Loading story…
CISA released an initial procurement-oriented list of hardware and software product categories that already support, or are expected to support, post-quantum cryptography (PQC) standards, aiming to help federal agencies and other organizations plan technology refreshes and investment strategies as quantum computing advances. The guidance highlights common government-purchased technology areas where PQC is described as “widely available,” including cloud services (PaaS/IaaS), collaboration and messaging software, web software (browsers/servers), endpoint security (e.g., full-disk and at-rest encryption), and networking hardware/software, with emphasis on PQC use for key establishment and digital signatures.
The publication aligns with US government direction to migrate high-value systems toward quantum-resistant cryptography, driven by concerns that adversaries may harvest encrypted data now for future decryption once a cryptographically relevant quantum computer emerges. Reporting also notes the list was developed in coordination with the NSA and is intended to be updated over time; some security professionals have questioned how actionable the guidance is for real-world procurement and migration planning, given the complexity and cost of transitioning cryptographic dependencies across large technology stacks.
Track how attackers are adapting to this technology.
3 events from the most recent confirmed update back to the earliest known activity.
Following the guide's release, security experts said CISA's document lacked operational migration detail, including cryptographic inventories, timelines, hybrid deployment guidance, and clear definitions of what qualifies as 'PQC-capable.' They also warned that many products only partially implement PQC, leaving risks around signatures, authentication, and mixed-vendor environments.
On January 23, 2026, CISA released guidance and an initial list of hardware and software product categories that support, or are expected to support, post-quantum cryptography standards. Developed with NSA collaboration, the list identified areas where PQC is already broadly available and urged agencies to prioritize PQC-capable products in future acquisitions.
On June 6, 2025, Executive Order 14306 directed federal agencies to transition high-value systems and devices toward post-quantum cryptography and tasked CISA with identifying widely available products using PQC standards. The order set the broader policy framework for federal PQC modernization through 2035.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
4 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcecyberscoop.com
Open sourcecsoonline.com
Open sourceinfosecurity-magazine.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Organizations are accelerating **post-quantum cryptography (PQC)** planning amid concerns that adversaries are already conducting “**harvest now, decrypt later**” operations—collecting encrypted traffic today for future decryption once sufficiently capable quantum computers emerge. A supply-chain-focused analysis highlighted that procurement and third-party ecosystems often rely on long-lived trust anchored in **RSA** and **ECC**, and that sensitive data exchanged across supplier onboarding, invoicing, contracts, pricing, and banking workflows could be exposed retroactively if captured now and decrypted later. A U.S. State Department cybersecurity official urged tighter **public-private coordination** on PQC migration, framing quantum resilience as an ecosystem-wide modernization effort rather than isolated upgrades by individual organizations. The official emphasized that adversaries (including **China**) can target entire digital ecosystems, and argued that transition plans must account for long-term national security risks such as data harvesting, with modernization efforts designed to reduce predictability and strengthen collective defenses across interconnected systems, devices, and data flows.
Aug 28, 2026
Major hardware vendors are beginning to embed **post-quantum cryptography (PQC)** into processors and platform security features as organizations prepare for quantum-era attacks. Intel said its **Xeon 6** server chips now support PQC-capable protections, while Nvidia is integrating NIST-approved post-quantum standards into confidential computing security layers. The shift is aimed at reducing exposure to **harvest-now, decrypt-later** campaigns, in which adversaries steal encrypted data today in anticipation of breaking legacy cryptography once large-scale quantum computing becomes practical. The move follows NIST’s standardization of post-quantum algorithms, a milestone that accelerated vendor adoption and enterprise migration planning. The reporting highlights that widely used public-key schemes such as **RSA** and **ECC** are expected to be vulnerable to quantum attacks, while **AES-256** remains a stronger option for symmetric encryption and is already hardware-accelerated on some platforms. Security teams are being pushed to inventory cryptographic dependencies and identify older systems that cannot be upgraded to support quantum-resistant protections.
Aug 23, 2026
Concerns about **quantum computing** undermining today’s cryptography are influencing both market behavior and policy planning. A Jefferies strategist reportedly removed a 10% **Bitcoin** allocation from a model portfolio, citing the risk that future quantum advances could eventually compromise cryptographic protections underpinning cryptocurrencies (e.g., long-term concerns around breaking schemes associated with Bitcoin’s security model, which relies on `SHA-256` hashing and public-key cryptography for ownership control). The decision reflects broader investor anxiety that a surprise cryptographic break could rapidly erode confidence and value across crypto markets. In parallel, the **G7 Cyber Expert Group** published a roadmap calling for the financial sector to complete **post-quantum cryptography (PQC)** implementation by **2034**, emphasizing early-stage quantum risk awareness, sensitive data and critical system mapping, and building detailed inventories that include third-party dependencies. The roadmap recommends beginning migration activities in the 2026–2029 window, progressing to quantum-resistant solutions through 2034, and prioritizing **cryptographic agility** so organizations can adapt as standards and threats evolve. Separate reporting on a **58% increase in ransomware victims in 2025** describes a fragmented ransomware ecosystem and sector targeting trends, but it is not directly tied to quantum-driven cryptographic risk or PQC migration planning.
Jun 29, 2026