	67, under the v3.1 methodology
Methodology revisions in the six weeks before launch	3
Paid listings, sponsored upgrades, foundation reviewers	0

LayerQu extends the public surfaces DQ already maintains: post-quantum migration assessments, quantum readiness scoring for organisations, and vendor and research mapping published as open research data.

Who is the reference for?

People inside chains who already get the quantum question and need somewhere to point a serious answer. Sometimes the question arrives from an institutional partner, sometimes from a journalist, sometimes from an auditor. The head of ecosystem, the head of community, and the head of security have mostly known it was coming; few have had a public reference they could hand over. That reference now exists.

It is deliberately unfinished. The methodology was revised three times in the six weeks before launch, and it will be revised again the moment a chain disputes a call with a primary source. That is the design.

Chain foundations, DAOs, ecosystem teams, research collectives, and institutional desks that touch digital assets get the same invitation: come and look, push back on a score, contribute a primary source, or propose a new gate.

Meta's five-level post-quantum migration framework, April 2026

Sat, 09 May 2026 08:00:00 GMT

Quick answer: On 16 April 2026 Meta published the framework guiding its own post-quantum migration: five maturity levels, from PQ-Unaware to PQ-Enabled, and a six-phase programme that starts with cryptographic inventory. Meta recommends ML-KEM-768 for key encapsulation and ML-DSA-65 for signatures, both finalised in NIST FIPS 203 and 204 in August 2024. Most enterprise systems today sit at the first or second maturity level.

On 16 April 2026, Meta published the framework it uses to migrate its own infrastructure to post-quantum cryptography, on its engineering blog. Public, in-progress migration accounts from operators at that scale are rare. The substance is more useful than any vendor whitepaper published this quarter.

What are the five migration levels?

The framework defines five maturity levels: PQ-Unaware, PQ-Aware, PQ-Ready, PQ-Hardened, and PQ-Enabled. Most enterprise systems today sit at the first or second level.

The path from there to PQ-Enabled is not a vendor selection. Meta describes a six-phase programme that starts with cryptographic inventory and ends with PQC components integrated into production protocols. The timeline is stated in plain language: "years of phased work across protocols, products, and infrastructure."

Two implications follow from Meta's account. The binding artefact of the migration is the inventory, not the roadmap. And the algorithm choices are now stable, which removes the standing reason for waiting. The two sections below take each in turn.

Why is the inventory the binding artefact?

A migration plan written on top of an unknown inventory is fiction. Per the 2026 Entrust and Ponemon Institute Global State of Post-Quantum and Cryptographic Security study (n=4,000), only 43% of surveyed organisations report full visibility into the certificates inside their own enterprise. 41% name limited cryptographic visibility as the top barrier to readiness.

The roadmap is the artefact boards ask for. The inventory is the artefact the roadmap depends on. Organisations that want a first read on their own position before commissioning the full inventory can take DQ's free PQC scan.

Are the algorithm choices still moving?

No. The recommendations are specific and the standards behind them are final.

Function	Meta recommendation	Standard	Date
Key encapsulation	ML-KEM, with ML-KEM-768 at NIST Security Level 3	NIST FIPS 203	Finalised August 2024
Digital signatures	ML-DSA, with ML-DSA-65	NIST FIPS 204	Finalised August 2024
Backup KEM	HQC	NIST selection	March 2025

The "wait for the standards to settle" position no longer maps to anything real. The standards settled in August 2024, and the backup KEM was named in March 2025.

What is the board question this quarter?

Which migration level the organisation can defend at the next audit, and what evidence backs the answer. For most enterprises the honest answer today is PQ-Aware at best. Defending that answer with evidence is still a stronger position than presenting a roadmap the inventory cannot support.

The work that moves the level up is dull and specific: inventory, hybrid deployment, guardrails, and integration, years of it on Meta's own account. Organisations that land at PQ-Enabled by the end of the decade will be the ones that started the inventory in 2026. Those that did not will still be defending PQ-Aware in 2030.

DORA's implicit post-quantum mandate: RTS 2024/1774, Articles 6 and 7

Thu, 07 May 2026 08:00:00 GMT

Quick answer: DORA does not mandate post-quantum cryptography by name. Commission Delegated Regulation (EU) 2024/1774, Articles 6 and 7, requires in-scope financial entities to monitor cryptographic threats, named in the preamble to include quantum advancements, and to mitigate them through a flexible, risk-based approach. More than 22,000 EU financial entities are in scope, per the European Commission's DORA impact assessment. Supervisors read the RTS as requiring a dated migration plan toward NIST FIPS 203, 204 and 205.

More than 22,000 financial entities fall under the Digital Operational Resilience Act, Regulation (EU) 2022/2554, per the European Commission's impact assessment (SWD(2020) 198 final). DORA has applied since 17 January 2025. Its text never names post-quantum cryptography.

The cryptography requirements sit one layer down. Commission Delegated Regulation (EU) 2024/1774, the regulatory technical standards on ICT risk management adopted under DORA, sets the operational rules in Articles 6 and 7. The preamble names cryptographic threats, including those arising from quantum advancements, and requires a flexible approach based on mitigation and monitoring. That wording traces to the ESAs Joint Committee final report on the draft RTS (JC 2023 86, January 2024).

Does DORA mandate post-quantum cryptography?

Not by name. The distance between the two honest readings of that fact is where the supervisory dialogue of the next three years will play out.

Counsel tends to read the RTS as "PQC is not mandated." True, narrowly. Supervisors read the same text as "cryptographic agility is mandated, and quantum is the named test of that agility." Also true, and more useful. The first reading produces a clean memo for the risk committee. The second produces a funded roadmap.

We expect supervisory dialogue to reward the second reading by 2027 and to penalise the first. The cost of holding the narrow reading is not a fine. It is the slow narrowing of the acceptable answer to a routine ICT risk question, until "we are monitoring developments" stops landing.

What are the institutions ahead of the requirement doing?

They are not running quantum research programmes. The institutions ahead of this treated the RTS preamble as an instruction and produced three artefacts: a cryptographic asset inventory, a classification of systems by data shelf-life, and a dated migration plan pointing at NIST FIPS 203, 204 and 205 as the destination.

NIST finalised those three standards in August 2024, so the destination has stopped moving. The shelf-life classification decides sequence: systems carrying data whose confidentiality must outlive the transition window come first. DQ collects documented migration cases in its open PQC case intelligence.

How does the EU calendar compare with other jurisdictions?

Jurisdiction	Instrument	Milestone
European Union	Commission Recommendation on a Coordinated Implementation Roadmap, 11 April 2024	2030 for high-risk systems, 2035 for full transition
United States	NIST FIPS 203, 204 and 205	Standards finalised August 2024
Canada	Canadian Centre for Cyber Security ITSM.40.001	April 2026 federal planning deadline
Australia	ASD/ACSC post-quantum planning guidance	End-2030 cessation of classical asymmetric cryptography

The cluster is real and the calendar is tight. A financial entity that waits for an explicit PQC mandate inside DORA will reach the 2030 milestone unprepared, because the work the milestone assumes, inventory, classification and a dated plan, consumes the years in between.

The narrow reading of DORA buys two budget cycles of comfort. The wider reading buys a 2030 audit that closes clean. Either way, the choice sits on the board paper this quarter, named or unnamed.

The 11-to-1 gap: $12.6 billion into quantum in 2025, just over $1 billion back

Mon, 04 May 2026 08:00:00 GMT

Quick answer: Quantum attracted $12.6 billion of investment in 2025 against just over $1 billion of revenue, an 11-to-1 gap, per the McKinsey Quantum Technology Monitor, April 2026. The hardware layer is consolidating while more than 300 companies already pay for quantum work. What is missing is the deployment layer that turns committed capital and committed buyers into shipped use cases inside a single budget cycle.

Quantum attracted $12.6 billion of investment in 2025 and returned just over $1 billion in revenue. The figures come from the McKinsey Quantum Technology Monitor, April 2026. Eleven dollars in for every dollar out, and that ratio is the most useful single number for reading the quantum market this year.

Where did the capital concentrate?

Per the same report, annual investment ran 6.3x year over year. Capital markets supplied 44% of the total, and the top 10 deals consumed roughly 60% of the year's capital. Read together, those three numbers describe a hardware layer consolidating in real time: fewer, larger bets on the companies building the processors.

The deployment layer shows no such consolidation. No comparable concentration of capital, talent, or tooling exists at the layer where quantum work gets integrated into production systems. That asymmetry is the structural fact of the 2025 market.

Who is already paying for quantum work?

McKinsey counts more than 300 companies already paying for quantum work. The median use-case budget sits near $6 million, willingness to pay reaches about $13 million per use case, and 7% of buyers run programs above $200 million. The same report puts $1.3 to $2.7 trillion of value at stake across industries by 2035.

Measure	Figure
Investment into quantum, 2025	$12.6 billion
Quantum revenue, 2025	just over $1 billion
Year-over-year investment growth	6.3x
Share of investment from capital markets	44%
Share of the year's capital in the top 10 deals	roughly 60%
Companies already paying for quantum work	more than 300
Median use-case budget	about $6 million
Willingness to pay per use case	near $13 million
Buyers running programs above $200 million	7%
Value at stake across industries by 2035	$1.3 to $2.7 trillion

All figures per the McKinsey Quantum Technology Monitor, April 2026.

What is missing between capital and revenue?

Capital is committed. Buyers are committed. The layer that turns commitment into shipped use cases inside a single budget cycle is the one still missing at scale.

McKinsey's integration framing points at where this resolves. Quantum compute belongs alongside CPU and GPU in the existing HPC stack, with software-defined layers routing workloads dynamically. On that reading, the QPU is a new accelerator inside a grid that already runs, and the work of the next phase is integration work: scheduling, routing, validation, and the operational plumbing that lets a quantum workload sit inside an existing compute budget.

That deployment layer is the un-consolidated layer of the quantum economy.

Why is 2026 the year this stops being speculative?

The sanity checks now sit outside the market itself. NIST has closed the PQC standards. The EU FS-PQC schedule is firm. US federal procurement is mandated to PQC by 2030. Each of those is a fixed point that does not move with sentiment, and together they put a calendar under decisions that used to float.

The window before the late-mover premium starts to compound is open and narrowing. Organisations that want to locate themselves on that calendar can start with the QR8 readiness scan, free and self-serve.

If a 2026 plan still treats quantum as a 2030 question, it is built on the wrong calendar.