Chapter 1 — Advanced security decision-making
Lesson map
Lesson 01 published. Map, example, EX001.
flowchart TD
N0["Learning outcomes"]
N1["1.1 Deep uncertainty"]
N2["1.2 Three decision rules"]
N3["1.3 Models encode values"]
N4["1.4 Practical activity — Lab D"]
N5["1.5 Buying information"]
N6["1.6 Worked case"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX001"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["1.1 Deep uncertainty"]
N2["1.2 Three decision rules"]
N3["1.3 Models encode values"]
N4["1.4 Practical activity — Lab D"]
N5["1.5 Buying information"]
N6["1.6 Worked case"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX001"]
[Learning outcomes]
|
v
[1.1 Deep uncertainty]
|
v
[1.2 Three decision rules]
|
v
[1.3 Models encode values]
|
v
[1.4 Practical activity — Lab D]
|
v
[1.5 Buying information]
|
v
[1.6 Worked case]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX001]
Learning outcomes
You will (1) frame post-quantum migration as decision-making under deep uncertainty; (2) distinguish robust, optimal and regret-minimising choices; (3) make the value judgments inside a prioritisation model explicit; (4) build a decision record that survives audit and turnover; and (5) recognise when to decide now and when to buy information.
1.1 Deep uncertainty
Specialists are rarely short of opinions about when a cryptographically relevant quantum computer (CRQC) will exist; they are short of a defensible way to act without knowing. The arrival time z in Mosca's inequality (Mosca, 2018) is not a quantity with an agreed probability distribution. Public resource estimates have fallen — Gidney and Ekerå (2021) estimated 20 million noisy qubits for RSA-2048, Gidney (2025) under one million under stated assumptions — but resource estimates are not forecasts. This is deep uncertainty: parties cannot agree on the probabilities, and possibly not even on the model. Under deep uncertainty, optimising expected value with a single invented distribution produces false confidence. Prefer robust decisions: options that perform acceptably across all plausible scenarios, even if they are optimal in none.
1.2 Three decision rules
Expected-value choice weights outcomes by scenario probabilities; it is appropriate when probabilities are credible. Robust choice discards options that fail badly in any plausible scenario, then picks among the rest by cost. Minimax regret compares each option with the best option in hindsight for each scenario and chooses the one whose worst regret is smallest. For quantum migration, robust and regret framings often agree: starting hybrid key exchange on long-lived data flows has small regret if CRQCs arrive late (the cost is modest and builds agility) and avoids large regret if they arrive early (recorded data is protected).
1.3 Models encode values
A prioritisation score is not neutral. Multiplying records by harm weight favours volume; treating each person's lifetime privacy as paramount favours long-lived data regardless of volume. Lab D makes the point concrete.
At NRHT the choice is between weights that count records and weights that reflect the lifetime of harm to each patient. Neither is wrong as arithmetic, but they lead to different first projects. The board should see both rankings and choose, with the reason recorded in the decision record, rather than inherit a choice buried in a spreadsheet formula.
1.4 Practical activity — Lab D
# Lab D (ch 1): robust prioritisation - rank synthetic NRHT data flows by expected exposure across timeline scenarios.
flows = { # name: (confidentiality years x, migration years y, records in transit per year, harm weight) - synthetic
"genomics transfers": (50, 3, 2e4, 5), "EHR site replication": (25, 2, 3e6, 3),
"imaging to cloud reader": (10, 2, 8e5, 2), "staff rota sync": (1, 1, 5e5, 1)}
scenarios = {"early z=8": (8, 0.25), "mid z=15": (15, 0.5), "late z=25": (25, 0.25)} # (z, subjective weight)
score = {}
for name, (x, y, vol, harm) in flows.items():
s = sum(w * (vol * harm if x + y > z else 0) for z, w in scenarios.values())
score[name] = s
print(f"{name:24s} late in: {[k for k, (z, _) in scenarios.items() if x + y > z]}")
print("ranking by weighted exposure:", [n for n, _ in sorted(score.items(), key=lambda kv: -kv[1])])
Expected output:
genomics transfers late in: ['early z=8', 'mid z=15', 'late z=25']
EHR site replication late in: ['early z=8', 'mid z=15', 'late z=25']
imaging to cloud reader late in: ['early z=8']
staff rota sync late in: []
ranking by weighted exposure: ['EHR site replication', 'imaging to cloud reader', 'genomics transfers', 'staff rota sync']
The volume-weighted score ranks imaging above genomics even though genomic data is exposed in every scenario and stays sensitive for 50 years. The arithmetic is correct; the question is whether the board accepts its values. A specialist's job is to show both the "late in" column, which is value-light, and the weighted ranking, which is value-laden, and to make the choice of weights an explicit governance decision.
Change the harm weight for genomics from 5 to 50 and rerun: the ranking changes, though no fact about the flows has changed. That is the point to show the board. Keep the late-in column as the primary evidence and present the weighted ranking as one view among several, labelled with the weights used.
1.5 Buying information
Some uncertainty can be reduced cheaply: whether a vendor will ship hybrid IKEv2 next year, how many devices are unknown, what the real retention period of a dataset is. Value of information reasoning asks whether resolving an uncertainty could change the decision; if not, do not wait for it. CRQC timing usually cannot be bought; inventory facts usually can.
At NRHT the decision to act on the two long-lived flows did not depend on knowing z more precisely, so waiting for better estimates would have bought nothing. The device inventory, by contrast, was cheap to improve and could change which devices are handled first. Record which uncertainties were bought down and what they cost.
1.6 Worked case
NRHT's board must decide whether to fund an 18-month programme for hybrid key exchange on inter-site links now or wait two years for a planned network refresh. Scenario analysis: if z = 8, waiting exposes genomics and EHR replication traffic for two extra years of collection with no remedy; if z = 25, acting now costs perhaps 15 % more than folding work into the refresh. The worst regret of waiting (irreversible disclosure of 50-year data) dominates the worst regret of acting (moderate extra cost). Decision: act now on the two long-lived flows; defer the rest to the refresh; buy information on device inventory immediately.
1.7 Common errors and limits
- Treating a single CRQC date as the planning basis.
- Hiding value judgments inside scoring weights.
- Waiting for information that cannot change the decision.
Each error has a guard used in this chapter. Sweep z across scenarios and report which choices hold in all of them. Show the weights in any score and record who approved them. Before commissioning a study, ask whether any plausible result would change the decision; if not, decide now and note why. Keep the scenario table in the decision record.
Exercises
- EX001 — Decision rules. For NRHT's act-now/wait decision, state which option each of expected value (with P(z = 8) = 0.1), robust and minimax-regret framings favour, using qualitative reasoning. Rubric: 3 = all three framings applied with stated assumptions.
- EX002 — Values in the model. Propose a scoring change to Lab D that would rank genomics first, and state the value it encodes. Rubric: 3 = concrete change and explicit value.
- EX003 — Value of information. Name two uncertainties worth resolving before NRHT signs a VPN appliance contract, and one not worth waiting for. Rubric: 3 = justified by decision sensitivity.
- EX004 — Decision record. List the fields of a decision record that would let an auditor in 2032 understand the 2026 decision. Rubric: 3 = context, options, scenarios, values/weights, decision, owner, review trigger.
- EX005 — Robustness test. Define one scenario that would make "act now on long-lived flows" a poor decision, and say how plausible it is. Rubric: 3 = coherent scenario with honest assessment.
Synthesis
Quantum migration decisions are made under deep uncertainty. Robust and regret-based framings, explicit value judgments and targeted information-buying produce decisions that can be defended when the future arrives.