Loading story…
The Trusted Computing Group (TCG) has released new guidance to help organizations verify whether Trusted Platform Modules (TPMs) marketed as quantum-safe actually meet post-quantum cryptography requirements. The guidance is built around the PC Client Platform TPM Profile 1.07 (PTP 1.07), published earlier in 2026, which defines baseline requirements for TPM 2.0 implementations supporting post-quantum algorithms and references the TPM 2.0 Library Specification Version 1.85.
TCG said the move is intended to address vendor claims that do not deliver full end-to-end quantum-safe capability and to give buyers a clearer basis for demanding evidence before procurement. The framework introduces two labels—TCG PQC-ready TPM for modules that already support PTP 1.07, and TCG PQC-upgradable TPM for modules that can be updated to meet it—and TCG said it plans to expand its certification programs to formally certify TPMs against those requirements.
Track how attackers are adapting to this technology.
4 events from the most recent confirmed update back to the earliest known activity.
TCG said it plans to enhance its certification programs to certify TPMs that meet PTP 1.07 requirements. The organization also said it will define requirements for a TCG-certified 'TCG PQC-ready TPM' once that certification work is completed.
As part of the new guidance, TCG introduced two transition designations: 'TCG PQC-ready TPM' for TPMs that already implement PTP 1.07 and 'TCG PQC-upgradable TPM' for TPMs designed to be upgraded to support it. The labels were created to clarify a platform's status in the transition to post-quantum cryptography.
On August 24, 2026, the Trusted Computing Group released guidance to help organizations verify whether TPMs meet post-quantum cryptography requirements tied to PTP 1.07. The guidance was intended to help buyers demand evidence from vendors and avoid unsupported compliance claims.
In March 2026, the Trusted Computing Group assembled nearly 90 contributors from government, academia, semiconductor companies, and hardware providers to develop the PC Client Platform TPM Profile 1.07 standard. The standard defined minimum requirements for post-quantum-cryptography-ready TPMs.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
helpnetsecurity.com
Open sourceinfosecurity-magazine.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security leaders are increasingly concerned about the impact of quantum computing on existing cryptographic systems, as quantum-inspired algorithms and quantum-ready software begin to appear in enterprise and defense environments. While most organizations are not yet running quantum computers, quantum software is being integrated into mission-critical workflows, often without security teams' full awareness. This integration poses new challenges for visibility, validation, and compliance, requiring CISOs and security operations teams to adapt their approaches to risk management and technology vetting. Despite growing awareness of the quantum threat, a recent survey by the Trusted Computing Group (TCG) reveals that 91% of businesses lack a formal roadmap for migrating to quantum-safe algorithms. Although many security professionals express confidence in their understanding of quantum risks, actual technical preparation remains limited, with most organizations' cryptographic libraries and hardware security modules not yet ready for post-quantum standards. The gap between perceived readiness and actual progress suggests that enterprises may be underestimating the complexity and timeline required to achieve true post-quantum security.
Jun 30, 2026
**CISA** released an initial procurement-oriented list of hardware and software product categories that already support, or are expected to support, **post-quantum cryptography (PQC)** standards, aiming to help federal agencies and other organizations plan technology refreshes and investment strategies as quantum computing advances. The guidance highlights common government-purchased technology areas where PQC is described as “widely available,” including cloud services (*PaaS/IaaS*), collaboration and messaging software, web software (browsers/servers), endpoint security (e.g., full-disk and at-rest encryption), and networking hardware/software, with emphasis on PQC use for **key establishment** and **digital signatures**. The publication aligns with US government direction to migrate high-value systems toward quantum-resistant cryptography, driven by concerns that adversaries may **harvest encrypted data now** for future decryption once a cryptographically relevant quantum computer emerges. Reporting also notes the list was developed in coordination with the **NSA** and is intended to be updated over time; some security professionals have questioned how actionable the guidance is for real-world procurement and migration planning, given the complexity and cost of transitioning cryptographic dependencies across large technology stacks.
Jun 29, 2026
Major hardware vendors are beginning to embed **post-quantum cryptography (PQC)** into processors and platform security features as organizations prepare for quantum-era attacks. Intel said its **Xeon 6** server chips now support PQC-capable protections, while Nvidia is integrating NIST-approved post-quantum standards into confidential computing security layers. The shift is aimed at reducing exposure to **harvest-now, decrypt-later** campaigns, in which adversaries steal encrypted data today in anticipation of breaking legacy cryptography once large-scale quantum computing becomes practical. The move follows NIST’s standardization of post-quantum algorithms, a milestone that accelerated vendor adoption and enterprise migration planning. The reporting highlights that widely used public-key schemes such as **RSA** and **ECC** are expected to be vulnerable to quantum attacks, while **AES-256** remains a stronger option for symmetric encryption and is already hardware-accelerated on some platforms. Security teams are being pushed to inventory cryptographic dependencies and identify older systems that cannot be upgraded to support quantum-resistant protections.
Aug 23, 2026