Empirical Audit of Proactive Refactoring Costs versus Deferred Vendor Integration

How do cumulative operational and refactoring expenditures over a multi-year period compare between financial institutions deploying early custom PQC solutions and those waiting for mature vendor hardware security module updates?

1. Introduction

This proposal introduces the historical and operational context of technology cost estimation in the financial sector. The field's roots lie in the broader challenge of quantifying technical risk alongside operational expenditure. Initially, technology cost estimation and risk assessment operated as separate disciplines. In 1995, communities began integrating risk assessment directly into software cost estimation [1], a practice that formalized over the following years [2] and culminated in hybrid methodologies for benchmarking costs by 1998 [3]. This methodological integration allowed researchers to model cost efficiency structurally across different regional banking systems and cooperative institutions [4], [5]. It established the baseline unit of institutional efficiency, allowing financial entities to measure how technological overhead impacted their broader economic performance.

As financial architectures aged, the primary question shifted from calculating general IT efficiency to measuring the specific burden of adaptive maintenance. By 2008, the imperative to migrate legacy software to web-enabling environments introduced legacy modernization as a primary cost driver [6]. Concurrently, financial institutions began modelling their risk management infrastructure systemically as a living system, recognizing that institutional longevity depended on the structural soundness of underlying processes rather than surface-level fixes [7]. To accurately estimate the costs of these complex implementations, the field borrowed advanced probabilistic methodologies originally developed for heavy construction and drilling [8]. This enabled a conceptual shift from risk minimization—managing ongoing exposure to vulnerabilities—to alternatives assessment, which focuses on structural hazard avoidance through wholesale infrastructure changes [9].

The way of estimating infrastructure costs narrowed explicitly onto banking legacy platforms, many of which relied on decades-old COBOL architectures. By 2022, the inability of these aging systems to support modern customer demands forced the field to evaluate migration strategies governed by strict cost optimization metrics [10]. Researchers established that transitioning legacy data systems to cloud-based architectures resolved historic rigidity and scalability limitations, fundamentally altering how financial institutions planned transitions [11]. Migration was no longer viewed as maintenance overhead, but as an incremental process of strategic re-platforming designed to maximize agility and data-driven decision-making [10], [11].

2. Theoretical Background

Building on this history, current theoretical models emphasize the necessity of cryptographic agility in modern network modernization. This trajectory of modernization changed abruptly with the realization that cryptographically relevant quantum computers threaten the public-key infrastructure underpinning newly modernized enterprise networks [12]. Driven by algorithms capable of breaking current encryption paradigms, the field shifted its focus entirely toward Post-Quantum Cryptography (PQC) integration [12]. Adapting strategies developed in telecommunications for quantum-safe data transmission [13], financial institutions were forced to evaluate the systemic risk of adversaries harvesting encrypted data today for future decryption [12]. This reframed cryptographic migration from a routine security patch into a complex, system-wide architectural dependency challenge involving cloud, private infrastructure, and edge devices [12].

Today, the field evaluates post-quantum migration costs through the lens of cryptographic agility. Frameworks such as the Quantum Readiness Maturity Model assess organizational preparedness not as a technical upgrade, but as a strategic enterprise capability encompassing governance, interoperability, and infrastructural resilience [14]. By tracking the integration of lattice-based schemes like CRYSTALS-Kyber into financial frameworks, researchers now measure how adopting blockchain and quantum-resistant models actively reduces breach frequencies and financial losses [15]. The endpoint of this trajectory is a field that quantifies migration costs by balancing structural key management complexity against existential cryptographic hazards, establishing a defined roadmap for financial infrastructure security [15], [14].

3. Statement of the Problem

Against this theoretical backdrop, a central challenge emerges regarding the optimal timing and cost efficiency of post-quantum cryptography integration. Does early proactive PQC migration reduce long-term costs compared to waiting for mature vendor solutions? This remains unresolved because proponents of early adoption argue it prevents expensive emergency remediation, while advocates for waiting contend that early implementations risk costly refactoring if standards or vendor tools evolve.

Limited evidence characterizes the current literature, which relies on theoretical decision models, risk frameworks, and timeline projections rather than empirical expenditure data comparing early and deferred migration outcomes. Furthermore, existing studies depend on surrogate risk metrics and model-dependent threat-arrival assumptions, leaving real-world capital savings and vendor maturity trade-offs unverified.

Proponents of a proactive migration strategy emphasize that post-quantum cryptography migration is a complex, multi-year undertaking requiring long lead times and structured risk metrics. The retrieved literature details extended migration timelines ranging from five to over fifteen years across different organization sizes and introduces frameworks for cryptographic cost estimation and risk prioritization. However, these studies focus primarily on timeline forecasting and risk scoring rather than providing empirical proof that early migration reduces total long-term expenditures.

Arguments evaluating a deferred migration strategy rely on decision-analytic frameworks and economic modeling of transition timing under uncertainty. A 2026 decision-theoretic synthesis demonstrates that recommendations for early versus late migration depend heavily on modeling assumptions, threat-arrival inputs, discount rates, and real-options evaluations. Additional review work in the financial sector examines deployment barriers and candidate standards, though the retrieved literature does not empirically prove that waiting minimizes sunk costs.

4. Review of Prior Research

A deeper examination of the literature reveals the foundational models, adjacent debates, and significant limitations driving the current divide in mitigation strategies.

Widely Reported Context

The transition to post-quantum cryptography (PQC) is recognized as a complex infrastructure challenge that extends far beyond the simple substitution of cryptographic algorithms. Migration mandates are now governed by formal standards, including the finalized FIPS 203, 204, and 205 baselines [16], [17]. The literature establishes that cryptographic dependencies permeate the entire operational ecosystem, spanning keys, digital certificates, trust anchors, hardware security modules, protocol stacks, and legacy systems [18].

Migration pathways and adoption rates are actively being mapped across different network instruments [19]. The shift is characterized as a systemic transition in infrastructure and lifecycle management rather than an isolated technical update [20]. Vulnerabilities are exacerbated by the operational lifetimes of deployed devices, many of which will remain in service past 2040 [21]. The threat landscape driving this transition includes the immediate risk of "Harvest Now, Decrypt Later" (HNDL) data interception [20]. Despite identical algorithmic resistance profiles, equivalent assets can impose vastly different migration costs depending on the delivery channels protecting their keys and the speed at which their primitives can be replaced [17].

The Competing Positions

Proactive Migration Strategy: Proponents of early, proactive migration argue that organizations must act immediately to prevent the catastrophic exposure of long-lived assets to future quantum decryption. This position relies heavily on the concept of HNDL tactics, where adversaries intercept encrypted data today to decrypt it once cryptographically relevant quantum computers (CRQCs) become available [22], [20]. Advocates for this strategy emphasize that delaying migration exacerbates a growing cryptographic readiness deficit, particularly for infrastructure operating on constrained revenue bases or deploying devices with service lives extending decades into the future [21]. From this perspective, the overarching threat to assets with extended lifespans necessitates immediate transition planning, as the operational reality of managing TLS and PKI infrastructure makes sequencing and validating late-stage migrations difficult [20].

Deferred Migration Strategy: The strategy favoring deferred migration contends that moving before vendor solutions mature risks extensive sunk costs and unnecessary refactoring. A decision-theoretic synthesis reports that recommendations for the optimal timing of post-quantum migration diverge significantly, and this disagreement traces back to specific modeling choices rather than empirical data [22]. The case for waiting rests on economic modeling that evaluates transition timing under uncertainty, utilizing expected-value equations, net-present-value cost models, and real-options models adapted from information-security investment practices [22]. This position argues that the decision to delay migration is economically rational depending on the discount rate applied to deferred costs and the assumed probability distribution of CRQC arrival [22]. Furthermore, advocates for waiting point out that emerging solutions—such as leveraging hardware security modules as crypto-agile platforms—might soon allow for secure transitions without requiring complete hardware replacement, suggesting that deferred action could ultimately lower capital expenditures [23].

Foundational Work Behind the Debate

The current debate is shaped by prior research that formalized the measurement of cryptographic risk and operational agility. Initially, cryptographic discovery tools only evaluated whether a single asset's primitive was post-quantum resistant. Foundational work proposes treating quantum risk posture as a three-axis observability problem: grading assets based on algorithmic resistance, the channel for key delivery, and replacement agility, ultimately generating a deadline-adjusted score [17].

To operationalize these observations, researchers develop frameworks that treat legacy compatibility, protocol negotiation, and key rotation as parts of a unified lifecycle-oriented control system [18]. This work introduces proposed metrics such as Algorithm Replacement Time, Key Rotation Time, Certificate Replacement Time, and a Cryptographic Agility Score (CAS) [18]. By mapping dependencies across trust stores and certificate authorities, the literature shifts the focus from purely theoretical cryptography to the measurable mechanics of migration governance [20]. These frameworks establish the parameters for the debate over transition timing, providing the vocabulary necessary to weigh the speed of algorithm replacement against the risks of long-term dependency.

Adjacent Debates and Neighbouring Evidence

The post-quantum transition impacts a variety of fields, providing transferable parallels for evaluating migration strategies. In the automotive sector, researchers evaluate how software-defined vehicles can utilize hardware security modules to support hybrid and fully post-quantum deployments, demonstrating that achieving crypto-agility does not inherently require wholesale hardware replacement [23]. In the energy sector, studies analyzing cyber-physical distributed energy resources establish a 5-to-10-year window before the new quantum era, emphasizing the need for defense strategies such as Quantum Key Distribution (QKD) alongside PQC [24].

Similar dependency challenges appear in election administration. A standards-level gap analysis reports that baseline certification guidelines (such as VVSG 2.0) structurally mandate the use of quantum-vulnerable primitives like RSA and ECDSA for digital signatures, indicating severe legacy entrenchment [16]. In artificial intelligence, an analysis suggests that classical digital signatures used to verify dataset integrity, model lineage, and automated training pipelines will become vulnerable to quantum-enabled forgery well within the operational lifetimes of complex AI systems [25].

Researchers are similarly exploring post-quantum mechanics across diverse network environments, including real-time cryptographic agility in autonomous UAV swarms [26], hardening cryptographic keys on the industrial internet [27], policy-governed migration for legacy microservices [28], automated critical infrastructure frameworks [29], and cloud-native AI workloads [30]. Across these varied domains, the consistent finding is that early integration of crypto-agility mechanisms is critical to avoiding systemic obsolescence.

Contradictory and Inconsistent Findings

The retrieved literature exhibits stark contradictions regarding the timeline for optimal migration, driven predominantly by theoretical models rather than observed outcomes. A synthesis of decision-analytic models finds that different mathematical frameworks generate opposing recommendations [22]. For instance, models that apply high discount rates to deferred costs or omit the harm from "harvest now, decrypt later" scenarios routinely favor delayed migration [22]. Conversely, portfolio models and risk inequality formulas that emphasize decision-making under deep uncertainty favor early action [22]. The discrepancy is explained entirely by the selection of inputs—specifically the assumed arrival distribution of CRQCs and the treatment of deferred harm—rather than inconsistencies in the underlying cryptographic science [22].

Limitations of the Existing Evidence

The primary limitation of the current evidence base is a complete absence of empirical cost data. The retrieved studies depend exclusively on theoretical decision models, conceptual frameworks, and proposed risk metrics [22], [17], [18], [20]. Work establishing metrics like the Cryptographic Agility Score (CAS) explicitly defines them as transparent research tools tested through sensitivity analysis, rather than production measurement studies validated against real-world systems [18].

Similarly, readiness frameworks and dependency maps rely on literature reviews, established standards, and public data overlays rather than historical expenditure tracking [21], [20]. The available research constructs sophisticated economic models for migration timing but lacks the retrospective financial data necessary to verify if deferred migration successfully avoids sunk costs or if proactive migration truly prevents expensive emergency remediation [22].

What Remains Unresolved

The literature genuinely cannot settle the central question of whether proactive migration reduces long-term operational costs compared to deferred migration. The actual financial outlay required to refactor legacy dependencies, replace certificates, and maintain parallel hybrid architectures remains unquantified. Furthermore, it is unresolved whether waiting for mature vendor tools—such as fully interoperable crypto-agile hardware security modules—ultimately minimizes total expenditures.

5. Research Gap and Purpose of the Study

Addressing the empirical limitations identified in prior research, this study proposes a targeted financial audit of migration strategies. Existing research relies on theoretical economic models and sensitivity analyses without empirical financial data tracking actual engineering hours, patch overhead, and refactoring expenses incurred by early PQC adopters. This leaves the debate unresolved: proponents of early PQC adoption argue it prevents expensive emergency remediation, while advocates for waiting contend that early implementations risk costly refactoring as vendor solutions mature.

The purpose of this study is to conduct a retrospective cost audit across financial institutions comparing total multi-year expenditures of early custom migration patterns against deferred implementations awaiting native vendor hardware support. Decision-theoretic models currently yield opposing migration timing recommendations because they depend on theoretical assumptions rather than verified expenditure data regarding refactoring costs and vendor maturity trade-offs [22].

This research matters because if the prevailing assumption that early proactive refactoring minimizes overall migration expenditures is incorrect, enterprise chief information security officers and software architects will misallocate operational budgets into custom integration layers that ultimately require costly deprecation. Engineering teams would incur double expenditure by maintaining unstable custom codebases only to refactor them again once hardware vendors release standardized, native security modules. Conversely, if delaying migration under the expectation of cheaper vendor integration proves false, risk managers face acute emergency remediation expenses and severe operational disruptions when legacy cryptographic dependencies are abruptly deprecated.

6. Research Questions and Hypotheses

To address this gap, the following research questions and hypotheses have been formulated.

How do cumulative operational and refactoring expenditures over a multi-year period compare between financial institutions deploying varying proportions of custom PQC solutions versus those relying on mature vendor hardware security module updates?

Hypotheses

(Note: H1 and H2 represent directional tests of the expenditure comparison).

7. Method

The methodology outlines the specific framework, variables, and data collection procedures required to execute the proposed audit.

Critical Assumptions

Reality Checks

Open Methodological Questions

Theoretical Framework

This design is grounded in the theoretical intersection of cryptographic agility frameworks and real-options economic modeling for technological investments under uncertainty. Foundational literature conceptualizes the PQC transition not merely as a cryptographic swap, but as a systemic, lifecycle-oriented observability challenge [31]. Modern institutional architectures must map dependencies across keys, certificates, and legacy trust anchors, requiring metrics like Cryptographic Agility Scores to measure operational readiness [32].

The disagreement mapping onto these frameworks centers on economic optimization under uncertain arrival times for cryptographically relevant quantum computers (CRQCs). Economic modeling utilizing real-options and net-present-value equations suggests that the optimal timing for migration diverges based on threat-arrival assumptions and discount rates applied to deferred costs [22]. Position A (H1) aligns with arguments that high proportions of custom integration force institutions into non-standardized architectures that inflate lifecycle maintenance costs [33]. Position B (H2) roots itself in the premise that delaying systemic cryptographic shifts risks catastrophic future remediation costs when legacy systems abruptly deprecate, potentially offsetting savings gained by waiting for mature vendor hardware.

Variables

Operational Definitions

Data

1. Conduct preliminary architectural audits (or structured interviews with enterprise architects) to evaluate the proportion of custom versus vendor-driven strategy (IV) across operational subsystems.

2. Deploy a standardized financial assessment protocol to review available data with participating IT finance departments.

3. Assess and normalize multi-year operational, refactoring, and payroll expenditures recorded during the PQC migration window (DV).

5. Note on expected attrition: Material loss of institutions failing to provide complete financial ledgers is expected; recruitment N and analysable N will be tracked separately, and missingness handled via multiple imputation if only specific engineering sub-logs are missing while total costs remain intact.

Methodology

Analysis Plan

Full specification

The model is a multiple linear regression estimated via Ordinary Least Squares (OLS) with robust standard errors to account for potential heteroskedasticity in expenditure variances across different-sized institutions.

Limitations & OLS bias: The OLS model suffers from severe omitted variable bias (e.g., unobserved regulatory pressure, executive risk appetite, existing engineering talent), meaning the estimated coefficients cannot represent the isolated, unconfounded financial effect of the migration timing strategy.

Robustness checks: A secondary specification will log-transform the dependent variable ($\ln ({\text{CumulativeExpenditures}}_i)$) to correct for the typical right-skewness of institutional financial data. An alternative model will test an interaction term (${\text{CustomProportion}}_i\times {\text{Technical\_Debt}}_i$) to evaluate Sub-question 2.

Power-analysis assumptions: TBD minimum detectable effect sizes based on the variance of standard enterprise modernization costs, requiring pilot extraction to parameterize.

Pre-registration: The analysis plan, cost extraction rubric, and specific inclusion/exclusion criteria for ledgers will be pre-registered on the Open Science Framework (OSF) prior to contacting institutions.

8. Expected Contributions

The successful completion of this study is expected to provide actionable financial insights for institutional security planning.

9. Limitations

Several methodological and structural limitations must be acknowledged.

10. Feasibility

The practical execution of this study is evaluated based on data access and methodological requirements.

Overall feasibility: The study depends heavily on the willingness of financial institutions to share highly sensitive retrospective operational costs and security implementation timelines; successful execution requires overcoming substantial proprietary data access hurdles.

References