Every number here is either cited or labeled a guess.
QER prices Harvest-Now-Decrypt-Later exposure for cyber insurers: the risk that encrypted data intercepted today is decrypted once a quantum computer exists. It is a competing-risks model built around three clocks, not a black box.
Three clocks, one race
An insured's data is exposed only if a quantum computer arrives before the insured finishes migrating to quantum-safe cryptography, and before the data's retention window closes. Move the migration-maturity control below; the model recalculates live, in your browser.
What's borrowed, what's ours
The inputs are not invented. The method that turns them into a price is.
| Component | Source | |
|---|---|---|
| Quantum arrival timeline | GRI / evolutionQ, 2025 survey | borrowed |
| Migration maturity levels | CAMM, Hochschule Darmstadt, 2022 | borrowed |
| Migration duration by size | Campbell, Computers, 2026 | borrowed |
| Breach severity weighting | UK ICO, 2019–2025 | borrowed |
| Competing-risks scoring method | original | |
| Relativity pricing bridge | original | |
| Portfolio systemic-risk curve | original |
A mid-sized insurer holding health data at low migration maturity scores 26 under central assumptions: a modest premium loading, not a decline. The same account at a higher maturity level scores materially lower without changing a single dollar of value at risk, by design.
Where this actually stands
Every input above is either sourced to a named, checkable reference, or explicitly labeled an unvalidated placeholder: it is not claimed to be more certain than it is. What QER cannot do yet is validate against real losses, because no Harvest-Now-Decrypt-Later claim has been paid anywhere in the market to validate against. That is the gap a design partner closes.