Federal post-quantum guidance is usually discussed through its deadlines, and the deadlines have moved. The memo that turned cryptographic inventory from good practice into a reporting obligation is older than the dates most people cite, and its requirements describe what an inventory has to contain more precisely than anything that followed.
\nOMB Memorandum M-23-02, Migrating to Post-Quantum Cryptography, was issued on 18 November 2022 and signed by OMB Director Shalanda D. Young. It exists to carry out National Security Memorandum 10, published on 4 May 2022, which set the goal of mitigating as much quantum risk as is feasible by 2035.
\nIts central instruction is a submission. By 4 May 2023, and annually after that until 2035, agencies were directed to send a prioritized inventory of information systems and assets containing cryptographic systems vulnerable to a cryptanalytically relevant quantum computer to the Office of the National Cyber Director and to CISA. National security systems are excluded.
\nThree kinds of system are in scope: high impact information systems, agency high value assets, and anything else the agency judges likely to be particularly vulnerable. The memo asks agencies to consider two cases under that last heading, and both are about exposure rather than classification. One is any system holding data expected to remain mission-sensitive in 2035, which is the harvest-now-decrypt-later problem stated as a scoping rule. The other is logical access control built on asymmetric encryption, naming public key infrastructure directly.
\nThe definition is narrower than the phrase suggests, and it is the part worth reading closely. M-23-02 defines a cryptographic system as an active software or hardware implementation of one or more cryptographic algorithms providing at least one of three services: creating and exchanging encryption keys, encrypted connections, or creating and validating digital signatures.
\nTwo words in that definition do most of the work. Active excludes implementations that are present but not in use, and the memo defines the test generously: a cryptographic system counts if it is possible for it to be employed during operation, even where it is only reached to support legacy clients. And a single system usually holds several, which the memo says explicitly, so the unit of inventory is the implementation rather than the application.
\nEach entry then carries nine fields, including the FISMA system identifier, the FIPS 199 categorization, the high value asset identifier where one applies, and for every vulnerable implementation the algorithm, the service it provides and the key or module length. Beyond the cryptography, an entry records whether the implementation arrives inside a commercial or government off-the-shelf package and from which vendor, the operating system and version, whether the system is hosted on-premises or by a commercial or government cloud provider, and the lifecycle of the data it protects, including how long that data needs protection.
\nThat last field is the one that turns an inventory into a migration plan. A record of how long data has to stay confidential, set against the algorithm protecting it, is what ranks a system by risk rather than by convenience.
\nFour further requirements sat alongside it, and they say what the inventory was for.
\nAgencies had 30 days to designate a cryptographic inventory and migration lead. Within 30 days of each annual submission, they owed ONCD and OMB an assessment of the funding needed to migrate the inventoried systems in the following fiscal year, which is how an inventory becomes a budget line rather than a report.
\nThe memo also commissioned work from the agencies that support the others. CISA, with NSA and NIST, was to publish a strategy on automated tooling for assessing PQC adoption within a year, covering discovery of both internet-accessible and internal systems. NIST, with CISA and the FedRAMP program office, was to establish a mechanism for exchanging results from testing pre-standardized PQC, which agencies were encouraged to run in production environments alongside approved algorithms. A cryptographic migration working group chaired by the Federal CISO was to coordinate the whole effort.
\nRead together, those four say the authors expected manual inventory to be insufficient and said so in 2022, before automated discovery became the assumption in later guidance.
\nThe 2035 horizon M-23-02 inherited from NSM-10 is no longer the date agencies plan against. Executive Order 14412, signed 22 June 2026, requires high value assets and high impact systems to move to post-quantum key establishment by 31 December 2030 and to post-quantum digital signatures by 31 December 2031. OMB M-26-15, issued 24 June 2026, sets out the objectives agencies execute against and asks for an inventory that is automated and continuously updated rather than assembled annually.
\nM-23-02 anticipated this. Its own instruction runs annually until 2035 or as directed by superseding guidance, which is the clause later memoranda have been written into. The requirement did not lapse so much as get absorbed, and what was absorbed was the shape of the record rather than the cadence.
\nAn agency that built the M-23-02 inventory properly has most of what the newer mandates ask for. The nine fields are close to the contents of a cryptographic bill of materials: algorithm, service, key length, where it runs, who supplied it, and how long the data behind it matters. What has changed is that a list compiled once a year cannot keep pace with an estate that changes weekly, which is the gap crypto-agility and continuous discovery close.
\nQuProtect produces that record from live traffic rather than from a survey. Reconnaissance identifies cryptographic implementations in use, including the asymmetric access-control dependencies M-23-02 singles out, and Reporting exports the result as evidence an agency can submit. Resilience is what makes the funding question smaller, because algorithms can be changed by policy across existing infrastructure rather than through the application rewrites the 2022 cost assessments had to assume.
", "date_published": "2026-08-30T11:00:00Z", "authors": [ { "name": "Meg Gleason" } ], "tags": [ "Insights", "Public Sector" ], "image": "https://www.qusecure.com/og/omb-m-23-02-federal-cryptographic-inventory.jpg" }, { "id": "https://www.qusecure.com/pci-dss-4-0-cryptographic-inventory/", "url": "https://www.qusecure.com/pci-dss-4-0-cryptographic-inventory/", "title": "What PCI DSS 4.0 Requirement 12.3.3 Asks of Your Cryptography", "summary": "Requirement 12.3.3 asks for a cryptographic inventory that stays current, and a payment estate is where that is hardest to keep.", "content_html": "Most PCI DSS requirements describe a control you put in place and then produce evidence for. Requirement 12.3.3 instead asks you to keep something true between assessments, about a part of the estate that changes without anyone deciding to change it.
\nRequirement 12.3.3 asks an organization to maintain a documented inventory of the cryptographic cipher suites and protocols in use, and to review that inventory at least every 12 months. The standard is published by the PCI Security Standards Council, whose document library carries the current revision as PCI DSS v4.0.1. The list is the starting point rather than the deliverable. Alongside it, 12.3.3 asks the organization to monitor whether the algorithms on the list remain viable, to document how it will respond when one of them stops being viable, and to act on that plan when a cryptographic weakness reaches data it is responsible for.
\nThose four parts describe a continuing responsibility rather than an annual document. An inventory assembled the month before an assessment satisfies the first part and says nothing about the other three, because it cannot show that anything was being monitored in the eleven months nobody was looking.
\nCryptography in a payment environment has not been confined to the cardholder data environment for a long time. It sits in cloud infrastructure, internal and external APIs, service-to-service traffic, machine identities, internal certificate authorities, build pipelines, VPN concentrators, network equipment, and the third-party platforms that carry part of a transaction.
\nThat spread is what makes the inventory a different kind of problem from the one the requirement sounds like. Finding the certificates on public endpoints is tractable. Answering which cipher suites two internal services negotiate with each other, and who owns the certificate authority that issued them, generally is not, and neither question has an owner in most organizations.
\nVendors compound it. A third party that describes its encryption as strong without naming an algorithm, a key length or a protocol version has given you nothing you can put in an inventory, and nothing you could assess for viability later.
\nThe failure is rarely that nobody built one. It is that the one that was built stopped being true.
\nCertificates, TLS configurations, cipher suites, key lengths, cryptographic libraries and internal PKI relationships tend to be recorded in different systems by different teams, or not recorded at all. A spreadsheet assembled from those sources is accurate on the day it is compiled.
\nOlder applications often carry cryptographic dependencies nobody documented, and the only way to learn what they negotiate is to look at what they put on the wire.
\nWhen business units, cloud accounts and development teams can each issue certificates, the result is several trust hierarchies that no single team can enumerate. Those are the certificates most likely to expire without warning.
\nCloud providers change encryption defaults, applications add dependencies, and cipher suites are deprecated on someone else’s schedule. An organization can fall out of alignment with its own documented inventory without any change it made.
\nContinuous cryptographic discovery addresses this directly, by taking the inventory from live traffic rather than from documentation that has to be maintained by hand.
\nThe part of 12.3.3 that asks for a documented response plan is the part an inventory alone cannot satisfy, and it is the harder commitment. Knowing that a deprecated algorithm is in use somewhere is worth little if changing it means a coordinated release across every application that depends on it.
\nThis is crypto-agility: being able to change algorithms, cipher suites, certificates and keys without an outage and without rewriting the applications behind them. Cryptographic standards keep moving, and each move has arrived on someone else’s timetable. SHA-1 was deprecated, older TLS versions were retired, and certificate validity periods have been shortened more than once.
\nAn organization that can answer a cryptographic weakness by changing a policy is describing a response plan an assessor can read. One that would have to schedule a migration project is describing an intention.
\nPCI DSS 4.0 does not require post-quantum cryptography. What it requires is the groundwork any cryptographic transition needs, which is why the two are worth planning together rather than in sequence.
\nPayment infrastructure is exposed to the quantum question for reasons that have nothing to do with PCI DSS. It depends heavily on public-key cryptography, transaction records hold value for years after they are written, and the dependencies run through systems that are difficult to change quickly. Migrating any of that starts with knowing where RSA and elliptic-curve cryptography are in use, which systems depend on them, and which of those systems would be hard to update. That is the inventory 12.3.3 already asks for, read with a different question in mind.
\nA cryptographic bill of materials is the format that carries the answer, and it is the same artifact in both cases.
\nQuProtect covers the requirement’s four parts with the three capabilities it is built from.
\nReconnaissance discovers cryptographic assets continuously from live traffic, so the inventory reflects what is negotiated today rather than what was documented last quarter, and surfaces the weak and deprecated algorithms the viability question is about.
\nResilience is what makes the response plan credible. It applies cryptographic policy across existing infrastructure at the network layer, so algorithms and cipher suites can be changed centrally without application rewrites.
\nReporting turns the live inventory into evidence, including a current CBOM, so the annual review is a read rather than a project.
\nFor how this sits alongside DORA and the other rules a financial institution answers to, see banking and financial services.
", "date_published": "2026-08-30T09:00:00Z", "authors": [ { "name": "Meg Gleason" } ], "tags": [ "Insights", "Banking, Financial Services & Insurance" ], "image": "https://www.qusecure.com/og/pci-dss-4-0-cryptographic-inventory.jpg" }, { "id": "https://www.qusecure.com/oil-gas-critical-infrastructure-post-quantum-case-study/", "url": "https://www.qusecure.com/oil-gas-critical-infrastructure-post-quantum-case-study/", "title": "Case Study: Oil and Gas Operator Validates Post-Quantum Encryption on Systems With No Migration Path", "summary": "A national oil company piloted post-quantum encryption for exploration data, protecting SCADA systems and industrial controls at the network layer.", "content_html": "A multi-national oil company with more than 50,000 employees has validated post-quantum encryption for its exploration data in a production-equivalent environment, without changing the applications that produce and consume it. The pilot took roughly three months from planning to validated result, and it ended with approval for production deployment and a multi-year budget for phased enterprise rollout.
\nThis case study is based on a real engagement with a national oil company; all identifying details have been anonymized, and the technical and operational themes are preserved.
\nGeological survey data informs drilling decisions for more than 20 years, and reservoir models stay commercially sensitive for decades. The infrastructure carrying it is long-lived too, and much less flexible: SCADA systems, legacy applications, industrial controls and proprietary protocols that will operate into the 2040s and cannot be replaced without massive capital expenditure.
\nCryptography runs on a different clock, changing every few years as standards evolve, and the encryption protecting this data is already vulnerable or scheduled for deprecation. Adversaries collecting encrypted traffic today can hold it until the computational capability to read it exists, which is what turns a 20-year sensitivity window into a present-tense problem.
\nSandia National Laboratories made the same observation about asset lifespans in its 2021 Critical Infrastructure Decision-Making Study:
\n\n\nU.S. critical infrastructure assets are often designed to operate for decades.
\n
The oil and gas sector spans an unusually wide technology mix: modern enterprise applications alongside constrained devices and decades-old legacy systems, each presenting its own post-quantum migration problem.
\nIn an organization with decades of accumulated technology, application-level migration means updating hundreds of applications: custom-built systems from the 1990s, third-party software whose vendors are long gone, and embedded systems with no development environment. Each one needs its own development work, its own testing and its own deployment window.
\nDevelopment teams already prioritize business features over cryptographic updates, and many developers do not have specialized knowledge of how to deploy cryptography well. Accurate testing requires recreating production scenarios that often do not exist outside live environments. Coordinated across hundreds of applications, post-quantum migration becomes a multi-year program, and for this environment that meant five to seven years across hundreds of development teams.
\nFor 20 to 30-year-old SCADA systems, proprietary industrial protocols and embedded controls, coordinated application-level updates are effectively impossible. There are no vendors left to support the changes, no test harnesses that reflect real-world behavior, and change control is tightly constrained. Those are also the systems carrying the data with the longest sensitivity window, so the cost and complexity of application code changes made network-level protection both the easier and the more cost-effective route.
\nQuProtect R3 deploys at network gateways, which separates security from application logic. Applications, endpoints and legacy infrastructure do not change, and data flows through quantum-safe tunnels transparently. When cryptographic standards change, only the gateway layer needs updating rather than the thousands of applications and endpoints behind it.
\nThat separation changes the shape of the work. Managing cryptography at the application level makes every application its own migration unit, each needing development, testing and a deployment window, and it leaves many legacy and OT systems with no route at all. Managing it at the network level gives a single team a single technology on a coordinated schedule, with timelines measured in months rather than years.
\nQuProtect R3 agents were deployed in a production-equivalent test environment, with gateways placed at strategic network points so that exploration data flows from multiple operating regions were routed through quantum-safe tunnels and validated. The full effort, from initial planning through deployment and validation, took approximately three months.
\nThe harder problem was organizational. Application development teams initially assumed they would need to update their own code, and had begun assessing backlog impact and estimating months of development work. Security architecture and network teams argued for a network-level approach instead, and the debate turned less on cryptography than on who owns post-quantum migration and how priorities are set across business units and regions.
\nThe pilot resolved that question at a practical level, because application teams watched their systems operate unchanged through quantum-safe gateways. Once they saw their workloads function normally without code changes, the conversation moved from how to update the applications to how quickly the approach could be deployed.
\nPerformance validation found no disruption, with latency impact negligible and within acceptable parameters. The organization used its own established testing tools rather than QuProtect R3’s built-in performance tooling, which kept the results inside the operational frameworks it already trusted.
\nProduction deployment begins with the exploration data flows validated in the pilot, and the integration framework established there is what lets the rollout across additional business units and regions move faster than the first.
\nThe full case study covers the sector’s technology mix, the gateway architecture, the integration work and the organizational questions the pilot resolved, along with an appendix on how QuProtect R3 addresses operational technology.
", "date_published": "2026-08-28T09:00:00Z", "authors": [ { "name": "Meg Gleason" } ], "tags": [ "Case Studies", "Critical Infrastructure" ], "image": "https://www.qusecure.com/og/oil-gas-critical-infrastructure-post-quantum-case-study.jpg" }, { "id": "https://www.qusecure.com/wef-quantum-technologies-ict-leaders/", "url": "https://www.qusecure.com/wef-quantum-technologies-ict-leaders/", "title": "World Economic Forum Cites QuSecure's Multi-Orbit Link in Its Quantum Roadmap for ICT Leaders", "summary": "The World Economic Forum and Accenture map quantum priorities for ICT leaders, citing QuSecure's multi-orbit link as proof PQC deploys where QKD cannot.", "content_html": "The World Economic Forum, with Accenture, has published a strategic roadmap for information and communication technology leaders covering three quantum fronts: computing, sensing, and communications and security. QuSecure’s co-founder and chief executive is among the paper’s listed contributors, and the paper reaches for QuSecure’s work at the point where it argues about what can actually be deployed.
\nWeighing how quantum-safe approaches scale, the authors set quantum key distribution against post-quantum cryptography. QKD, they note, carries high costs and distance limitations, while PQC does not. Their example of what that difference makes possible is the multi-orbit satellite data link QuSecure built with Accenture, which the report describes as a hybrid approach that is easier to deploy, even in space, and that features crypto-agility.
\nThe argument belongs to the report rather than to us, which is what makes it worth reading. Deployability is the whole practical question for a network operator, and a satellite link is the hardest case anyone can point at.
\nKey points of the white paper include:
\nThe paper’s own conclusion is that early adoption of quantum-safe measures is what separates the organizations that will absorb the transition from those that will be overtaken by it.
", "date_published": "2026-08-27T09:00:00Z", "authors": [ { "name": "Meg Gleason" } ], "tags": [ "Resources" ], "image": "https://www.qusecure.com/og/wef-quantum-technologies-ict-leaders.jpg" }, { "id": "https://www.qusecure.com/qusecure-gold-award-post-quantum-cryptography/", "url": "https://www.qusecure.com/qusecure-gold-award-post-quantum-cryptography/", "title": "QuSecure Wins Gold at the 23rd Annual International Business Awards", "summary": "QuSecure won a Gold International Business Award for QuProtect R3 in the Cybersecurity Solution category, chosen from more than 3,400 nominations.", "content_html": "Judging Panel Credits QuSecure for its Revenue Dominance and Competitive Edge, Delivering a Vital Breakthrough in PQC, Revolutionizing Quantum Cyber-readiness, and Industry Endorsements
\nSAN MATEO, Calif. — Aug. 25, 2026 — QuSecure™, Inc., a leader in post-quantum cryptography (PQC) and cryptographic agility, today announced it earned top honors from the 23rd Annual International Business Awards, while garnering rave reviews from its global judging panel.
\nOne judging panelist commented, “QuSecure’s ability to drastically reduce quantum migration costs and timelines provides an undeniable competitive edge. Their overwhelming government revenue dominance and prominent placement in key cybersecurity readiness guidelines strongly validate their position as an elite leader in quantum security.”
\nAward winners out of more than 3,400 nominations were determined based on average scores from judges, more than 300 business professionals serving on 11 specialized committees, during the independent judging process in June and July. QuSecure won a Gold International Business Award for its PQC platform QuProtect R3 in the Cybersecurity Solution category.
\nOther independent judges’ comments included:
\n“The International Business Awards are some of the most sought after awards each year, partly because winners are selected by a judging panel of hundreds of professionals across the globe,” said Joey Lupo, QuSecure Product Manager. “It is truly gratifying to see the judges’ recognition of QuSecure’s innovation, market leadership, validation in the industry, and revenue growth.”
\nFurther details about The International Business Awards and the lists of Stevie Award winners are available at iba.stevieawards.com.
\nFounded in 2002, the Stevie Awards honor achievements in the workplace worldwide. The name Stevie is derived from the Greek name Stephanos, meaning crowned. Each year the Stevie Awards receive more than 12,000 nominations from organizations in more than 70 nations and territories. Learn more at stevieawards.com.
", "date_published": "2026-08-25T05:00:56Z", "authors": [ { "name": "Trina Mabunay" } ], "tags": [ "Awards", "Press Releases" ], "image": "https://www.qusecure.com/og/qusecure-gold-award-post-quantum-cryptography.jpg" }, { "id": "https://www.qusecure.com/quantum-zeitgeist-post-quantum-cryptography-award/", "url": "https://www.qusecure.com/quantum-zeitgeist-post-quantum-cryptography-award/", "title": "QuSecure Featured in Quantum Zeitgeist: QuProtect R3 Wins Gold for Quantum Security Innovation", "summary": "Quantum Zeitgeist reported QuProtect R3's Gold International Business Award in the Cybersecurity Solution category, from 3,400 nominations.", "content_html": "Quantum Zeitgeist covered QuSecure’s Gold International Business Award for its QuProtect R3 platform in the Cybersecurity Solution category. Selected from more than 3,400 nominations, QuSecure was recognized for its work in post-quantum cryptography and crypto agility, and for reducing quantum migration costs and timelines.
\nQuProtect R3 helps organizations accelerate post-quantum cryptography migration through crypto agility, automated asset discovery, real-time remediation, and Cryptographic Bill of Materials generation. The platform modernizes cryptography across existing environments without requiring code rewrites or an infrastructure overhaul.
\nThe International Business Awards judging panel recognized QuSecure’s approach to quantum-resilient cybersecurity, including QuProtect R3’s ability to identify encryption vulnerabilities, support cryptographic modernization, and help organizations transition toward quantum-ready security.
", "date_published": "2026-08-25T03:56:45Z", "authors": [ { "name": "Trina Mabunay" } ], "tags": [ "Media Coverage" ], "image": "https://www.qusecure.com/og/quantum-zeitgeist-post-quantum-cryptography-award.jpg" }, { "id": "https://www.qusecure.com/technewsworld-scalable-quantum-computing-ibm/", "url": "https://www.qusecure.com/technewsworld-scalable-quantum-computing-ibm/", "title": "QuSecure Featured in TechNewsWorld: IBM Advances the Path to Scalable Quantum Computing", "summary": "TechNewsWorld covered IBM's demonstration of linked cryogenic modules, with QuSecure's Garfield Jones on why stabilizing qubits matters.", "content_html": "TechNewsWorld covered IBM’s demonstration of linked modular cryogenic systems, an engineering milestone designed to support fault-tolerant quantum computing. The article features Garfield Jones, SVP of Global Strategy and Research at QuSecure, who explains why stabilizing and scaling qubits is a step toward more powerful quantum systems.
\nAs quantum computing advances, organizations should begin preparing for the transition to post-quantum cryptography. Building crypto agility, maintaining a comprehensive cryptographic inventory, and implementing NIST PQC algorithms aligned with evolving NIST PQC standards help organizations strengthen post quantum cybersecurity and prepare for cryptographic migration.
\nEngineering advances continue to move the industry closer to practical quantum computing. Organizations that begin cryptographic discovery, modernization, and migration planning today will be better positioned to protect long-lived data and adapt as quantum capabilities mature.
", "date_published": "2026-08-19T20:49:55Z", "authors": [ { "name": "Trina Mabunay" } ], "tags": [ "Media Coverage" ], "image": "https://www.qusecure.com/og/technewsworld-scalable-quantum-computing-ibm.jpg" }, { "id": "https://www.qusecure.com/iqt-quantum-dragon-podcast-post-quantum-cryptography/", "url": "https://www.qusecure.com/iqt-quantum-dragon-podcast-post-quantum-cryptography/", "title": "QuSecure Featured in IQT: The Quantum Dragon Podcast with Rebecca Krauthamer", "summary": "Inside Quantum Technology's Quantum Dragon podcast, on the widening gap between organizations preparing early for post-quantum work and those delaying.", "content_html": "Inside Quantum Technology featured QuSecure Co-Founder and CEO Rebecca Krauthamer on The Quantum Dragon Podcast, where she discussed the growing divide between organizations preparing early for post-quantum cryptography and those delaying action. The conversation also covered U.S. military cryptographic standards, AWS Qualified Software Certification, and why organizations should begin planning for quantum security now.
\nPreparing for quantum threats requires more than replacing encryption algorithms. Organizations need post-quantum cryptography, crypto agility, and a comprehensive cryptographic inventory to identify vulnerable systems and accelerate migration. Implementing NIST PQC algorithms while aligning with evolving NIST PQC standards helps organizations adapt as security requirements change.
\nQuantum migration is a multiyear effort. Organizations that begin cryptographic discovery, inventory, and modernization today will be better prepared to protect long-lived data and meet future security requirements.
", "date_published": "2026-08-19T11:35:06Z", "authors": [ { "name": "Trina Mabunay" } ], "tags": [ "Media Coverage" ], "image": "https://www.qusecure.com/og/iqt-quantum-dragon-podcast-post-quantum-cryptography.jpg" }, { "id": "https://www.qusecure.com/world-economic-forum-post-quantum-cryptography-video/", "url": "https://www.qusecure.com/world-economic-forum-post-quantum-cryptography-video/", "title": "QuSecure Featured in World Economic Forum: Protecting Data in the Quantum Era", "summary": "The World Economic Forum on how quantum computing reshapes cybersecurity, the harvest now, decrypt later risk, and what to do before Q-Day.", "content_html": "The World Economic Forum featured QuSecure Co-Founder and CEO Rebecca Krauthamer discussing how quantum computing will reshape cybersecurity and why organizations should begin preparing now. The video explains the risks posed by future quantum computers, including harvest now, decrypt later attacks, and outlines the steps organizations can take to protect sensitive data before Q-Day arrives.
\nPreparing for quantum threats requires more than deploying new encryption algorithms. Organizations need post-quantum cryptography, crypto agility, and a comprehensive cryptographic inventory to identify vulnerable systems and accelerate migration. Implementing NIST PQC algorithms while aligning with evolving NIST PQC standards supports long-term cyber resilience.
\nQuantum migration is a multiyear effort. Organizations that begin cryptographic discovery, inventory, and modernization today will be better positioned to protect long-lived data and adapt as security requirements evolve.
", "date_published": "2026-08-19T09:27:54Z", "authors": [ { "name": "Trina Mabunay" } ], "tags": [ "Media Coverage" ], "image": "https://www.qusecure.com/og/world-economic-forum-post-quantum-cryptography-video.jpg" }, { "id": "https://www.qusecure.com/securityinfowatch-carahsoft-gsa-schedule-post-quantum-cryptography/", "url": "https://www.qusecure.com/securityinfowatch-carahsoft-gsa-schedule-post-quantum-cryptography/", "title": "QuSecure Featured in SecurityInfoWatch: QuProtect R3 Added to Carahsoft's GSA Schedule", "summary": "SecurityInfoWatch on QuProtect R3 reaching Carahsoft's GSA Schedule, giving federal agencies a procurement path to post-quantum tooling.", "content_html": "SecurityInfoWatch covered the addition of QuSecure’s QuProtect R3 platform to Carahsoft’s GSA Schedule contract. The agreement expands access to QuSecure’s post-quantum cryptography products for U.S. government agencies, and the platform provides continuous cryptographic discovery, active remediation, and compliance reporting.
\nQuProtect R3 lets agencies deploy post-quantum cryptography while maintaining operational continuity through crypto agility. The platform delivers continuous cryptographic inventory, automated remediation, and support for NIST PQC algorithms that align with evolving NIST PQC standards. It also generates compliance-ready reports, including a Cryptographic Bill of Materials.
\nAvailability through Carahsoft’s GSA Schedule gives federal agencies a procurement path to a platform that combines cryptographic discovery, remediation, and reporting. That helps organizations move from planning to execution while preparing for the 2030 and 2031 federal migration milestones.
", "date_published": "2026-08-17T11:12:44Z", "authors": [ { "name": "Trina Mabunay" } ], "tags": [ "Media Coverage" ], "image": "https://www.qusecure.com/og/securityinfowatch-carahsoft-gsa-schedule-post-quantum-cryptography.jpg" }, { "id": "https://www.qusecure.com/qusecure-2026-inc-5000-fastest-growing-private-company/", "url": "https://www.qusecure.com/qusecure-2026-inc-5000-fastest-growing-private-company/", "title": "QuSecure Named No. 526 on the 2026 Inc. 5000 List, the Most Prestigious Ranking of America's Fastest-Growing Private Companies", "summary": "QuSecure ranked 526th on the 2026 Inc. 5000, recognized for three years of revenue growth in post-quantum cryptography.", "content_html": "Company Recognized for Three Years of Outstanding Revenue Growth and Leadership in Post-Quantum Cryptography, Earning a Place Among the Nations’ Most Successful Independent Businesses
\nSAN MATEO, Calif. — Aug. 12, 2026 — QuSecure™, Inc., a leader in post-quantum cryptography (PQC) and cryptographic agility, today announced it has been ranked No. 526 on the 2026 Inc. 5000 list, the annual list of the fastest-growing private companies in America. The list is the most prestigious ranking of the nation’s most successful independent and entrepreneurial businesses, recognizing companies that have achieved remarkable growth while driving innovation, creating jobs, and shaping the future of the economy. Past honorees include companies such as Microsoft, Meta, and Oracle.
\n“Every company on the Inc. 5000 has a story of perseverance, smart decision making, and a refusal to sit still,” says Mike Hofman, editor-in-chief of Inc. “Their growth reflects more than strong financial performance - it reflects creativity, resilience, and the customer focus required to build companies that make a lasting impact. We congratulate all honorees on this significant achievement.”
\nThis year’s Inc. 5000 recognizes a new class of companies redefining what growth looks like. The businesses included are expanding their impact, creating jobs and proving that entrepreneurial ambition continues to fuel the U.S. economy. Among the 5,000 companies on the list, the median three-year revenue growth rate was 130%, and those companies have collectively added more than 627,208 jobs to the U.S. economy over the past three years.
\n“It is rewarding to be recognized in such a high ranking on Inc.’s list of most successful private companies,” said Rebecca Krauthamer, QuSecure CEO and Co-Founder. “Fueled by the timelines for quantum-safe adoption shrinking to 2030, QuSecure anticipates even greater acceleration this year and next, as organizations hasten to address rapidly approaching compliance deadlines. Among our many growth markets are fed gov, banking, and telecom. 2026 is a very important year for QuSecure as the foundation for aggressive growth in the years to come.”
\nCompanies on the 2026 Inc. 5000 list are ranked according to percentage revenue growth from 2022 to 2025. To qualify, companies must have been founded and generating revenue by March 31, 2022. They must be U.S.-based, privately held, for-profit, and independent - not subsidiaries or divisions of other companies - as of Dec. 31, 2025. (Since then, some on the list may have gone public or been acquired.) The minimum revenue required for 2022 is $100,000; the minimum for 2025 is $2 million. As always, Inc. reserves the right to decline applicants for subjective reasons. For the full Inc. 5000 list, honoree company profiles, and a searchable database by industry and location, please visit: www.inc.com/inc5000.
\nAbout Inc.
\nInc. is the leading media brand and playbook for the entrepreneurs and business leaders shaping our future. Through its journalism, Inc. aims to inform, educate, and elevate the profile of its community: the risk-takers, the innovators, and the ultra-driven go-getters who are creating the future of business. Inc. is published by Mansueto Ventures LLC, along with fellow leading business publication Fast Company. For more information, visit www.inc.com.
Contract Addition Enhances Availability of QuSecure’s QuProtect R3 Platform for the Public Sector
\nSAN MATEO, Calf., and RESTON, Va. - Aug. 11, 2026 -QuSecure™, Inc., a leader in post-quantum cryptography (PQC) and cryptographic agility, and Carahsoft Technology Corp., The Trusted Government IT Solutions Provider®, today announced that QuSecure’s post-quantum cryptography (PQC) and cryptographic-agility solutions have been added to Carahsoft’s GSA Schedule contract, expanding access to the QuProtect R3 platform for U.S. Government teams.
\n“Adding QuProtect R3 to Carahsoft’s GSA Schedule contract is an important step in helping Government agencies move from planning to execution on post-quantum security,” said Garfield Jones, QuSecure Senior Vice President of Research and Technology Strategy. “The timelines are no longer theoretical. Key establishment must be upgraded by the end of 2030, and digital signatures by the end of 2031. Agencies are being asked to address cryptographic vulnerabilities, build crypto-agility and prepare production systems for new standards without disrupting critical operations — which is why we’re seeing rising demand for solutions like QuProtect R3 that can fast-track these upgrades without changing underlying code or infrastructure.”
\n“This partnership removes a major procurement obstacle and gives Government customers a faster path to deploy QuProtect R3 through a vehicle they already know and trust,” Jones continued. “That matters because the quantum migration is not a one-time upgrade. It is an operational shift toward stronger, more resilient infrastructure that can adapt as threats, standards and mission requirements continue to evolve.”
\nQuSecure’s QuProtect R3 platform is a fully integrated, production-ready solution designed to help organizations discover, remediate and manage cryptographic risks as they transition to post-quantum security. The platform unifies three core capabilities—continuous discovery, active remediation and real-time reporting—into a single system that provides complete visibility into an organization’s cryptographic environment. Through its recon module, QuProtect R3 delivers a live inventory of cryptographic assets across cloud, on-premise and legacy systems, enabling teams to quickly identify vulnerabilities and prioritize risk before they can be exploited, visibility that periodic, point-in-time audits can’t provide. Its resilience capabilities allow agencies to upgrade encryption and implement quantum-resistant algorithms without system downtime, code changes or costly infrastructure overhauls, the rip-and-replace approach legacy cryptographic upgrades have historically required, while built-in reporting tools generate automated compliance outputs such as Cryptographic Bill of Materials (CBOMs) aligned to evolving Federal standards.
\nQuProtect R3 provides a streamlined and cost-effective path to achieving quantum readiness while maintaining operational continuity. That path is increasingly urgent: recent Federal guidance and executive action have set December 31, 2030, as the deadline for key-establishment upgrades and December 31, 2031, for digital-signature upgrades on high-value Federal systems, narrowing agencies’ runway to modernize. This platform empowers IT and security teams with centralized control, policy-based crypto-agility and the ability to modernize encryption across complex environments without disrupting mission-critical systems. By combining rapid visibility, simplified remediation workflows and audit-ready reporting, QuProtect R3 is helping Government teams meet emerging security mandates, strengthen Zero Trust architectures and proactively defend against both current and future threats.
\n“We are pleased to add QuSecure’s post-quantum cryptography solutions to Carahsoft’s GSA Schedule contract, further strengthening our portfolio of advanced technologies available to the Public Sector,” said Natalie Gregory, Vice President overseeing the QuSecure Team at Carahsoft. “As our customers prepare for the transition to post-quantum security, access to proven, scalable solutions that address evolving cryptographic risk is critical. Together with our reseller partners, we are committed to helping accelerate quantum readiness and enhance security resilience with the QuProtect R3 platform.”
\nQuSecure’s solutions are available through Carahsoft’s GSA Schedule No. 47QSWA18D008F, SEWP V contracts NNG15SC03B and NNG15SC27B, ITES-SW2 Contract W52P1J-20-D-0042, NASPO ValuePoint Master Agreement #AR2472 and OMNIA Partners Contract #R240303. For more information, contact the Carahsoft Team at (571) 662-4771 or QuSecure@carahsoft.com; or learn more about QuProtect R3 use cases for Government.
\nAbout Carahsoft
\nCarahsoft Technology Corp. is The Trusted Government IT Solutions Provider, supporting Public Sector organizations across Federal, State and Local Government agencies and Education and Healthcare markets. As the Master Government Aggregator® for our vendor partners, we deliver solutions for Quantum Computing, Cybersecurity, MultiCloud, DevSecOps, Artificial Intelligence, Customer Experience and Engagement, Open Source and more. Working with resellers, systems integrators and consultants, our sales and marketing teams provide industry leading IT products, services and training through hundreds of contract vehicles. Visit us at www.carahsoft.com.
IT Brief recently highlighted QuSecure’s recognition as a Sample Vendor for crypto agility in three Gartner® Hype Cycle™ reports. Covering Zero-Trust Technology, Application Security, and Data Security Technologies. The recognition reflects the growing importance of cryptographic agility as organizations prepare for post-quantum migration and evolving cybersecurity requirements.
\nAs organizations accelerate adoption of post-quantum cryptography, success depends on more than deploying new algorithms. Building crypto agility, maintaining a comprehensive cryptographic inventory, and implementing NIST PQC algorithms aligned with evolving NIST PQC standards are essential to strengthening post quantum cybersecurity. These capabilities help organizations adapt to changing standards, threats, and compliance requirements while reducing the complexity of cryptographic migration.
\nRecognition across multiple Gartner Hype Cycle reports highlights the growing role of crypto agility in enterprise security. Organizations that invest in cryptographic visibility and flexible cryptographic management today will be better prepared for the transition to quantum-resistant security.
", "date_published": "2026-08-03T17:47:17Z", "authors": [ { "name": "Trina Mabunay" } ], "tags": [ "Media Coverage" ], "image": "https://www.qusecure.com/og/it-brief-gartner-crypto-agility-recognition.jpg" }, { "id": "https://www.qusecure.com/qusecure-gartner-hype-cycle-crypto-agility/", "url": "https://www.qusecure.com/qusecure-gartner-hype-cycle-crypto-agility/", "title": "QuSecure Recognized as a Sample Vendor for Crypto-Agility in Three Separate Gartner® Hype Cycle™ Reports", "summary": "Gartner named QuSecure a Sample Vendor for crypto-agility in three Hype Cycle reports, on changing algorithms without rebuilding systems.", "content_html": "Crypto-Agility is Critical for Post-Quantum Cryptography so Organizations Can Quickly Change Algorithms without Rebuilding or Replacing Systems as Standards, Threats and Regulatory Requirements Evolve
\nSAN MATEO, Calif. — July 31, 2026 — QuSecure™, Inc., a leader in post-quantum cryptography (PQC) and cryptographic agility, today announced it has been recognized by Gartner as a Sample Vendor for crypto-agility solutions in the Gartner® Hype Cycle™ for Zero-Trust Technology1, the Gartner® Hype Cycle™ for Application Security2, and the Gartner® Hype Cycle™ for Data Security Technologies3.
\nQuSecure feels this recognition confirms its advancements in PQC and its mission to ensure public and private sector organizations are secure ahead of looming quantum computing threats to data security. In its view, inclusion in these three reports comes as post-quantum migration timelines compress toward 2029 targets, increasing pressures on organizations to move from planning to execution amid rising “store now, decrypt later” threats and new standards from NIST and CNSA 2.0.
\n“Gartner’s recognition of QuSecure in my view reflects the excellence and trust the team has built in the industry over the past seven years,” said Rebecca Krauthamer, QuSecure CEO and Co-Founder. “As timelines for quantum-safe adoption shrink to 2029 and 2030 for organizations across the world, the crypto-agility migration has become core to annual operating plans. Organizations need visibility into their cryptographic environments, policy-based control, and a practical path to migrate without redesigning applications or replacing hardware. QuProtect R3 was built for that operating reality, enabling quantum-resilient cryptography across enterprise IT, tactical networks, and mission-critical environments at a tenth of the time and cost of status quo migration methods.”
\nAccording to Gartner, “There is a 75% chance that nation-state actors will have a cryptographically relevant quantum computer around 2030, necessitating the move to PQC alternatives…Cryptography usage is growing and the systems using cryptography are becoming more dynamic, demanding more scalable, efficient and agile management practices to support them…Emerging regulations and other mandates are directly or indirectly requiring crypto-agility, such as PCI-DSS, DORA and CA/Browser Forum Ballot SC081.”1
\nQuSecure’s solutions are uniquely designed to deliver a cryptographic security layer across integrated and distributed defense networks, including centralized cryptographic management (including automated cryptography discovery and cryptographic inventory management) and PQC. They are built on NIST PQC algorithms, securing defense communications today and future-proofing missile defense systems. QuSecure’s crypto-agile and zero trust cryptography solutions provide anti-fragile, resilient, network encryption using PQC ciphers to secure network infrastructure, nodes, and applications from adversaries.
\nAccording to Gartner, “Cryptography algorithms and associated parameters require maintenance. This can include the periodic rotation of keys and certificates, migrations to safer alternatives as computing power improves and once-secure algorithms and key lengths become deprecated, and urgent change in response to compromise. The more crypto-agile your implementation and management of cryptography is, the more seamless and efficient this cryptographic maintenance becomes.”2
\nGartner Hype Cycle for Zero-Trust Technology, 2026, by Thomas Lintemuth and Andrew Lerner, July 21, 2026.
\nGartner Hype Cycle for Application Security, 2026, by Dionisio Zumerle, July 21, 2026.
\nGartner Hype Cycle for Data Security Technologies, 2026, by Andrew Bales, June 23, 2026.
\nGartner and Hype Cycle are a trademark of Gartner, Inc. and/or its affiliates.
\nGartner does not endorse any vendor, product or service depicted in its research publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner’s research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.
", "date_published": "2026-07-31T15:00:33Z", "authors": [ { "name": "Trina Mabunay" } ], "tags": [ "Press Releases" ], "image": "https://www.qusecure.com/og/qusecure-gartner-hype-cycle-crypto-agility.jpg" }, { "id": "https://www.qusecure.com/quantum-zeitgeist-post-quantum-cryptography-platform/", "url": "https://www.qusecure.com/quantum-zeitgeist-post-quantum-cryptography-platform/", "title": "QuSecure Featured in Quantum Zeitgeist: QuProtect R3 Simplifies Post-Quantum Cryptography", "summary": "Quantum Zeitgeist on how QuProtect R3 modernizes encryption through centralized policy management with minimal operational disruption.", "content_html": "Quantum Zeitgeist recently highlighted how QuSecure’s QuProtect R3 platform simplifies the transition to post-quantum cryptography for enterprise and government organizations. The article examines how organizations can modernize encryption while minimizing operational disruption as quantum computing advances.
\nQuProtect R3 helps organizations accelerate adoption of post-quantum cryptography through centralized policy management and crypto agility. The platform enables a comprehensive cryptographic inventory, supports deployment of NIST PQC algorithms, and helps organizations align with evolving NIST PQC standards. These capabilities strengthen post quantum cybersecurity while enabling organizations to modernize cryptography across legacy and modern environments.
\nPreparing for quantum threats requires more than implementing new algorithms. Organizations need visibility into their cryptographic assets, flexible policy management, and the ability to rapidly update encryption as standards evolve. QuProtect R3 provides a practical path to long-term quantum resilience.
", "date_published": "2026-07-25T16:37:52Z", "authors": [ { "name": "Trina Mabunay" } ], "tags": [ "Media Coverage" ], "image": "https://www.qusecure.com/og/quantum-zeitgeist-post-quantum-cryptography-platform.jpg" }, { "id": "https://www.qusecure.com/federal-contractors-accelerate-pqc-migration/", "url": "https://www.qusecure.com/federal-contractors-accelerate-pqc-migration/", "title": "Federal Contractors: Accelerate PQC Migration", "summary": "A short clip on the accelerated compliance timeline federal contractors face, and why key establishment on high-value assets comes first.", "content_html": "A short clip rather than a full session, running well under a minute.
\nFederal contractors face an accelerated timeline for regulatory compliance. Key establishment on high-value assets is crucial, as a single network vulnerability compromises the entire system. Transition to PQC-ready algorithms now.
", "date_published": "2026-07-24T13:10:21Z", "authors": [ { "name": "Meg Gleason" } ], "tags": [ "Webinars" ], "image": "https://www.qusecure.com/og/federal-contractors-accelerate-pqc-migration.jpg" }, { "id": "https://www.qusecure.com/missing-pillar-cryptography-zero-trust/", "url": "https://www.qusecure.com/missing-pillar-cryptography-zero-trust/", "title": "The Missing Pillar: Why Cryptography Should Be a First-Class Citizen in Zero Trust", "summary": "CISA's Zero Trust Maturity Model treats cryptography as a detail inside the Network pillar; the case for making it the foundation instead.", "content_html": "When you buy a house, you check the roof, the windows, the electrical, the plumbing. What’s easy to miss because it’s underground and invisible is the foundation. If the foundation is compromised, the whole building comes down. Everything above it is irrelevant.
\nThat’s where we are with cryptography in Zero Trust.
\nThe CISA Zero Trust Maturity Model is one of the most important security frameworks in federal IT today. Its five pillars, Identity, Devices, Networks, Applications, and Data, provide a clear architecture for reducing implicit trust across enterprise environments. But there is an opportunity to strengthen how the model is structured. Cryptography sits as a detail inside the Network pillar rather than recognized as the foundational requirement it is. We think that is worth reconsidering.
\nEvery pillar in the CISA Zero Trust Maturity Model depends on cryptographic integrity to function. Every single one. I am not overstating this. After working in this field, I came to understand how fundamental encryption is to all of security, and how easy it is to lose sight of that. Let me walk through each pillar to build the case, using concrete examples of how cryptography underpins every one.
\nIdentity uses digital signatures at its core. JSON Web Tokens, the standard mechanism for identity assertion in modern systems, are cryptographically signed. Forge that signature and every downstream access decision built on that identity claim is compromised. The entire premise of “verify explicitly” breaks. And signatures are only half the story. Those same tokens often carry scope claims that spell out exactly what the bearer is allowed to do, so they don’t just assert who you are, they shape what you are permitted to access. Authorization decisions ride on that cryptographically signed payload just as much as authentication does. Break the crypto and an attacker can mint or tamper with a token to grant themselves whatever scope they want, quietly escalating privileges while every downstream service still trusts the claim. Identity and authorization both collapse on the same cryptographic foundation.
\nDevices depend on cryptographic trust chains. Device certificates and hardware attestation are how a zero-trust architecture determines whether an endpoint is what it claims to be. Cryptographic integrity is what makes that chain hold. That chain is built on public key infrastructure. Every device certificate is issued by a certificate authority, and the whole model only works because a trusted CA cryptographically signs each certificate, binding an identity to a key pair the device can prove it controls. When an endpoint presents its certificate, the architecture validates that signature back up the chain to a root of trust, and it checks revocation to make sure the certificate hasn’t been pulled. Enrollment, renewal, and revocation all have to be managed at scale, which is exactly why PKI is operational plumbing, not a one-time setup. And if the algorithms underneath that CA are ever broken, an attacker can forge certificates the whole fleet will trust, and device identity across the enterprise falls with it.
\nNetworks are the one place the current framework at least acknowledges encryption, through TLS and IPsec. But even here it’s buried as a feature. Network security runs on cryptography. The current framing obscures what actually needs to be managed and migrated. And there is a point people miss here: the conversation tends to fixate on encrypting the data in transit, but encryption on its own only buys you confidentiality. It keeps an eavesdropper from reading the traffic, and nothing more. It says nothing about who is on the other end of the connection. Without strong authentication you can be encrypting a perfectly private conversation with an attacker, which is why protocols like TLS authenticate the endpoints with certificates before any data flows. Trusting who you are talking to is just as foundational as protecting what you say, and both of those guarantees rest on the same cryptography.
\nApplications rely on HMAC hash validation and OAuth2 token integrity. Secure hashing is how applications verify that data hasn’t been tampered with in transit. That’s built into every authentication handshake. It is worth being precise about why this works. The HMAC value itself isn’t a secret, it travels alongside the data in the clear, so anyone can see it. What they can’t do is recompute or alter it, because an HMAC is keyed: producing a valid one requires a shared secret key, not just the message. That’s the difference between a plain hash, which anyone can regenerate after tampering with the data, and a keyed hash, which cannot be changed without the key. So even though the hash is public, an attacker who modifies the message can’t produce a matching HMAC, and the tampering is caught. Break the underlying cryptography, though, and that guarantee evaporates.
\nData at rest is protected by symmetric encryption and key management systems. The encryption key is the security control. There is no data protection without a cryptographic strategy underneath it. And the hard part of data at rest was never the encryption itself, it’s the keys. Ciphertext sitting on a disk is only as safe as the key that unlocks it, so the real work is key management: generating keys, storing them in an HSM or key vault, rotating them on a schedule, and revoking them cleanly when something is compromised. This is also where the long lifetime of stored data bites. Information written to disk today may still be sensitive in ten or fifteen years, which means an adversary can harvest encrypted data now and simply wait, decrypting it once the underlying algorithm weakens. That “harvest now, decrypt later” exposure is why the cryptography protecting data at rest has to be chosen with its full retention horizon in mind, not just today’s threat model.
\nNow consider what happens when a single digital signature in this chain gets forged. Every pillar that trusts that signature is exposed. The strongest network controls, device policies, and access governance do not save you. The adversary is already inside, carrying a legitimate identity, on a trusted device, authorized by a poisoned token. One forged signature and all five pillars can fall together, because the foundation has given way. That is the real lesson of walking the pillars one by one: none of them stand on their own. Identity, devices, networks, applications, and data are all resting on the same cryptographic guarantees of confidentiality, integrity, and authenticity. Strip those guarantees away, and every pillar loses the thing that made it trustworthy in the first place. Which leads to the conclusion the whole model has been circling around: without the security guarantees that cryptography provides, you simply cannot do Zero Trust.
\nHere’s what makes the current framing risky: cryptography is embedded everywhere, and migrating it takes a decade. And it only grows from here: every Zero Trust pillar you add multiplies the cryptography in play, so the footprint that needs to be managed and migrated keeps expanding rather than holding steady.
\nNot a sprint. Not a fiscal year initiative. A decade on average, and often longer, to inventory, prioritize, and systematically replace the cryptographic algorithms woven into enterprise infrastructure. That’s the scope of the post-quantum migration. NIST finalized its first post-quantum cryptographic standards in 2024. The clock is already running. And this is not a one-time event: cryptography changes over time. As new threats emerge, the algorithms adapt to stay ahead of them, and each of those changes has to be deployed across the enterprise. That recurring deployment challenge is what makes cryptography a foundation to manage continuously, not a box to check once. And it is worth being honest about where that cost comes from, because it is not just deployment labor. The algorithms themselves are the product of decades of painstaking work by the global cryptographic community. NIST’s post-quantum standards, for instance, came out of a multi-year, open competition in which cryptographers around the world proposed candidate algorithms and then spent years trying to break each other’s submissions. That adversarial scrutiny is the whole point: an algorithm only earns trust after it has survived sustained, public attempts to defeat it. Standing on the shoulders of that effort is what lets an enterprise treat a new algorithm as a real security guarantee rather than a hopeful assumption, and it is also why the work never finishes. Every time the research community strengthens or retires an algorithm, that hard-won progress has to be carried back into the enterprise, which is the recurring cost of keeping cryptography current.
\nNo other element of Zero Trust carries that migration burden. You can retrain staff on identity hygiene in months. You can roll out new device management policies in a quarter. Cryptographic migration requires a dedicated, multi-year program with executive sponsorship, dedicated resourcing, and governance structures that don’t yet exist in most federal agencies, in part because the framework doesn’t yet call for it explicitly. And it is worth noticing what kind of work those other changes actually are. Retraining staff on identity hygiene or rolling out new device management policies are largely process-oriented efforts: they adjust how people request, grant, and review access, and they can be handled through the normal cadence of security operations, policy updates, and user training. In other words, most of the Zero Trust pillars evolve through changes to access processes and governance, which organizations already know how to run on quarterly or annual cycles. Cryptographic migration is different in kind. It is not a process tweak layered on top of existing access controls but a deep, technical replacement of the security primitives those controls quietly depend on, and that is why it demands its own dedicated program rather than fitting into the usual process-improvement rhythm.
\nWhen something requires its own strategy, its own roadmap, its own budget line, and its own governance program, it belongs in its own pillar.
\nIn the near term, we’d encourage elevating cryptography to a named function within the Network pillar, giving it the visibility, specificity, and measurement criteria that other functions receive. This would move it out of the encryption footnotes.
\nIn the next revision of the Zero Trust Maturity Model, we’d suggest recognizing Cryptography as a standalone sixth pillar.
\nThe security field was built on cryptography. RSA, the world’s largest security conference, is named after the inventors of a cryptographic algorithm. The entire architecture of digital security rests on the assumption that certain mathematical problems are hard to solve. When that assumption changes, as it will with quantum computing, everything built on it gets exposed at once, across every pillar, in every agency, simultaneously.
\nCryptography is the foundation this zero trust building sits on. Time to name it.
\n“Cryptographic agility” started as a clear technical argument stated publicly, carried forward until the field caught up. This is the same play. Taking a strong public stance and bringing people along is how frameworks evolve. It’s how change at the standards level actually happens. And the reason this matters so much comes back to a single point: every pillar of Zero Trust ultimately depends on the security guarantees that only cryptography provides. The confidentiality, integrity, and authenticity that let you verify identities, trust devices, secure networks, protect data, and authorize access are all cryptographic guarantees at their core. Take those away and there is nothing left to build trust on. Put plainly, without cryptography you cannot do Zero Trust. This is also why crypto agility belongs at the center of the conversation rather than the margins. NIST made the same case in its Cybersecurity White Paper 39, “Considerations for Achieving Crypto Agility,” which lays out a strategy for building systems that can swap cryptographic algorithms in and out as standards change instead of hard-wiring today’s choices into place. That is precisely the capability every Zero Trust pillar needs, because the migration never ends and the algorithms will keep evolving. Treating cryptography as a first-class, agile foundation, exactly as CSWP 39 argues, is what turns “you cannot do Zero Trust without cryptography” from a warning into a workable engineering plan.
\nLet’s build on solid ground.
", "date_published": "2026-07-22T23:37:41Z", "authors": [ { "name": "Trina Mabunay" } ], "tags": [ "Insights" ], "image": "https://www.qusecure.com/og/missing-pillar-cryptography-zero-trust.jpg" }, { "id": "https://www.qusecure.com/qubit-report-aws-icmp-quprotect-r3/", "url": "https://www.qusecure.com/qubit-report-aws-icmp-quprotect-r3/", "title": "QuSecure Featured in The Qubit Report: QuProtect R3 Listed in AWS ICMP", "summary": "The Qubit Report on QuProtect R3 in the AWS marketplace for the Intelligence Community, and the procurement route it opens for agencies.", "content_html": "The Qubit Report recently highlighted QuSecure’s listing of QuProtect R3 in the AWS Marketplace for the U.S. Intelligence Community (ICMP). The listing provides federal agencies and intelligence organizations with streamlined access to QuSecure’s platform for post-quantum cryptography and cryptographic agility, helping accelerate quantum-resilient security adoption across government environments.
\nQuProtect R3 enables organizations to implement post-quantum cryptography while maintaining operational continuity through crypto agility. The platform helps agencies build a comprehensive cryptographic inventory, automate cryptographic policy management, and deploy NIST PQC algorithms aligned with evolving NIST PQC standards. These capabilities strengthen post quantum cybersecurity while simplifying migration across enterprise IT, tactical networks, and mission-critical operations.
\nAvailability through AWS ICMP simplifies software procurement for federal customers while helping agencies accelerate cryptographic modernization. Organizations can assess cryptographic exposure, enforce security policies, and deploy quantum-resilient protections without replacing existing applications or infrastructure.
", "date_published": "2026-07-18T15:37:46Z", "authors": [ { "name": "Trina Mabunay" } ], "tags": [ "Media Coverage" ], "image": "https://www.qusecure.com/og/qubit-report-aws-icmp-quprotect-r3.jpg" }, { "id": "https://www.qusecure.com/quantum-insider-aws-icmp-quprotect-r3/", "url": "https://www.qusecure.com/quantum-insider-aws-icmp-quprotect-r3/", "title": "QuSecure Featured in The Quantum Insider: QuProtect R3 Listed in AWS ICMP", "summary": "The Quantum Insider on QuProtect R3 in the AWS marketplace for the Intelligence Community, and the visibility and policy management it brings.", "content_html": "The Quantum Insider recently highlighted QuSecure’s listing of QuProtect R3 in the AWS Marketplace for the U.S. Intelligence Community (ICMP). The listing expands access to QuSecure’s cryptographic agility platform. Making it easier for federal agencies and intelligence organizations to deploy quantum-resilient cybersecurity solutions through a trusted procurement channel.
\nQuProtect R3 helps organizations accelerate adoption of post-quantum cryptography. By providing the visibility, policy management, and automation needed for large-scale migration. Through crypto agility, comprehensive cryptographic inventory, and support for NIST PQC algorithms, organizations can align with evolving NIST PQC standards while strengthening post quantum cybersecurity across existing environments.
\nAs federal agencies accelerate their transition to quantum-resistant security, availability through AWS ICMP simplifies procurement and deployment while helping organizations modernize cryptography with minimal operational disruption.
", "date_published": "2026-07-15T18:17:26Z", "authors": [ { "name": "Trina Mabunay" } ], "tags": [ "Media Coverage" ], "image": "https://www.qusecure.com/og/quantum-insider-aws-icmp-quprotect-r3.jpg" }, { "id": "https://www.qusecure.com/security-today-aws-icmp-quprotect-r3/", "url": "https://www.qusecure.com/security-today-aws-icmp-quprotect-r3/", "title": "QuSecure Featured in Security Today: AWS Marketplace Lists QuProtect R3 for Federal Agencies", "summary": "Security Today on QuProtect R3 in the AWS marketplace for the Intelligence Community, reached through a curated government channel.", "content_html": "Security Today recently highlighted QuSecure’s listing of QuProtect R3 in the AWS Marketplace for the U.S. Intelligence Community (ICMP). The listing gives federal agencies and intelligence organizations streamlined access to QuSecure’s production-ready platform for post-quantum cryptography and cryptographic agility through AWS’s curated government marketplace.
\nQuProtect R3 helps organizations modernize encryption by implementing post-quantum cryptography while maintaining operational continuity through crypto agility. The platform enables agencies to build a comprehensive cryptographic inventory, automate cryptographic policy management, and deploy NIST PQC algorithms aligned with evolving NIST PQC standards. These capabilities strengthen post quantum cybersecurity while simplifying migration across existing federal environments.
\nAs government agencies work toward post-quantum migration deadlines, availability through AWS ICMP simplifies procurement and deployment of quantum-resilient cybersecurity solutions. Organizations can modernize cryptography without replacing existing infrastructure, helping reduce operational complexity while improving long-term cyber resilience.
", "date_published": "2026-07-15T17:07:37Z", "authors": [ { "name": "Trina Mabunay" } ], "tags": [ "Media Coverage" ], "image": "https://www.qusecure.com/og/security-today-aws-icmp-quprotect-r3.jpg" }, { "id": "https://www.qusecure.com/quantum-computing-report-aws-icmp-quprotect-r3/", "url": "https://www.qusecure.com/quantum-computing-report-aws-icmp-quprotect-r3/", "title": "QuSecure Featured in Quantum Computing Report: QuProtect R3 Listed in AWS ICMP Post-Quantum Cryptography", "summary": "Quantum Computing Report on QuProtect R3 listed in the AWS marketplace for the US Intelligence Community, easing defense and intelligence access.", "content_html": "Quantum Computing Report recently highlighted QuSecure’s listing of QuProtect R3 in the AWS ICMP Post-Quantum Cryptography Marketplace for the U.S. Intelligence Community (ICMP). The listing gives federal defense and intelligence organizations streamlined access to QuSecure’s cryptographic agility platform, helping accelerate adoption of quantum-resilient security without requiring major infrastructure changes.
\nThe article highlights how organizations can modernize encryption with post-quantum cryptography while maintaining operational continuity through crypto agility. QuProtect R3 enables agencies to build a comprehensive cryptographic inventory, automate policy enforcement, and deploy NIST PQC algorithms that align with evolving NIST PQC standards. These capabilities help strengthen post quantum cybersecurity while simplifying migration across federal environments.
\nAvailability through AWS ICMP makes it easier for federal agencies and intelligence organizations to procure and deploy quantum-resilient cybersecurity solutions. As government timelines accelerate, cloud-based access to proven cryptographic modernization tools can help organizations move from planning to implementation faster.
", "date_published": "2026-07-14T17:51:43Z", "authors": [ { "name": "Trina Mabunay" } ], "tags": [ "Media Coverage" ], "image": "https://www.qusecure.com/og/quantum-computing-report-aws-icmp-quprotect-r3.jpg" }, { "id": "https://www.qusecure.com/quprotect-r3-aws-icmp-us-federal-government/", "url": "https://www.qusecure.com/quprotect-r3-aws-icmp-us-federal-government/", "title": "QuSecure QuProtect R3 Listed in AWS \"ICMP\" for the U.S. Federal Government", "summary": "QuProtect R3 is listed in AWS ICMP, giving federal and intelligence organizations a streamlined route to crypto-agility and post-quantum cryptography.", "content_html": "Availability Through AWS ICMP Gives Federal and Intelligence Community Organizations Streamlined Access to QuSecure’s Crypto-Agility and Post-Quantum Cryptography Platform
\nSAN MATEO, Calif. — July 14, 2026 — QuSecure™, Inc., a post-quantum cryptography (PQC) and cryptographic-agility company helping organizations manage cryptographic risk and prepare for quantum-resilient security, today announced that it listed QuProtect R3™ in the AWS Marketplace for the U.S. Intelligence Community (ICMP). ICMP is a curated digital catalog from Amazon Web Services (AWS) that makes it easy to discover, purchase, and deploy software packages and applications from vendors that specialize in supporting government customers.
\nQuProtect R3 is a post-quantum cryptography (PQC) and crypto-agility platform that helps government organizations discover, inventory, manage, and enforce cryptographic policy across existing networks. The platform enables migration to quantum-resilient cryptography without requiring application redesign or hardware replacement while protecting sensitive data and communications across enterprise IT environments, tactical networks, and mission-critical operations.
\n“Government agencies need practical ways to prepare for post-quantum cryptography while maintaining security across today’s systems,” said Brian Cunningham, QuSecure EVP of Strategy & Growth. “QuProtect R3 can help organizations assess cryptographic exposure, manage cryptographic policy, and deploy quantum-resilient protections across existing environments. We are pleased to offer QuProtect R3 on ICMP to give more federal customers access to QuSecure’s technology.”
", "date_published": "2026-07-14T12:00:33Z", "authors": [ { "name": "Trina Mabunay" } ], "tags": [ "Press Releases" ], "image": "https://www.qusecure.com/og/quprotect-r3-aws-icmp-us-federal-government.jpg" }, { "id": "https://www.qusecure.com/intelligence-community-news-doug-small-federal-advisory-board/", "url": "https://www.qusecure.com/intelligence-community-news-doug-small-federal-advisory-board/", "title": "QuSecure Featured in Intelligence Community News: Doug Small Joins Federal Advisory Board", "summary": "Intelligence Community News on Doug Small joining the Federal Advisory Board as executive orders and Department of War guidance drive migration.", "content_html": "Intelligence Community News highlighted the appointment of retired U.S. Navy Rear Admiral Doug Small to QuSecure’s Federal Advisory Board as federal agencies accelerate their transition to quantum-resilient security. The article notes that Small joins QuSecure at a pivotal time. As new executive orders and Department of War guidance drive post-quantum cryptography migration across government systems.
\nWith more than 35 years of leadership in information warfare and defense modernization. Admiral Small brings valuable expertise to support agencies implementing post-quantum cryptography. Success will depend on building crypto agility, maintaining a comprehensive cryptographic inventory, and deploying NIST PQC algorithms that align with emerging NIST PQC standards. These capabilities are essential to strengthening post quantum cybersecurity across government and critical infrastructure.
\nAs agencies move from planning to execution, experienced leaders like Admiral Small provide strategic guidance to help government organizations modernize cryptography and prepare for the quantum era.
", "date_published": "2026-07-09T17:10:41Z", "authors": [ { "name": "Trina Mabunay" } ], "tags": [ "Media Coverage" ], "image": "https://www.qusecure.com/og/intelligence-community-news-doug-small-federal-advisory-board.jpg" }, { "id": "https://www.qusecure.com/executing-omb-m-26-15/", "url": "https://www.qusecure.com/executing-omb-m-26-15/", "title": "Executing OMB's M-26-15 Core Objectives With QuProtect", "summary": "OMB Memorandum M-26-15 sets ten objectives for federal PQC migration; this walks each one and maps it to QuProtect R3's three capabilities.", "content_html": "Rebecca Ilett, Forward Deployed Engineer at QuSecure
\nThe Office of Management and Budget (OMB) Memorandum M-26-15 recently gave federal agencies a playbook for post-quantum cryptography (PQC) migration. It calls for an automated, continuously updated cryptographic inventory and makes crypto-agility an architectural objective.
\nQuProtect R3 by QuSecure was specifically designed to help large organizations, including federal agencies, complete the transition to PQC and cryptographic agility. It’s three principal capabilities of Reconnaissance, Resilience, and Reporting map directly onto guidance in the memo. This guide walks the memo’s core objectives one by one and explains how QuProtect R3 can help agencies and contractors achieve them.
\nAgencies must execute a prioritized migration “with the objective of mitigating as much quantum risk as feasible by December 31, 2030,” and must fold PQC readiness into existing governance rather than building something parallel.
\nQuProtect Solution: The 2030 objective is ultimately about getting PQC deployed across the systems that matter, without breaking them. QuProtect deploys National Institute of Standards and Technology (NIST) approved PQC across existing infrastructure without application rewrites or downtime, which is what makes a four-year timeline realistic rather than aspirational. Because it operates as an overlay with centralized control, agencies avoid the rip-and-replace projects that turn migration deadlines into missed deadlines.
\nEvery agency must submit a plan to OMB and the Office of the National Cyber Director (ONCD) within 120 days. The appendix lists exactly what it must contain, including a risk-based prioritization strategy, phase milestones, the TLS 1.3 timeline, the inventory methodology and tools, a crypto-agility plan, a third-party coordination plan, resource estimates, and defined governance roles.
\nQuProtect Solution: The plan must be written from real data rather than from guesswork. QuProtect’s automated discovery gives you a cryptographic inventory to base your prioritization and resourcing on, and a concrete answer to the required “methodologies and automated tools used for the cryptographic inventory” section. The required “plan for implementing a cryptographic agile architecture” is materially stronger when you can point to an orchestration layer already capable of policy-based algorithm changes.
\nAgencies must prioritize high impact systems, High Value Assets (HVAs), and any system with highly sensitive data or heightened exposure to attacks by a cryptographically relevant quantum computer (CRQC), specifically flagging Public Key Infrastructure (PKI) style asymmetric access-control systems and data “expected to remain mission-sensitive in 2030.”
\nQuProtect Solution: You cannot prioritize by risk until you can see where your vulnerable cryptography is and what it protects. QuProtect’s Reconnaissance automatically identifies cryptographic assets, surfaces vulnerable and quantum-vulnerable algorithms, and highlights the asymmetric-encryption and PKI dependencies the memo calls out. That inventory is the raw material for a risk ranking that stands up to scrutiny.
\nSystems “incapable of supporting PQC or hybrid cryptography must be identified and given priority for replacement or decommissioning,” and PQC upgrades should ride along with planned cloud, software, and hardware refreshes.
\nQuProtect Solution: Identifying the dead ends is a discovery problem, and continuous discovery is exactly what Recon does. It surfaces where unsupportable or non-agile cryptography lives so you can flag those systems early. Just as important, because QuProtect protects data in motion across existing infrastructure without touching the applications, it can extend quantum-resilient protection to many systems that look like replacement candidates, reducing how much you actually have to rip out. Budgeting and executing the replacement or decommissioning of genuinely dead-end systems is an agency modernization program. QuProtect narrows that list and buys time on the rest.
\nAgencies must make PQC integration a requirement for relevant products, engage Federal Risk and Authorization Management Program (FedRAMP) authorized cloud providers on shared-responsibility duties, and coordinate third-party migration.
\nQuProtect Solution: Much of an agency’s cryptography lives in products and cloud services it does not control, and the memo requires a “third-party coordination plan.” QuProtect’s discovery extends visibility across distributed and cloud environments, so you can see where third-party and cloud-terminated cryptography sits and hold coordinated conversations from evidence rather than vendor assurances.
\n“Manual approaches to discovery and management of cryptography are often insufficient.” Automation is “critical for inventory management, policy enforcement, and compliance reporting,” feeding a dynamic, continuously updated CBOM and live dashboards.
\nQuProtect Solution: QuProtect was built precisely because manual cryptographic inventory and management cannot keep pace with federal-scale information technology. Recon delivers automated, continuous discovery; Resilience enforces cryptographic policy across distributed systems; and Reporting turns that live data into a current CBOM and compliance evidence on demand. Where the memo describes automated inventory feeding a central CBOM and dashboards, it is describing QuProtect’s core loop.
\nCrypto-agility is defined as the ability “to switch its cryptographic algorithms with minimal disruption,” essential not only for the quantum threat but for any future cryptographic weakness. The memo asks for configuration-driven cryptography, protocol negotiation, and agile key management.
\nQuProtect Solution: Orchestrated crypto-agility is QuProtect’s founding idea. Resilience provides centralized policy management that lets agencies change cryptographic algorithms without code changes or redeployment, which is the operational definition of “minimal disruption.” This directly addresses the memo’s call for configuration-driven cryptography rather than algorithms hardcoded into application binaries.
\nAgencies must support TLS 1.3 or a successor “as soon as practicable, but not later than January 2, 2030,” as the foundation for network-level PQC and hybrid key exchange.
\nQuProtect Solution: QuProtect Resilience provides TLS 1.3 protection for co-located TCP/IP network services, satisfying this key requirement as a prerequisite for PQC upgrade. The solution supports either hybrid or pure PQC key exchange algorithms to match the organization’s intended deployment configuration.
\nPQC is “a foundational dependency” for a mature zero-trust architecture (ZTA), because “never trust, always verify” fails if the verifying cryptography is vulnerable. The memo maps PQC across four pillars: devices, networks, applications, and data.
\nQuProtect Solution: QuProtect Resilience enables a quantum-safe, zero-trust security architecture at scale, directly satisfying this requirement. By supporting strong identity for workloads and applications, Resilience creates quantum-safe, mutually-authenticated connections to ensure data is protected from unauthorized access as it traverses untrusted networks. This capability maps directly onto the Network, Applications and Workloads, and Data pillars outlined in the memo.
\nMigration requires accountability across leadership, clearly defined roles (Chief Information Officer, Chief Information Security Officer, technical and migration leads, security architect, system owners), and Chief Financial Officer (CFO) involvement so migration costs appear in the budget request.
\nQuProtect Solution: QuProtect helps make governance enforceable: once cryptographic policy is set, Resilience lets those policies be applied and monitored centrally, and Reporting gives leadership the concrete data that make resourcing decisions defensible rather than speculative.
\nEverything in M-26-15 depends on one thing: a dynamic, automated cryptographic inventory. Agencies that begin the discovery phase by hand-counting cryptography across applications, certificates, APIs, VPNs, cloud, endpoints, operational technology, and PKI will spend the 2026 to 2027 discovery window still discovering, and arrive at the 2030 migration deadline without having reached the starting line.
\nQuProtect compresses that timeline at both ends. At the front, automated discovery gives agencies a real inventory in a fraction of the time manual methods take, so the discovery phase finishes on schedule and the migration plan is built on evidence. At the back, orchestrated crypto-agility means the migration itself, and every cryptographic transition after it, is a policy change rather than a redeployment, so the 2030, 2031, and 2035 milestones are milestones you pass rather than walls you hit.
\nWant a requirement-by-requirement look at where your agency or product stands against M-26-15? Talk to a QuSecure expert or schedule a demo.
", "date_published": "2026-07-09T17:08:20Z", "authors": [ { "name": "Trina Mabunay" } ], "tags": [ "Insights" ], "image": "https://www.qusecure.com/og/executing-omb-m-26-15.jpg" }, { "id": "https://www.qusecure.com/executivebiz-doug-small-federal-advisory-board/", "url": "https://www.qusecure.com/executivebiz-doug-small-federal-advisory-board/", "title": "QuSecure Featured in ExecutiveBiz: Doug Small Joins Federal Advisory Board", "summary": "ExecutiveBiz on Doug Small joining the Federal Advisory Board, bringing 36 years in the Navy including NAVWAR and Project Overmatch.", "content_html": "ExecutiveBiz recently highlighted the appointment of retired U.S. Navy Rear Admiral Doug Small to QuSecure’s Federal Advisory Board. Small joins QuSecure as federal agencies accelerate the transition to post-quantum cryptography in response to new executive orders and Department of War security mandates.
\nSmall brings 36 years of U.S. Navy leadership in information warfare, defense modernization, and cybersecurity. His experience leading Naval Information Warfare Systems Command (NAVWAR) and Project Overmatch will help support federal agencies and contractors. As they implement crypto agility, build a comprehensive cryptographic inventory, and deploy NIST PQC algorithms. Aligning with emerging NIST PQC standards will help strengthen post quantum cybersecurity and support long-term federal quantum readiness.
\nAs agencies move from planning to execution, experienced leaders like Admiral Small bring valuable operational insight to the implementation of quantum-ready security strategies across government and defense environments.
", "date_published": "2026-07-08T16:39:54Z", "authors": [ { "name": "Trina Mabunay" } ], "tags": [ "Media Coverage" ], "image": "https://www.qusecure.com/og/executivebiz-doug-small-federal-advisory-board.jpg" }, { "id": "https://www.qusecure.com/citybiz-doug-small-federal-advisory-board/", "url": "https://www.qusecure.com/citybiz-doug-small-federal-advisory-board/", "title": "QuSecure Featured in Citybiz: Retired Rear Adm. Doug Small Joins Federal Advisory Board", "summary": "Citybiz on Doug Small joining the Federal Advisory Board, with 35 years in information warfare, as agencies move from planning to implementation.", "content_html": "Citybiz recently highlighted the appointment of retired U.S. Navy Rear Adm. Doug Small to QuSecure’s Federal Advisory Board. The article notes that Small joins QuSecure as federal agencies accelerate the transition from planning to implementation of post-quantum cryptography initiatives. Driven by new federal directives and national security mandates.
\nWith more than 35 years of leadership in information warfare, cybersecurity, and defense technology. Admiral Small brings valuable expertise to support agencies modernizing their cryptographic infrastructure. Successfully adopting post-quantum cryptography requires crypto agility, a comprehensive cryptographic inventory, and deployment of NIST PQC algorithms that align with evolving NIST PQC standards. These capabilities help strengthen post quantum cybersecurity across government and critical infrastructure.
\nAs agencies prepare for emerging quantum threats, leaders like Admiral Small bring operational insight that helps bridge national security priorities with practical implementation. His experience will help guide organizations as they modernize cryptography while maintaining mission continuity.
", "date_published": "2026-07-07T22:36:07Z", "authors": [ { "name": "Trina Mabunay" } ], "tags": [ "Media Coverage" ], "image": "https://www.qusecure.com/og/citybiz-doug-small-federal-advisory-board.jpg" }, { "id": "https://www.qusecure.com/quantum-insider-doug-small-federal-advisory-board/", "url": "https://www.qusecure.com/quantum-insider-doug-small-federal-advisory-board/", "title": "QuSecure Featured in The Quantum Insider: Doug Small Joins Federal Advisory Board", "summary": "The Quantum Insider on Doug Small joining the Federal Advisory Board, bringing 35 years of information warfare and defense modernization.", "content_html": "The Quantum Insider recently highlighted the appointment of retired U.S. Navy Rear Admiral Doug Small to QuSecure’s Federal Advisory Board. The article notes that Small joins QuSecure as federal agencies accelerate post-quantum cryptography migration in response to new cybersecurity directives and national security initiatives.
\nWith more than 35 years of leadership in information warfare and defense modernization, Admiral Small brings strategic expertise to support government organizations implementing post-quantum cryptography. Building crypto agility, maintaining a comprehensive cryptographic inventory, and deploying NIST PQC algorithms aligned with evolving NIST PQC standards are essential for strengthening post quantum cybersecurity across government and defense environments.
\nAs agencies move from planning to implementation, experienced leaders like Admiral Small help bridge operational expertise with emerging cybersecurity technologies. His leadership will support mission-critical modernization efforts as organizations prepare for the quantum era.
", "date_published": "2026-07-07T22:17:47Z", "authors": [ { "name": "Trina Mabunay" } ], "tags": [ "Media Coverage" ], "image": "https://www.qusecure.com/og/quantum-insider-doug-small-federal-advisory-board.jpg" }, { "id": "https://www.qusecure.com/hstoday-doug-small-federal-advisory-board/", "url": "https://www.qusecure.com/hstoday-doug-small-federal-advisory-board/", "title": "QuSecure Featured in Homeland Security Today: U.S. Navy Rear Admiral Doug Small Joins Federal Advisory Board", "summary": "Homeland Security Today on Doug Small joining the Federal Advisory Board, with 35 years in information warfare and defense modernization.", "content_html": "Homeland Security Today recently highlighted the appointment of retired U.S. Navy Rear Admiral Doug Small to QuSecure’s Federal Advisory Board. The article notes that Small joins QuSecure as federal agencies accelerate post-quantum cryptography migration. In response to new federal directives and national security priorities.
\nWith more than 35 years of leadership in information warfare and defense modernization. Admiral Small brings deep operational expertise to support agencies implementing post-quantum cryptography. Building crypto agility, maintaining a comprehensive cryptographic inventory, and deploying NIST PQC algorithms aligned with evolving NIST PQC standards are critical to strengthening post quantum cybersecurity across government and defense environments.
\nAs federal agencies move from planning to execution, experienced leaders like Admiral Small help bridge operational expertise with emerging cybersecurity technologies. His leadership will support government organizations as they modernize cryptographic infrastructure and prepare mission-critical systems for future quantum threats.
", "date_published": "2026-07-07T21:56:39Z", "authors": [ { "name": "Trina Mabunay" } ], "tags": [ "Media Coverage" ], "image": "https://www.qusecure.com/og/hstoday-doug-small-federal-advisory-board.jpg" }, { "id": "https://www.qusecure.com/brief-glance-doug-small-federal-advisory-board/", "url": "https://www.qusecure.com/brief-glance-doug-small-federal-advisory-board/", "title": "QuSecure Featured in Brief Glance: Doug Small's Mission to Secure America's Data", "summary": "Brief Glance covers retired Rear Admiral Doug Small joining the Federal Advisory Board, and his record in Navy information warfare.", "content_html": "Brief Glance recently featured retired U.S. Navy Rear Admiral Doug Small’s appointment to QuSecure’s Federal Advisory Board, highlighting his leadership in information warfare. His new mission to help strengthen America’s quantum cybersecurity posture. The article underscores the growing urgency for federal agencies to modernize cryptography as quantum computing capabilities continue to advance.
\nAdmiral Small’s decades of experience in defense technology and cybersecurity will help support organizations transitioning to post-quantum cryptography. Achieving quantum readiness requires crypto agility, a comprehensive cryptographic inventory, and deployment of NIST PQC algorithms that align with evolving NIST PQC standards. These capabilities help strengthen post quantum cybersecurity across government and critical infrastructure.
\nAs agencies move from planning to implementation, experienced leaders like Admiral Small bring valuable operational expertise to help modernize cryptographic infrastructure and prepare mission-critical systems for the quantum era.
", "date_published": "2026-07-07T21:36:35Z", "authors": [ { "name": "Trina Mabunay" } ], "tags": [ "Media Coverage" ], "image": "https://www.qusecure.com/og/brief-glance-doug-small-federal-advisory-board.jpg" }, { "id": "https://www.qusecure.com/securityinfowatch-doug-small-federal-advisory-board/", "url": "https://www.qusecure.com/securityinfowatch-doug-small-federal-advisory-board/", "title": "QuSecure Featured in SecurityInfoWatch: Doug Small Joins Federal Advisory Board", "summary": "SecurityInfoWatch on Doug Small joining the Federal Advisory Board as agencies move from planning to implementation on post-quantum work.", "content_html": "SecurityInfoWatch recently highlighted the appointment of retired U.S. Navy Rear Admiral Doug Small to QuSecure’s Federal Advisory Board. The article notes that Small joins QuSecure as federal agencies transition from planning to implementation of post-quantum cryptography initiatives. Driven by recent federal directives and national security priorities.
\nWith more than 35 years of leadership in information warfare, cybersecurity, and defense modernization. Admiral Small brings operational expertise to support government organizations implementing post-quantum cryptography. Building crypto agility, maintaining a comprehensive cryptographic inventory, and deploying NIST PQC algorithms aligned with evolving NIST PQC standards are essential for strengthening post quantum cybersecurity across federal and defense environments.
\nAs agencies accelerate quantum security migration, experienced leaders like Admiral Small provide strategic guidance to help modernize cryptographic infrastructure while maintaining operational continuity across mission-critical government systems.
", "date_published": "2026-07-07T21:19:46Z", "authors": [ { "name": "Trina Mabunay" } ], "tags": [ "Media Coverage" ], "image": "https://www.qusecure.com/og/securityinfowatch-doug-small-federal-advisory-board.jpg" }, { "id": "https://www.qusecure.com/quantum-zeitgeist-doug-small-federal-advisory-board/", "url": "https://www.qusecure.com/quantum-zeitgeist-doug-small-federal-advisory-board/", "title": "QuSecure Featured in Quantum Zeitgeist: Navy Systems Chief Joins Federal Advisory Board", "summary": "Quantum Zeitgeist on the retired Navy systems chief joining the Federal Advisory Board as agencies accelerate post-quantum initiatives.", "content_html": "Quantum Zeitgeist recently highlighted the appointment of retired U.S. Navy Rear Admiral Doug Small to QuSecure’s Federal Advisory Board. The article notes that Small joins QuSecure as federal agencies accelerate post-quantum cryptography initiatives. In response to evolving national security requirements and government mandates.
\nWith more than 35 years of leadership in information warfare and defense modernization, Admiral Small brings valuable operational expertise to support government organizations implementing post-quantum cryptography. Building crypto agility, maintaining a comprehensive cryptographic inventory, and deploying NIST PQC algorithms aligned with evolving NIST PQC standards are critical to strengthening post quantum cybersecurity across federal and defense environments.
\nAs agencies move from planning to execution, experienced leaders like Admiral Small help bridge operational expertise with emerging cybersecurity technologies. His leadership supports the successful adoption of quantum-ready security across mission-critical government systems.
", "date_published": "2026-07-07T18:41:34Z", "authors": [ { "name": "Trina Mabunay" } ], "tags": [ "Media Coverage" ], "image": "https://www.qusecure.com/og/quantum-zeitgeist-doug-small-federal-advisory-board.jpg" }, { "id": "https://www.qusecure.com/doug-small-qusecure-federal-advisory-board/", "url": "https://www.qusecure.com/doug-small-qusecure-federal-advisory-board/", "title": "U.S. Navy Rear Admiral Doug Small Joins QuSecure Federal Advisory Board as Agencies Accelerate Quantum Security Migration Plans", "summary": "Retired Rear Admiral Doug Small joins the Federal Advisory Board as the Department of War's PQC Strategy mandates a department-wide shift.", "content_html": "Small Brings 35+ Years of U.S. Navy Information and Operational Leadership to QuSecure as Agencies Enter Critical Time to Meet Executive Order and Department of War Post-Quantum Security Mandates
\nSAN MATEO, Calif. — July 7, 2026 — QuSecure™, Inc., a leader in post-quantum cryptography (PQC) and cryptographic agility, today announced that U.S. Navy Rear Admiral Doug Small has joined its Federal Advisory Board (FAB).
\nAdmiral Small (Ret.) joins QuSecure as federal agencies move from planning to execution on PQC migration initiatives, in part driven by official directives. Last month, the U.S. Department of War (DoW) released the DoW Post-Quantum Cryptography Strategy, which mandates a department-wide shift to secure communications, data, and command and control systems against emerging quantum computing threats. The effort came on the heels of the President’s Executive Order 14409, “Securing the Nation Against Advanced Cryptographic Attacks,” fueling the national post-quantum security movement.
\nAdmiral Small most recently served as the Commander of the Naval Information Warfare Systems Command (NAVWAR), where he exercised executive leadership over a $6B annual budget and a global workforce of 11,000 professionals. Throughout his 35+-year career in the U.S. Navy, Admiral Small led some of the military’s most complex technical and operational information systems initiatives. From 2020 to 2024, he served as the first Direct Reporting Program Manager for Project Overmatch, a highest-priority effort to complete a generational update to the Navy’s operational architecture, delivering across all domains.
\n“Doug is an executive leader with a proven track record of driving large-scale innovation and disruptive acquisition strategies within the Department of Defense,” said Brian Cunningham, EVP Strategy & Growth, QuSecure. “He has deep expertise in high-tech systems development and production, cybersecurity leadership, and helping federal agencies navigate the national security landscape. He will be a tremendous resource as we meet growing demand from agencies looking to meet post-quantum requirements and cryptographic agility with operational continuity.”
\nPrior to NAVWAR, Admiral Small served as the Program Executive Officer for Integrated Warfare Systems (PEO IWS), where he was accountable for the development, delivery, and sustainment of all surface navy sensor, combat, and weapon systems. His expertise in “disruptive acquisition” allowed him to partner across military branches to deliver the first-ever virtualized combat systems and integrated missile launch platforms. He has also chaired NATO and bilateral cooperative programs, and developed strategies that synchronized defense efforts among global allies. He holds a Ph.D. in Physics from the Naval Postgraduate School, as well as a Bachelor of Science in Physics from Marquette University.
\n“Our competitors are unrelenting in their efforts to acquire our secrets, and they’re becoming armed with AI-enabled tools and soon quantum computing,” said Small. “It is more important than ever that we bring real agility and post-quantum security for our nation’s information protection.”
\nThe QuSecure Federal Advisory Board (FAB) is a distinguished group of former senior military, intelligence, and government officials established to guide QuSecure’s work with U.S. Government agencies.
", "date_published": "2026-07-07T12:00:21Z", "authors": [ { "name": "Trina Mabunay" } ], "tags": [ "Press Releases" ], "image": "https://www.qusecure.com/og/doug-small-qusecure-federal-advisory-board.jpg" }, { "id": "https://www.qusecure.com/channel-insider-pqc-quantum-readiness/", "url": "https://www.qusecure.com/channel-insider-pqc-quantum-readiness/", "title": "QuSecure Featured in Channel Insider: PQC and Quantum Readiness in the Channel", "summary": "Channel Insider on how partners are preparing customers for post-quantum migration, and the opportunity in modernizing cryptographic infrastructure.", "content_html": "Channel Insider recently explored how channel partners are preparing customers for the transition to post-quantum cryptography. As government mandates, industry standards, and customer demand continue to accelerate. The article highlights the growing opportunity for solution providers to help organizations modernize their cryptographic infrastructure before quantum threats become operational.
\nThe article emphasizes that successful migration starts with post-quantum cryptography, supported by crypto agility and a complete cryptographic inventory. Deploying NIST PQC algorithms and aligning with evolving NIST PQC standards can help organizations strengthen post quantum cybersecurity. While reducing migration complexity across legacy and modern environments.
\nFor channel partners, the transition to quantum-safe security is an opportunity to deliver long-term value through cryptographic discovery, migration planning, and ongoing crypto-agility. Organizations that begin preparing today will be better positioned to meet future compliance requirements and evolving cyber threats.
", "date_published": "2026-07-02T18:15:04Z", "authors": [ { "name": "Trina Mabunay" } ], "tags": [ "Media Coverage" ], "image": "https://www.qusecure.com/og/channel-insider-pqc-quantum-readiness.jpg" }, { "id": "https://www.qusecure.com/network-world-federal-pqc-timeline/", "url": "https://www.qusecure.com/network-world-federal-pqc-timeline/", "title": "QuSecure Featured in Network World: Aggressive Federal PQC Timeline Prompts Enterprise Action", "summary": "Network World on accelerated federal deadlines, with Garfield Jones on the practical challenges of modernizing cryptographic infrastructure.", "content_html": "Network World recently examined how accelerated federal timelines for post-quantum encryption are raising the urgency for enterprises to begin planning their own migrations. The article highlights new government requirements, Gartner guidance, and insights from QuSecure’s Dr. Garfield Jones on the challenges organizations face as they modernize cryptographic infrastructure.
\nThe article explains that organizations should not wait for compliance deadlines to begin implementing post-quantum cryptography. Building crypto agility, maintaining a comprehensive cryptographic inventory, and adopting NIST PQC algorithms are critical steps toward a successful migration. Aligning with emerging NIST PQC standards can help organizations strengthen post quantum cybersecurity. While reducing migration risk across legacy and modern environments. Dr. Garfield Jones also notes that organizations should account for operational technology and legacy systems as part of their long-term migration strategy.
\nAs federal requirements continue to evolve, enterprises that begin cryptographic modernization today will be better positioned. To not only meet customer expectations and regulatory requirements but also, future security challenges.
", "date_published": "2026-06-27T18:53:30Z", "authors": [ { "name": "Trina Mabunay" } ], "tags": [ "Media Coverage" ], "image": "https://www.qusecure.com/og/network-world-federal-pqc-timeline.jpg" }, { "id": "https://www.qusecure.com/pqc-migration-executive-orders/", "url": "https://www.qusecure.com/pqc-migration-executive-orders/", "title": "New Executive Orders Set Federal Deadlines for Post-Quantum Cryptography Migration", "summary": "Two executive orders signed on 22 June 2026 set federal PQC deadlines from 30 days to 2031, and put contractors and allies on the clock too.", "content_html": "On June 22, 2026, President Trump signed two Executive Orders that officially launch the federal government’s next phase of post-quantum cryptography (PQC) migration while accelerating U.S. quantum technology development. The orders establish new deadlines for federal agencies, signal upcoming requirements for contractors, and reinforce the importance of cryptographic inventory, crypto-agility, and NIST-approved PQC standards.
\nOn June 22, 2026, President Trump signed two Executive Orders that, taken together, draw the clearest line yet between where the United States wants quantum technology to go and how it intends to defend against the risks that come with it:
\nThe first: “Securing the Nation Against Advanced Cryptographic Attacks” sets hard deadlines for the federal government’s migration to post-quantum cryptography (PQC) and reaches beyond federal agencies to contractors and critical infrastructure operators.
\nThe second: “Ushering in the Next Frontier of Quantum Innovation” which open with the line that America “stands at the cusp of a quantum revolution.” is an industrial-strategy order aimed at building a powerful quantum computer, deploying quantum sensors and networks, and securing the supply chains and workforce behind them.
\nFor years, the case for post-quantum cryptography rested on a forecast: a sufficiently powerful quantum computer would one day break the public-key encryption (e.g. RSA and ECC) that protects nearly all digital communication. What changed on June 22 is that the forecast became federal policy with deadlines attached.
\nThe cryptographic-attacks order states the threat plainly in its opening section: the arrival of large-scale quantum computers, especially in adversary hands, “will pose a significant threat to widely used cryptographic security systems,” and ongoing cyber activity “presents the risk of adversaries collecting United States information now, and decrypting it later once large-scale quantum computers are operational.”
\nTaken together, these Executive Orders recognize that advancing quantum computing and defending against its security implications are now inseparable national priorities. One order accelerates quantum innovation; the other accelerates the operational readiness required to protect critical systems in the quantum era. This guide reviews each order and translates it into actionable insights.
\nThis is the order that should be open on the desk of every CISO, head of PKI, and compliance lead.
\nThe order makes PQC migration official U.S. policy, committing the government to “responsibly and effectively executing the transition of Federal information systems to National Institute of Standards and Technology (NIST)-approved Federal Information Processing Standards (FIPS) for Post-Quantum Cryptography (PQC), and to assist critical infrastructure owners and operators with their transitions.”
\nTwo offices are put in charge of coordination: the Director of United States Office of Management and Budget (OMB) and the National Cyber Director are directed to “lead the strategic coordination and oversight of the national PQC migration policy and strategy.” NIST, NSA, and CISA are tasked with giving agencies ongoing technical guidance. This is no longer a recommendation from a standards body. It is a top-down program with named owners.
\nJust as importantly, the order shifts the conversation from awareness to execution. Organizations are no longer being asked whether they should prepare for post-quantum cryptography, they are being directed to establish ownership, inventory cryptographic assets, and execute a migration strategy against defined milestones.
\nThe heart of the order is in Section 4. Within 90 days, OMB must issue guidance requiring every agency to review its inventory of high value assets (HVAs) and high impact systems, and then:
\n“transition all HVAs and high impact systems to use PQC for key establishment by December 31, 2030”
\n“transition all HVAs and high impact systems to use PQC for digital signatures by December 31, 2031”
\nNotice what comes before the migration deadlines: assigning ownership and understanding the current environment. The order recognizes that organizations face challenges migrating cryptography they have not yet identified.
\nThere is also a near-term action that is easy to miss: within just 30 days of the order, every agency head must “identify its PQC migration lead”; a named individual reporting to the CIO who owns cryptographic inventory, the migration plan, and cross-agency coordination.
\nThe order also directs NIST to start a pilot within 180 days and to “initiate a pilot project for PQC migration on an appropriate subset of information systems owned or operated by NIST, to be completed no later than December 31, 2027.” Before the government-wide deadlines hit, NIST is meant to migrate a slice of its own systems and show the rest of government how it’s done. Watch this pilot: it will become the de facto playbook, and the lessons from it will shape what auditors and procurement officers expect everyone else to do.
\nThe pilot is likely to influence more than technical implementation. It will also shape expectations for how agencies inventory cryptography, prioritize migrations, measure progress, and ultimately demonstrate readiness.
\nThis is the part with the widest blast radius. The order directs the Federal Acquisition Regulatory Council to publish a proposed rule requiring “covered contractors to comply by December 31, 2030, with NIST’s FIPS, including all applicable FIPS incorporating PQC compliant algorithms.”
\nA second rule, due within 270 days, would require contractor vulnerability disclosure programs to include “reports of cryptographic vulnerabilities, including testing for lack of encryption and the use of non-FIPS approved algorithms.”
\nIn simple terms, this means that if you sell to the federal government, post-quantum readiness is becoming a contractual requirement, not a nice-to-have. By the end of 2030, non-FIPS, non-PQC cryptography in your products could put you out of compliance, and the vulnerability-disclosure rule means you’ll be expected to actively detect and report weak or missing encryption.
\nFor many organizations, the practical challenge extends well beyond selecting a PQC algorithm. Understanding where cryptography is used, coordinating migration across teams, and adapting existing environments will likely prove to be the larger effort.
\nAgencies that act as Sector Risk Management Agencies must work with CISA to help critical infrastructure operators build PQC migration plans. The State Department is directed to engage foreign governments and industry groups to “encourage their transition to PQC algorithms standardized by NIST.” And within 270 days, CISA and NIST must release public guidance on the minimum elements of a cryptographic bill of materials (CBOM): a machine-readable inventory designed to “enable the automated assessment of the cryptographic assets utilized by a hardware or software element.” The inclusion of a CBOM reinforces a broader shift. Cryptography is becoming an operational asset that organizations will be expected to understand, manage, and update over time.
\nThe second order is less about defense and more about offense: building American leadership in quantum computing, sensing, and networking. It is sprawling, but a few pieces matter most for anyone tracking the security implications.
\nThe order establishes the “Quantum Computer for Application Development and Discovery Science (QC-ADDS) Effort,” a national push to develop a quantum computer “at a scale intended to initiate the era of quantum-enabled scientific discovery,” with the goal of delivering at least one such machine to a Department of Energy facility.
\nThe innovation order also directs the Department of War to identify at least three next-generation quantum sensor projects to field by September 30, 2028; tasks multiple agencies with five-year plans for quantum sensing and networking; orders a strategy to strengthen domestic quantum supply chains; and calls for a government-wide quantum workforce recruitment and retention strategy, plus a network of National QIST Workforce Development Institutes.
\nOn the security side, it expands the Quantum Information Science and Technology Counterintelligence Protection Team to guard the quantum ecosystem against “adversarial threats to the QIST ecosystem, including cybersecurity threats.”
\nCrucially, the order also directs the intelligence community and the Department of War to identify the national security implications of more powerful commercial quantum computers, “such as the implications for the migration to post-quantum cryptography.”
\nThis means that the same document that propels the race toward a more capable quantum computer also explicitly names cryptographic migration as one of the risks that it will create. Essentially, the government is acknowledging, in writing, that building quantum capability and defending against it are two halves of one strategy.
\nPerhaps the most important takeaway is that these two Executive Orders are not in tension with one another, they are complementary. One is designed to accelerate quantum capability. The other recognizes that advancing quantum capability also requires a corresponding evolution in how cryptography is managed and modernized.
\nThe clock has already started. Your near-term task is naming a PQC migration lead and beginning the cryptographic inventory of your high value assets and high impact systems. Your fixed deadlines are PQC for key establishment by the end of 2030 and for digital signatures by the end of 2031. Watch the NIST pilot due in 2027. It will set expectations for everyone else.
\nPQC is becoming a condition of doing business. Plan for a Federal Acquisition Regulation (FAR) requirement to meet NIST FIPS, including PQC algorithms, by the end of 2030, and for a vulnerability-disclosure obligation that specifically covers weak or missing encryption. The practical first step is the same as the government’s: find out where cryptography lives in your products and where you’re relying on outdated algorithms.
\nYou are explicitly named as someone the government intends to assist through Sector Risk Management Agencies and CISA. You aren’t under the federal deadlines directly, but the direction of travel is unmistakable, and the forthcoming cryptographic bill of materials guidance will likely become the reference standard for demonstrating you know what cryptography you’re running.
\nThere may be no statutory deadline, but you have every signal you need. When the U.S. government commits its own systems, its contractors, and its diplomatic weight to NIST PQC standards by 2030/2031, those standards become the baseline your customers, partners, insurers, and regulators will eventually expect.
\nAlthough each audience faces different timelines and responsibilities, a common theme runs through both Executive Orders: organizations are expected to treat cryptography as something that must be actively managed over time, not simply deployed and forgotten. That expectation extends well beyond any single migration effort.
\nAcross both orders, the same requirement keeps surfacing: know your cryptography. The cryptographic-attacks order requires agencies to review their inventories before migrating, assigns a migration lead to own that inventory, and directs the creation of a cryptographic bill of materials standard for automated assessment. Every deadline in the order assumes you already know where your vulnerable algorithms are.
\nHowever, most don’t. Even if they think they do. Cryptography is buried across applications, certificates, APIs, VPNs, cloud infrastructure, routers, endpoints, operational technology, and PKI. It is rarely centralized, often managed by different teams, and difficult to inventory or govern. It is impossible to confirm you will meet the 2030 deadline for migration without the current-state visibility that makes a migration strategy possible.
\nThis is also why cryptographic agility (the ability to quickly swap in and out cryptography without re-architecting underlying applications) matters more than any single algorithm swap. PQC migration will not be the last cryptographic transition. Standards will keep evolving, and organizations that can discover, manage, and update their cryptography without rip-and-replace projects will absorb deadlines like these as routine, not as emergencies.
\nThis is where technology decisions become important. The organizations best positioned for this transition will be those that can gain visibility into their cryptographic environments, modernize without unnecessary disruption, and remain adaptable as standards continue to evolve.
\nQuSecure built QuProtect R3 for exactly the gap these orders expose: helping government, defense, and enterprise organizations modernize cryptography without massive rip-and-replace programs. It wraps around your existing infrastructure and delivers an automated, continuous inventory of cryptographic assets across the network: the visibility that every deadline in the cryptographic-attacks order quietly depends on, and the foundation for a cryptographic bill of materials. It also provides orchestrated crypto-agility, letting organizations transition to NIST-approved PQC and update algorithms by policy without code changes or downtime, and allows users to download an up-to-date cryptographic bill of materials (CBOM) at the click of a button for when auditors and contracting officers start asking for proof of PQC readiness. QuSecure already supports NIST-aligned PQC, hybrid migration, centralized governance, and deployment across cloud, on-premises, air-gapped, and tactical environments, with established adoption across federal and defense programs.
\nThe two Executive Orders signed on June 22, 2026 made one thing clear: the post-quantum transition is no longer a question of if or even when. The dates are on the calendar. The organizations that start now and use next gen solutions like QuProtect R3 for cryptographic agility, will meet them without disruption and allow them to respond quickly to any new requirements going forward, saving significant time and resources. The ones that wait or stick with the traditional approach of managing cryptography at the infrastructure-level, will struggle to meet these deadlines both now and in the future.
", "date_published": "2026-06-26T23:09:17Z", "authors": [ { "name": "Meg Gleason" } ], "tags": [ "Critical Infrastructure", "Insights", "News", "Public Sector" ], "image": "https://www.qusecure.com/og/pqc-migration-executive-orders.jpg" }, { "id": "https://www.qusecure.com/dark-reading-2030-quantum-deadline/", "url": "https://www.qusecure.com/dark-reading-2030-quantum-deadline/", "title": "QuSecure Featured in Dark Reading: Meeting the 2030 Quantum Deadline", "summary": "Dark Reading on the cost and technical hurdles behind the US government's 2030 deadline for moving to quantum-resistant cryptography.", "content_html": "Dark Reading recently explored the challenges organizations face in meeting the U.S. government’s 2030 deadline for transitioning to quantum-resistant cryptography. While the availability of standards provides a clear path forward, many enterprises continue to face significant cost, operational, and technical hurdles as they modernize legacy environments.
\nThe article highlights that a successful transition requires more than replacing encryption algorithms. Organizations need a comprehensive cryptographic inventory, the flexibility provided by crypto agility, and a phased strategy for deploying post-quantum cryptography. Aligning with NIST PQC standards and implementing NIST PQC algorithms can help reduce migration risk while strengthening long-term cyber resilience.
\nOrganizations that begin planning today will be better positioned to meet future compliance requirements and protect critical data from emerging quantum threats. Building a roadmap for PQC adoption can simplify migration while improving overall post quantum cybersecurity readiness.
", "date_published": "2026-06-26T21:55:54Z", "authors": [ { "name": "Trina Mabunay" } ], "tags": [ "Media Coverage" ], "image": "https://www.qusecure.com/og/dark-reading-2030-quantum-deadline.jpg" }, { "id": "https://www.qusecure.com/it-brew-quantum-computing-public/", "url": "https://www.qusecure.com/it-brew-quantum-computing-public/", "title": "QuSecure Featured in IT Brew: How Soon Will Quantum Computing Reach the Public?", "summary": "IT Brew asks how soon quantum computing reaches the public, with Garfield Jones on what happens if decryption outpaces defensive adoption.", "content_html": "IT Brew recently explored how quickly quantum computing could become publicly accessible and what that means for cybersecurity. The article examines the rapid pace of quantum innovation and includes insights from QuSecure’s Dr. Garfield Jones, who warns that the consequences could be significant if quantum decryption capabilities outpace organizations’ adoption of quantum-resistant security.
\nAs quantum computing continues to advance, organizations should begin implementing post-quantum cryptography today rather than waiting for a future breakthrough. Building crypto agility, maintaining a comprehensive cryptographic inventory, and deploying NIST PQC algorithms aligned with evolving NIST PQC standards are essential steps toward strengthening post quantum cybersecurity. Organizations that begin preparing now will be better positioned to protect sensitive data from future quantum-enabled threats.
\nQuantum computing is progressing from research to practical application. As Dr. Garfield Jones notes, organizations cannot afford to wait until quantum computers become widely available before modernizing their cryptography. Early preparation is key to reducing long-term cyber risk.
", "date_published": "2026-06-25T17:30:55Z", "authors": [ { "name": "Trina Mabunay" } ], "tags": [ "Media Coverage" ], "image": "https://www.qusecure.com/og/it-brew-quantum-computing-public.jpg" }, { "id": "https://www.qusecure.com/federal-news-network-white-house-pqc-order/", "url": "https://www.qusecure.com/federal-news-network-white-house-pqc-order/", "title": "QuSecure Featured in Federal News Network: White House PQC Order Accelerates Federal Transition", "summary": "Federal News Network on the White House executive order, with Garfield Jones on the responsibility it puts directly on agency leaders.", "content_html": "Federal News Network recently examined how the White House’s new executive order is accelerating the federal transition to post-quantum cryptography. The article explains that the order establishes aggressive deadlines and shifts agencies from planning to executing their quantum security strategies.
\nThe article features insights from Dr. Garfield Jones, Executive Vice President of Strategy & Research at QuSecure, who notes that the executive order places immediate responsibility on agency leaders to begin implementation. Success will require organizations to adopt post-quantum cryptography, establish crypto agility, and build a comprehensive cryptographic inventory. Organizations should also begin deploying NIST PQC algorithms and align with emerging NIST PQC standards to strengthen long-term post quantum cybersecurity.
\nThe executive order reinforces that agencies, contractors, and critical infrastructure organizations should begin migration efforts now. Early planning and cryptographic modernization will help reduce migration risk while improving long-term cyber resilience.
", "date_published": "2026-06-24T02:46:56Z", "authors": [ { "name": "Trina Mabunay" } ], "tags": [ "Media Coverage" ], "image": "https://www.qusecure.com/og/federal-news-network-white-house-pqc-order.jpg" }, { "id": "https://www.qusecure.com/meritalk-quantum-executive-orders/", "url": "https://www.qusecure.com/meritalk-quantum-executive-orders/", "title": "QuSecure Featured in MeriTalk: Quantum Executive Orders Send Clear Signals", "summary": "MeriTalk on two executive orders setting clear expectations for agencies and contractors on the move to quantum-resistant cryptography.", "content_html": "MeriTalk recently examined the impact of two executive orders designed to accelerate U.S. quantum computing leadership and strengthen federal cybersecurity. Industry experts explain that the directives provide agencies and contractors with clear expectations for advancing quantum readiness and accelerating the transition to quantum-resistant cryptography.
\nThe article highlights that organizations should move from planning to execution. By implementing post-quantum cryptography, establishing crypto agility, and developing a comprehensive cryptographic inventory. As federal requirements continue to evolve, adopting NIST PQC algorithms and aligning with NIST PQC standards will help organizations prepare for long-term quantum resilience.
\nThe executive orders reinforce the importance of proactive planning for agencies, contractors, and critical infrastructure organizations. Building a roadmap for PQC adoption can reduce migration risk while strengthening overall post quantum cybersecurity readiness.
", "date_published": "2026-06-23T22:19:09Z", "authors": [ { "name": "Trina Mabunay" } ], "tags": [ "Media Coverage" ], "image": "https://www.qusecure.com/og/meritalk-quantum-executive-orders.jpg" }, { "id": "https://www.qusecure.com/pymnts-quantum-executive-orders/", "url": "https://www.qusecure.com/pymnts-quantum-executive-orders/", "title": "QuSecure Featured in PYMNTS: White House Accelerates Quantum Computing Transition", "summary": "PYMNTS on the pair of executive orders setting aggressive timelines for quantum capability and quantum-resistant encryption in government.", "content_html": "PYMNTS recently reported on the White House’s pair of executive orders designed to accelerate U.S. quantum computing innovation and speed the federal transition to quantum-resistant cybersecurity. The orders establish more aggressive timelines for developing practical quantum computing capabilities and deploying quantum-resistant encryption across government systems.
\nThe article highlights that organizations should begin preparing now for the transition to post-quantum cryptography. A successful migration requires crypto agility, a comprehensive cryptographic inventory, and deployment of NIST PQC algorithms. Aligning with emerging NIST PQC standards can help agencies, contractors, and enterprises strengthen post quantum cybersecurity while reducing migration risk.
\nThe executive orders reinforce that quantum readiness is now an operational priority for both government and industry. Organizations that begin cryptographic modernization today will be better positioned to meet future compliance requirements and protect sensitive data against emerging quantum threats.
", "date_published": "2026-06-23T17:50:44Z", "authors": [ { "name": "Trina Mabunay" } ], "tags": [ "Media Coverage" ], "image": "https://www.qusecure.com/og/pymnts-quantum-executive-orders.jpg" }, { "id": "https://www.qusecure.com/the-quantum-insider-quantum-executive-order/", "url": "https://www.qusecure.com/the-quantum-insider-quantum-executive-order/", "title": "QuSecure Featured in The Quantum Insider: Industry Responds to New Quantum Executive Order", "summary": "The Quantum Insider gathers industry reaction to the quantum executive order, with Rebecca Krauthamer on what it now expects of organizations.", "content_html": "The Quantum Insider recently examined industry reaction to the Trump Administration’s new executive order advancing U.S. quantum innovation and post-quantum cybersecurity. The article features perspectives from quantum industry leaders, including QuSecure Co-Founder and CEO Rebecca Krauthamer, on how the order accelerates both quantum technology development and the transition to quantum-resistant security.
\nKrauthamer explains that the executive order establishes clear expectations for organizations to begin preparing now. Successfully navigating the transition requires implementing post-quantum cryptography, establishing crypto agility, and building a comprehensive cryptographic inventory. Organizations should also begin deploying NIST PQC algorithms and align with emerging NIST PQC standards to strengthen long-term post quantum cybersecurity and reduce migration risk.
\nThe executive order reinforces that agencies, contractors, and enterprises should begin quantum readiness efforts today. Early planning and cryptographic modernization will help organizations meet evolving federal requirements while improving long-term cyber resilience.
", "date_published": "2026-06-23T16:48:06Z", "authors": [ { "name": "Trina Mabunay" } ], "tags": [ "Media Coverage" ], "image": "https://www.qusecure.com/og/the-quantum-insider-quantum-executive-order.jpg" }, { "id": "https://www.qusecure.com/quantum-zeitgeist-eman-blair-federal-advisory-board/", "url": "https://www.qusecure.com/quantum-zeitgeist-eman-blair-federal-advisory-board/", "title": "QuSecure Featured in Quantum Zeitgeist: Eman Blair Joins Federal Advisory Board", "summary": "Quantum Zeitgeist on Eman Blair joining the Federal Advisory Board, with a record in cloud modernization across the intelligence community.", "content_html": "Quantum Zeitgeist recently highlighted the appointment of former CIA Senior Intelligence Service Officer Eman Blair to QuSecure’s Federal Advisory Board. Blair joins QuSecure as federal agencies accelerate efforts to strengthen quantum security and modernize cryptographic infrastructure in response to evolving cybersecurity requirements.
\nThe article highlights Blair’s extensive experience leading cybersecurity, digital innovation, cloud modernization, and technology strategy across the intelligence community. Additionally, her expertise will help support organizations as they implement post-quantum cryptography, establish crypto agility. Overall, preparing for long-term quantum resilience.
\nAs agencies and contractors advance their quantum security initiatives, organizations should build a comprehensive cryptographic inventory, begin deploying NIST PQC algorithms, and align with emerging NIST PQC standards. These foundational steps help strengthen post quantum cybersecurity and support a successful transition to quantum-resistant security.
", "date_published": "2026-06-19T21:32:44Z", "authors": [ { "name": "Trina Mabunay" } ], "tags": [ "Media Coverage" ], "image": "https://www.qusecure.com/og/quantum-zeitgeist-eman-blair-federal-advisory-board.jpg" }, { "id": "https://www.qusecure.com/govconwire-eman-blair-federal-advisory-board/", "url": "https://www.qusecure.com/govconwire-eman-blair-federal-advisory-board/", "title": "QuSecure Featured in GovCon Wire: Eman Blair Joins Federal Advisory Board", "summary": "GovCon Wire on Eman Blair joining the Federal Advisory Board, with two decades in cybersecurity modernization across the intelligence community.", "content_html": "GovCon Wire recently highlighted the appointment of former CIA Senior Intelligence Service Officer Eman Blair to QuSecure’s Federal Advisory Board. Blair joins QuSecure as federal agencies accelerate the transition to quantum-resistant cybersecurity and move from planning to execution on post-quantum cryptography initiatives.
\nBlair brings more than 20 years of leadership in cybersecurity modernization, cloud transformation, and digital innovation across the intelligence community. Her expertise will help support federal agencies and contractors as they implement post-quantum cryptography, modernize cryptographic infrastructure, and prepare for long-term quantum resilience.
\nAs agencies advance their quantum security initiatives, organizations should establish crypto agility. Maintaining a comprehensive cryptographic inventory, and adopting NIST PQC algorithms are essential steps. Aligning with emerging NIST PQC standards helps organizations strengthen long-term post quantum cybersecurity resilience.
", "date_published": "2026-06-19T17:23:51Z", "authors": [ { "name": "Trina Mabunay" } ], "tags": [ "Media Coverage" ], "image": "https://www.qusecure.com/og/govconwire-eman-blair-federal-advisory-board.jpg" }, { "id": "https://www.qusecure.com/the-quantum-insider-eman-blair-federal-advisory-board/", "url": "https://www.qusecure.com/the-quantum-insider-eman-blair-federal-advisory-board/", "title": "QuSecure Featured in The Quantum Insider: Former CIA Executive Eman Blair Joins Federal Advisory Board", "summary": "The Quantum Insider on Eman Blair joining the Federal Advisory Board, with two decades across cybersecurity and cloud modernization.", "content_html": "The Quantum Insider recently highlighted the appointment of former CIA Senior Intelligence Service Officer Eman Blair to QuSecure’s Federal Advisory Board. Blair joins QuSecure as federal agencies accelerate efforts to strengthen quantum security. As well as, modernize cryptographic infrastructure in preparation for the quantum era.
\nThe article highlights Blair’s more than 20 years of leadership in cybersecurity, digital innovation, cloud modernization, and technology strategy across the intelligence community. Her expertise will help support organizations implementing post-quantum cryptograph y, establishing crypto agility, and preparing for long-term quantum resilience.
\nAs agencies and contractors accelerate quantum security initiatives, organizations should build a comprehensive cryptographic inventory. Then, begin deploying NIST PQC algorithms, and align with emerging NIST PQC standards. These foundational steps help strengthen post quantum cybersecurity and support a successful transition to quantum-resistant security.
", "date_published": "2026-06-18T22:45:51Z", "authors": [ { "name": "Trina Mabunay" } ], "tags": [ "Media Coverage" ], "image": "https://www.qusecure.com/og/the-quantum-insider-eman-blair-federal-advisory-board.jpg" }, { "id": "https://www.qusecure.com/citybiz-eman-blair-federal-advisory-board/", "url": "https://www.qusecure.com/citybiz-eman-blair-federal-advisory-board/", "title": "QuSecure Featured in Citybiz: Eman Blair Joins Federal Advisory Board", "summary": "Citybiz on former CIA Senior Intelligence Service Officer Eman Blair joining the Federal Advisory Board after two decades in the intelligence community.", "content_html": "Citybiz recently highlighted QuSecure’s appointment of former CIA Senior Intelligence Service Officer Eman Blair to its Federal Advisory Board. Blair joins QuSecure as federal agencies move from planning to execution on post-quantum security initiatives. Driven by federal directives and standardized quantum-resistant algorithms.
\nBlair brings more than two decades of experience leading cybersecurity, cloud modernization, data strategy, and digital transformation across the intelligence community. Her expertise will help support QuSecure’s work with federal agencies as they identify vulnerable cryptography, modernize security infrastructure, and prepare for the transition to post-quantum cryptography.
\nAs agencies accelerate implementation of quantum security initiatives, organizations should establish crypto agility. Build a comprehensive cryptographic inventory, and prepare to deploy NIST PQC algorithms. Aligning with emerging NIST PQC standards can help agencies and contractors strengthen long-term cyber resilience.
", "date_published": "2026-06-18T19:03:09Z", "authors": [ { "name": "Trina Mabunay" } ], "tags": [ "Media Coverage" ], "image": "https://www.qusecure.com/og/citybiz-eman-blair-federal-advisory-board.jpg" }, { "id": "https://www.qusecure.com/eman-blair-joins-qusecure-federal-advisory-board/", "url": "https://www.qusecure.com/eman-blair-joins-qusecure-federal-advisory-board/", "title": "Former CIA Chief Digital and Innovation Officer Eman Blair Joins QuSecure Federal Advisory Board as Federal Agencies Accelerate Quantum Security Plans", "summary": "Former CIA Senior Intelligence Service Officer Eman Blair joins the Federal Advisory Board as CNSA 2.0 sets quantum readiness for 2027.", "content_html": "Blair Brings 20+ Years of Intelligence Community Leadership to QuSecure as Federal Agencies Enter a Critical Phase of Post-Quantum Cryptography Migration
\nSAN MATEO, Calif. — June 18, 2026 — QuSecure™, Inc., a leader in post-quantum cryptography (PQC) and cryptographic agility, today announced that Eman Blair, former CIA Senior Intelligence Service Officer, has joined its Federal Advisory Board.
\nBlair joins QuSecure as federal agencies move from planning to execution on PQC migration initiatives. Following NIST’s standardization of post-quantum algorithms and the implementation of federal directives, including CNSA 2.0 which mandates quantum readiness by 2027, federal agencies are increasingly focused on identifying vulnerable cryptography and modernizing cryptographic infrastructure for a quantum-secure future.
\nBlair retired from the Central Intelligence Agency (CIA) in 2023 after more than two decades of service, earning the Distinguished Career Intelligence Medal. She held senior executive roles spanning data, cyber, cloud adoption, digital innovation, and defense coordination, including titles of Chief Data Officer, Deputy Chief Information Officer, Chief of Digital Innovation for Europe and the Counterterrorism Mission Center, and Senior Representative of the CIA Director to the Department of Defense. She also served as Chief of Leadership Development at the CIA Leadership Academy; and holds graduate degrees from Durham University and the University of Maryland, and a bachelor’s degree from Kuwait University.
\n“Eman spent her career leading some of the most complex data, cyber, and technology modernization efforts in government,” said Brian Cunningham, EVP Strategy & Growth, QuSecure. “As agencies implement post-quantum requirements, her experience managing mission-critical systems at scale provides valuable insight into how organizations can modernize cryptography while maintaining operational continuity.”
\n“During my career at the CIA, I watched the quantum threat move from theoretical to near-term,” said Blair, Former CIA Senior Executive. “The institutions I served and the systems I helped build are exactly what adversaries with quantum capabilities will target. QuSecure is focused on making post-quantum protection operational for the organizations that need it most. That is why I joined their Federal Advisory Board.”
", "date_published": "2026-06-18T12:00:29Z", "authors": [ { "name": "Trina Mabunay" } ], "tags": [ "Press Releases" ], "image": "https://www.qusecure.com/og/eman-blair-joins-qusecure-federal-advisory-board.jpg" }, { "id": "https://www.qusecure.com/crypto-agility-quantum-risk-board-level-priority/", "url": "https://www.qusecure.com/crypto-agility-quantum-risk-board-level-priority/", "title": "Beyond the Noise: Why Recent Quantum Advances Make Crypto-Agility a Board-Level Conversation", "summary": "Recent quantum advances do not break RSA tomorrow, but a 50 percent encoding rate from Harvard, MIT and QuEra changes the risk calculation today.", "content_html": "Recent quantum computing advances do not mean RSA and elliptic curve cryptography will break tomorrow. They do mean enterprise leaders should treat crypto-agility as a current risk-management priority, especially because harvest-now-decrypt-later attacks are already underway.
\nIf you follow cybersecurity news, the last few weeks have been busy. Google published a resource-estimate paper for attacking elliptic curve cryptography. Oratomic showed that Shor’s algorithm could theoretically run on as few as 10,000 qubits. Both stories got their share of headlines and LinkedIn coverage, usually from journalists doing their best with a topic that rewards specialization.
\nAnother preprint landed last month. A joint team from Harvard, MIT, and QuEra Computing published a preprint titled “Towards Ultra-High-Rate Quantum Error Correction with Reconfigurable Atom Arrays”. The key takeaway is one number that is worth paying attention to: 50 percent.
\nThat is the encoding rate the team demonstrated: one logical qubit, the kind you can actually compute with, for every two physical qubits in the system. The ratio that determines how big a quantum computer needs to be to break today’s encryption. The higher it climbs, the smaller (and closer) that machine becomes.
\nQuantum computing research is steadily reducing the estimated resources needed to threaten today’s public-key cryptography.
\nHarvest-now-decrypt-later attacks make the risk relevant before a capable quantum computer exists.
\nPQC compliance and crypto-agility are related but not the same.
\nCrypto-agility gives organizations the ability to adapt as standards, algorithms, and threats evolve.
\nQuantum computers are fragile. Their physical hardware makes errors constantly, so to do anything useful you have to bundle many physical (noisy) qubits together to form a single reliable logical (high quality) qubit. This bundling is quantum error correction, and it is the central engineering challenge of the field.
\nFor years the dominant approach has been surface codes, which are well understood, experimentally demonstrated, and the foundation of results like Google’s Willow chip. They are also expensive. Current surface-code implementations need roughly a hundred physical qubits to produce one logical qubit, an encoding rate of about one percent.
\nIn practical terms, that meant early estimates for attacking RSA-2048 with Shor’s algorithm called for something like a million physical qubits. That was the number that gave security teams cover to defer the post-quantum conversation indefinitely; a million qubits sounded like decades of engineering work away.
\nThen high-rate codes began to arrive. The Oratomic/Caltech paper from March 2026 demonstrated encoding rates of around thirty percent. Their projections brought the RSA-2048 qubit requirement down to roughly 13,000. One paper cut two zeros off the qubit requirement.
\nThe Harvard/MIT/QuEra team has now pushed that encoding rate past fifty percent: one logical qubit per two physical qubits.
\nThis is a quantum memory result, which means the team demonstrated that logical information can be stored with very low error rates at high encoding efficiency. Storing information and computing on it are related but distinct problems. The decoder has not yet been optimized for real-time hardware. Idling errors, atom loss, and correlated noise still need to be characterized. And the paper is a preprint, ahead of peer review. The authors themselves note that “further developments will be needed to establish all ingredients for full fault-tolerant computation.”
\nThey also make the case for why the result matters: “Memory is the foundation. If a quantum computer can’t hold information reliably, it can’t compute reliably either. The encoding efficiency demonstrated here directly determines how large that computer needs to be.”
\nAs it stands, fault-tolerant quantum computing has not been solved. One of its most fundamental requirements has, however, just become demonstrably closer to being met. The reason to pay attention is less about individual headlines and more the direction of travel across the whole field.
\nIt is worth being clear about what is and is not being claimed. The recent results are not machines; they are carefully scoped experimental and theoretical contributions, and it would be a mistake to read them as anything else.
\nIt’s important to note that quantum computing companies have commercial incentives to publish aggressive timelines. They are competing to build the first genuinely useful quantum computer, and their marketing reflects that competition. A reader who factors in that bias is reading correctly.
\nEven accounting for it, the peer-reviewed literature points consistently in one direction. In the early 2010s, resource estimates for attacking RSA-2048 ran into the hundreds of millions of physical qubits. In 2019, Gidney and Ekerå brought the estimate down to around twenty million. More recent surface-code analyses put the number under a million. Oratomic’s March 2026 architecture brought it to roughly 13,000 for RSA-2048 and 11,000 for 256-bit elliptic curve. And the new memory result, once extended to a full computing architecture, has the potential to compress those numbers further.
\nThis is more than a decade of papers chipping away at what looked like a generational engineering problem. The field has been narrowing the gap year by year, quietly enough that most outside it haven’t registered how far the line has moved.
\nThe trajectory above gets a predictable reaction: interesting, distant, not urgent. Here is the argument against that reaction, and it doesn’t depend on quantum physics at all.
\nPeople buy fire insurance not because they believe their house will catch fire next Tuesday, but because being wrong without it is catastrophic, and the cost of coverage is small relative to that downside. It is a judgment about asymmetric consequences rather than a prediction about probability.
\nThe same logic applies to the data an organization holds. The most valuable thing most organizations own is neither real estate nor physical assets nor, honestly, their people. What drives value are repositories of private data accumulated over years of operation: strategic communications, intellectual property, client relationships, and the competitive intelligence embedded in internal documents that were never meant to leave the building.
\nThat data currently sits behind RSA and elliptic curve cryptography. The trajectory for breaking those algorithms has moved consistently in one direction for more than a decade, and this year alone has produced several meaningful steps forward, even accounting for the work still ahead.
\nWhile skepticism is completely fair for an emerging technology that generates so much noise, what if that skepticism turns out to be wrong? Frankly, being wrong is years of competitive advantage exposed, client trust damaged, and intellectual property in the hands of people who should not have it. None of that is recoverable through explanation or apology.
\nThat asymmetric downside is the whole argument: being honest on what it would cost to be wrong, and it doesn’t take believing the threat to be imminent to adopt that perspective.
\nBefore moving on to what to do about any of this, there is a related problem that does not require a capable quantum computer to exist today. It is called “harvest now, decrypt later.”
\nRight now, sophisticated adversaries are capturing encrypted network traffic and holding it, intending to decrypt it once capable quantum hardware arrives. Those adversaries include nation-states, well-funded criminal organizations, and competitors who do not share your scruples. Storage is cheap, patience costs nothing, and the value of years of captured strategic communications, once decryptable, is enormous.
\nEvery week that passes without quantum-safe encryption on the most sensitive channels is another week of exposure accumulating in archives the organization does not control. Traffic your organization transmitted in 2021, 2022, and 2023 may already be sitting somewhere, waiting to become useful. The advances across multiple papers and multiple teams this year each solve a piece of that puzzle, and every piece that falls shortens the window between when data was captured and when it becomes readable.
\nThis is already a current problem, and every new result makes it worse.
\nCrypto-agility is the ability to identify, manage, and update cryptographic algorithms, certificates, and keys across an organization as threats and standards change.
\nPost-quantum compliance and crypto-agility are not the same thing, and it is worth being explicit about the distinction.
\nPQC compliance means an organization has swapped its vulnerable algorithms for quantum-resistant ones. That is good and necessary work, but it is not sufficient on its own.
\nCrypto-agility means an organization has built the infrastructure to update its cryptographic posture continuously, as the threat landscape changes and as standards evolve. It knows at any given moment exactly which algorithms are running on every system in its environment: every certificate, every key, every algorithm embedded in every application and third-party dependency. And it can change those configurations without turning the effort into a multi-year infrastructure project.
\nThe reason this matters is that the post-quantum transition will not be a one-time event. NIST has finalized its first post-quantum standards in ML-KEM, ML-DSA, and SLH-DSA, but cryptographic standards change over time. The Supersingular Isogeny Diffie-Hellman protocol was once considered a strong post-quantum candidate. A classical attack broke it in 2022, and organizations that had hardcoded it into their infrastructure were forced to scramble.
\nWhen a standard shifts or an algorithm falls, crypto-agile organizations update their systems rather than rebuilding them from scratch. That distinction shows up everywhere in practice, from migration cost to the length of the window in which an adversary can exploit the transition.
\nThe enterprise value extends beyond avoiding catastrophe. Crypto-agile organizations carry lower cyber insurance risk profiles, compete more effectively in government and regulated industry procurement where quantum-safe security is increasingly a baseline requirement, earn credibility with enterprise clients managing the same risks, and can read each new quantum computing headline from a position of confidence rather than exposure.
\nWhen clients, customers, and partners hand an organization their data, they are extending a form of trust that goes beyond what a terms-of-service document describes. They are trusting that the organization will protect that data with the best tools available at the time.
\nIn 2026, meeting that expectation honestly means being aware of a documented, consistent trajectory in which the machines capable of breaking current encryption are getting closer with each paper and each experimental result. It means understanding that harvest-now, decrypt-later attacks are already operational, and recognizing that the research community has been telling us so, steadily and without interruption, for more than a decade.
\nInvesting in crypto-agility is risk management, but it is also something closer to keeping a promise: to shareholders who are owed honest accounting of existential risks, to customers who trust the organization with something they consider important, and to the broader ecosystem that depends on serious institutions taking this problem seriously.
\nOrganizations that move now will arrive at the transition prepared. Organizations that wait for a definitive signal may find that by the time the signal arrives, the data that needs to be protected has already been harvested. The window for moving on your own timeline, and at a manageable cost, is open now.
\n“Towards Ultra-High-Rate Quantum Error Correction with Reconfigurable Atom Arrays” (Zhao, Duckering, Gu, Maskara, Zhou; arXiv:2604.16209, April 2026),
\nKasai at the Institute of Science Tokyo
\nOratomic/Caltech (arXiv:2603.28627)
\nResource estimates from Google Quantum AI (March 2026).
\nThe Quantum Insider recently highlighted the companies selected for the World Economic Forum’s 2026 Technology Pioneers cohort. Recognizing organizations advancing innovation across quantum computing, communications, and cybersecurity. QuSecure was recognized for its leadership in post-quantum cryptography and its work helping organizations prepare for the quantum era.
\nThe annual World Economic Forum program recognizes early-stage companies with technologies that have the potential to transform industries and address global challenges. QuSecure’s inclusion reflects the growing importance of quantum-resilient cybersecurity. As governments and enterprises accelerate efforts to modernize cryptographic infrastructure and prepare for future threats.
\nAs organizations prepare for the transition to quantum-resistant security, implementing crypto agility, maintaining a comprehensive cryptographic inventory, and adopting NIST PQC algorithms are essential steps. Aligning with emerging NIST PQC standards helps organizations strengthen long-term post quantum cybersecurity resilience.
", "date_published": "2026-06-10T16:19:28Z", "authors": [ { "name": "Trina Mabunay" } ], "tags": [ "Media Coverage" ], "image": "https://www.qusecure.com/og/quantum-insider-wef-technology-pioneer.jpg" }, { "id": "https://www.qusecure.com/quantum-zeitgeist-wef-technology-pioneer/", "url": "https://www.qusecure.com/quantum-zeitgeist-wef-technology-pioneer/", "title": "QuSecure Featured in Quantum Zeitgeist: World Economic Forum Technology Pioneer", "summary": "Quantum Zeitgeist on QuSecure's selection as a 2026 World Economic Forum Technology Pioneer, a list whose alumni include Google and NVIDIA.", "content_html": "Quantum Zeitgeist recently highlighted QuSecure’s selection as a 2026 World Economic Forum Technology Pioneer. The recognition places QuSecure among an accomplished group of innovators, including past Technology Pioneers such as Google, NVIDIA, and other companies advancing transformative technologies. The award recognizes organizations with the potential to address global challenges through innovation and technology.
\nThe article highlights QuSecure’s leadership in post-quantum cryptography and its mission to help organizations prepare for quantum-era cybersecurity risks. As governments and enterprises accelerate quantum readiness initiatives, organizations are prioritizing cryptographic modernization and long-term cyber resilience.
\nPreparing for the quantum era requires more than adopting new algorithms. Organizations should establish crypto agility, maintain a comprehensive cryptographic inventory, and begin deploying NIST PQC algorithms. Aligning with NIST PQC standards helps organizations strengthen long-term post quantum cybersecurity readiness.
", "date_published": "2026-06-10T16:13:36Z", "authors": [ { "name": "Trina Mabunay" } ], "tags": [ "Media Coverage" ], "image": "https://www.qusecure.com/og/quantum-zeitgeist-wef-technology-pioneer.jpg" }, { "id": "https://www.qusecure.com/qusecure-named-a-2026-technology-pioneer-by-world-economic-forum-for-its-post-quantum-cryptography-leadership/", "url": "https://www.qusecure.com/qusecure-named-a-2026-technology-pioneer-by-world-economic-forum-for-its-post-quantum-cryptography-leadership/", "title": "QuSecure Named a 2026 Technology Pioneer by World Economic Forum for its Post-Quantum Cryptography Leadership", "summary": "The World Economic Forum named QuSecure a 2026 Technology Pioneer, a recognition based on technology and potential impact.", "content_html": "Leading Post-Quantum Cryptography Company QuSecure Recognized Due to its Cutting-Edge Technology and Potential Impact to the World
\nSAN MATEO, Calif. — June 10, 2026 — QuSecure™, Inc., a leader in post-quantum cryptography (PQC) and cryptographic agility, today announced that the World Economic Forum (WEF) has named the company as a 2026 Technology Pioneer. Each year the WEF awards leading early-stage start-ups from around the globe for their cutting-edge technologies with the potential to improve the world.
\nThe 2026 cohort highlights the major trends in global innovation, from AI infrastructure and robotics to quantum systems, advanced energy, biotechnology, and next -generation materials. Past WEF Technology Pioneers include Google, Palantir, PayPal, Twitter, Cloudflare, Okta, Dropbox, Nvidia, GitHub, and Red Hat, which were recognized while in their startup phases.
\n“QuSecure is honored to be named to this select list and join a global community of innovators contributing ideas, expertise, and technology to conversations shaping the future of industries and society,” said QuSecure CEO Rebecca Krauthamer. “We look forward to engaging with leaders across industries, governments, and civil society through the Forum’s global platform.”
\nWorld Economic Forum
\nThe World Economic Forum, committed to improving the state of the world, is the International Organization for Public-Private Cooperation. The Forum engages the foremost political, business and other leaders of society to shape global, regional and industry agendas. (www.weforum.org).
Technology Pioneers
\nLaunched in 2000, the Technology Pioneers is a leading community for early-stage companies from around the world that are shaping the future through breakthrough technologies and innovations. These companies are selected for their potential to have a significant impact on business and society and are invited to engage with public and private sector leaders through the World Economic Forum’s global platform. The Technology Pioneers community is part of the Innovator Communities at the World Economic Forum, which convene the world’s leading global start-ups across different growth stages, from early-stage Technology Pioneers to growth-stage Global Innovators and unicorn companies valued at more than $1 billion.