Loading story…
A U.S. Government Accountability Office audit found that none of 24 federal agencies had fully implemented all three preparatory practices for post-quantum cryptography (PQC): cryptographic inventories, migration funding assessments, and testing, according to PostQuantum’s account of the findings. Only one agency had completed an inventory of priority systems, none of six sampled agencies fully substantiated inventory accuracy, and no agency had tested PQC in its own environment by the audit’s conclusion. GAO attributed the gaps to shortages of cryptographic expertise, documented processes, and discovery tools. Incomplete funding assessments also weakened the basis for the government’s approximately $7.1 billion migration estimate.
Subsequent federal policy requires migration plans by October 22, 2026, with PQC adoption for specified critical systems due by the end of 2030 for key establishment and 2031 for digital signatures. CISA has separately published a resource identifying product categories for technologies that use PQC standards, supporting migration planning. PostQuantum’s analysis emphasizes that a completed inventory does not necessarily establish verified cryptographic coverage and recommends independently reconciling assets, sampling evidence, and documenting discovery gaps. It also questions the Social Security Administration’s assertion that its systems use no vulnerable algorithms, underscoring the need to validate claims of quantum readiness before relying on them for migration decisions.
Track how attackers are adapting to this technology.
12 events from the most recent confirmed update back to the earliest known activity.
GAO released report GAO-27-108740, finding that none of 24 agencies had fully implemented all three assessed practices: cryptographic inventories, migration funding assessments, and PQC testing. Only one agency had a complete inventory of priority systems, none of six sampled agencies fully substantiated inventory accuracy, and no agency had tested PQC in its own environment by the audit's conclusion.
OMB issued Memorandum M-26-15, requiring agencies to submit PQC migration plans by October 22, 2026, identifying inventory methods, automated tools, funding needs, and personnel requirements. The memorandum called for continuously updated inventories of all cryptographic assets, automated discovery wherever possible, and a central cryptographic bill of materials.
Executive Order 14412 was signed, directing OMB to require PQC key establishment by December 31, 2030, and PQC digital signatures by December 31, 2031, for high value assets and high-impact systems outside national security systems. It also directed DHS, through CISA and in coordination with NIST, to publish minimum cryptographic bill of materials elements.
CISA published categories of technologies with widely available PQC-capable products and advised organizations to acquire only PQC-capable products within those categories.
SSA stated that it had updated cryptographic-information collection through its governance, risk, and compliance tool and found no vulnerable algorithms in its systems. It said it would develop transition plans when quantum-resistant algorithms became widely available.
GAO issued a sensitive report containing 89 recommendations to CISA and 23 audited agencies. Of those agencies, 12 agreed fully, two partially, seven neither agreed nor disagreed, one disputed three of four recommendations, and the Department of the Interior did not respond.
Craig Gidney published a preprint estimating that RSA-2048 could be factored in under a week using fewer than one million noisy physical qubits under specified hardware assumptions. This contrasted with the approximately ten-million-physical-qubit estimate cited by GAO.
A Global Risk Institute survey found that 21 of 32 experts assigned at least a 50 percent probability to a cryptographically relevant quantum computer by 2040. GAO later cited the survey in its threat assessment.
NIST published its first three PQC standards, establishing standardized algorithms for post-quantum adoption.
OMB published an ONCD-developed rough estimate of $7.1 billion in 2024 dollars to migrate prioritized non-national-security systems during 2025–2035. The estimate relied on agency funding assessments that GAO subsequently found were incomplete and acknowledged to contain inaccuracies.
GAO began an audit requested by Senator Maggie Hassan covering 24 Chief Financial Officers Act agencies, including every cabinet department. The audit ran through September 2025 and assessed cryptographic inventories, migration funding assessments, and PQC testing.
Memorandum M-23-02 required agencies to inventory prioritized systems using quantum-vulnerable public-key cryptography and submit annual inventories to ONCD and CISA. It also required migration funding assessments within 30 days of each inventory.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CISA** released an initial procurement-oriented list of hardware and software product categories that already support, or are expected to support, **post-quantum cryptography (PQC)** standards, aiming to help federal agencies and other organizations plan technology refreshes and investment strategies as quantum computing advances. The guidance highlights common government-purchased technology areas where PQC is described as “widely available,” including cloud services (*PaaS/IaaS*), collaboration and messaging software, web software (browsers/servers), endpoint security (e.g., full-disk and at-rest encryption), and networking hardware/software, with emphasis on PQC use for **key establishment** and **digital signatures**. The publication aligns with US government direction to migrate high-value systems toward quantum-resistant cryptography, driven by concerns that adversaries may **harvest encrypted data now** for future decryption once a cryptographically relevant quantum computer emerges. Reporting also notes the list was developed in coordination with the **NSA** and is intended to be updated over time; some security professionals have questioned how actionable the guidance is for real-world procurement and migration planning, given the complexity and cost of transitioning cryptographic dependencies across large technology stacks.
Jun 29, 2026
The G7 Cybersecurity Working Group has called on governments and organizations across all sectors to begin preparing immediately for a transition to **post-quantum cryptography (PQC)**. The group highlighted the current “harvest now, decrypt later” threat: adversaries can collect encrypted information today and retain it until cryptographically relevant quantum computers can break existing public-key encryption, placing long-lived sensitive data at risk. The non-binding call prioritizes awareness, national strategies, research, public-private cooperation, and embedding PQC in cybersecurity requirements. Organizations should begin with a cryptographic inventory, defined ownership, limited pilots, crypto-agile architecture, hybrid standardized deployments, and PQC-focused procurement. EU member states are expected to have initiated national PQC strategies by the end of 2026, while high-risk environments—particularly critical infrastructure—should transition as early as possible and no later than the end of 2030; delayed adoption could also affect supplier eligibility for public-sector and other contracts.
Sep 11, 2026
Security experts are intensifying efforts to develop and implement post-quantum cryptography (PQC) in anticipation of the eventual arrival of quantum computers capable of breaking current encryption algorithms, a milestone referred to as "Q-Day." The transition to PQC is recognized as a complex, multi-year process that requires not only new cryptographic algorithms but also significant changes to cybersecurity infrastructure, including the adoption of hybrid solutions and the integration of PQC into zero-trust architectures. High-security sectors are particularly urged to begin migration early to mitigate the risk of "harvest now, decrypt later" attacks, where adversaries collect encrypted data now to decrypt once quantum capabilities are available. Industry analysts highlight that the migration to post-quantum encryption presents unique challenges compared to previous cryptographic upgrades, as it involves extensive updates to hardware, software, and system architectures. While some areas, such as blockchain, are not immediately threatened by quantum computing, the scale and complexity of the migration require coordinated efforts across security, product management, and IT operations. Experts emphasize the need for proactive planning and the adoption of best practices to ensure a smooth transition before quantum computers become a practical threat to digital security.
Jul 12, 2026