Mechanism Design for Systemic Post-Quantum Cyber Risk:Incentive-Compatible Adoption, Equilibrium Guarantees, and Policy-Grade Algorithms

Abstract: This study investigates systemic post-quantum cyber risk as a governance and coordination problem in critical infrastructure, where cryptographic transitions interact with interdependent attack surfaces, heterogeneous operator costs, and policy constraints. A mechanism-design perspective is developed to formalize incentive-compatible adoption of crypto-agile controls under network externalities, and to derive equilibrium guarantees that remain meaningful under uncertainty about exploitability and cascading exposure. The empirical component integrates the Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) catalog with Exploit Prediction Scoring System (EPSS) probabilities, producing policy-relevant risk indices aligned to a Python graph–Bayes pipeline. The proposed framework combines (i) a dependency graph that captures shared weakness structure across vendors and products, (ii) Bayesian risk inference that propagates exploitation likelihood through interdependence channels while retaining uncertainty bounds, and (iii) a transfer mechanism that prices marginal externalities using computable centrality-based surrogates. Results provide a reproducible analytics lifecycle for crypto-agile governance, including diagnostics for risk concentration, scenario adoption equilibria under incentives, and decision artifacts that translate model outputs into procurement and compliance levers. The contribution is positioned as policy-grade: it avoids unverifiable claims while delivering algorithms, metrics, and governance protocols that can be audited, updated, and sector-tailored as post-quantum standards mature.