Quantum-risk disclosure in 10-K filings and measured cryptographic practice of US listed firms

Data, code and analysis plan for a study of 4,026 US firms listed on NYSE or Nasdaq. Disclosure: the study codes how each firm describes quantum computing as a security risk in its 10-K filings (2019 to October 2026; 7,016 passages, two large language models validated against two human raters). Practice: it links that disclosure to hybrid post-quantum key exchange (X25519MLKEM768) on 34,516 public web hosts, scanned on 7 to 9 November 2026, and to crypto-agility derived from 3.05 million certificates in Certificate Transparency logs. Results: disclosing firms are no more crypto-agile than other firms (equivalence within 0.30 SD), and hybrid key exchange on corporate websites follows the hosting provider. Contents: the archive contains the code, the analysis plan with its amendment history, the deviation log, the coded passages, firm-level measures, all tables and figures, and a 300-firm website validation. The plan was written before data collection but was not registered publicly before it; this deposit is its first public release. Host-level scan results are not released (see data-availability.md).