Welcome to the first Cloud CISO Perspectives for October 2026. Today, Stephanie Kiel explains the latest on our approach to post-quantum cryptography, and shares a new tool to help CISOs and executives prepare their organizations for PQC.
As with all Cloud CISO Perspectives, the contents of this newsletter are posted to the Google Cloud blog. If you’re reading this on the website and you’d like to receive the email version, you can subscribe here.
By Stephanie Kiel, Head of Cloud Security Policy, Government Affairs and Public Policy, Google Cloud
Post-quantum cryptography (PQC) is one of the most urgent security shifts of the decade — and one of the easiest to tune out. For security leaders and policymakers, the research is dense, scattered across papers and engineering blogs, and can be challenging to turn into action.
To help, we're launching Prepare for Post-Quantum Cryptography, a public Gemini Notebook that brings Google's PQC research, engineering blogs, and migration guidance together in one place. Ask it questions, listen to an audio overview, or test yourself with flashcards, and quickly get up to speed on the quantum threat.
Why PQC matters now
Quantum computing is rapidly moving from theory to reality. Our Willow chip and Quantum Echoes algorithm mark substantial progress, and Google research estimates that breaking ECDLP-256 and RSA-2048 encryption — the public-key cryptography schemes protecting much of our online data — would require around 500,000 and 1 million imperfect quantum computer components (noisy qubits), respectively.
This research has consequences now. It indicates that today’s online security is more vulnerable to future quantum computers than previously thought.
In Store Now, Decrypt Later attacks, adversaries may steal encrypted data now and wait to decrypt it once a sufficiently powerful quantum computer exists. Data that we’ve long considered sensitive — health records, financial data, intellectual property, and government secrets — is already at risk.
With continued advances in architecture, quantum algorithms, and quantum error correction shrinking future quantum hardware requirements, waiting to upgrade our digital locks is not a viable option. To help organizations stay ahead of the curve, Google has published a migration timeline noting our plans to transition to PQC by 2029, and we urge others to consider the same.
As the technology advances, policymakers should consider urging critical infrastructure owners and operators to recognize condensed timelines, and build PQC readiness into existing risk mitigation plans. We also recommend governments engage with global counterparts to promote a harmonized approach to standards development, and include technical and security experts in the building of policy and regulatory requirements focused on quantum safety.
Google's PQC expertise, in one notebook
The Prepare for Post-Quantum Cryptography notebook turns years of Google expertise into an interactive primer that anyone can use. It's built on curated Google sources covering the quantum era, quantum computing breakthroughs like Willow, Quantum Echoes, and surface code error suppression, industry PQC standards, Google's own deployments, and the latest research.
In the Gemini Notebook, you can:
Get answers grounded in Google's sources.
Listen to a podcast-style audio overview.
Test your PQC knowledge with flashcards.
Explore an interactive visual diagram of the quantum threat.
Read a concise briefing document.
Try these prompts
To get started, here are a few questions to ask the notebook:
For CISOs: "What should a CISO prioritize in the first 90 days of a PQC migration?"
For anyone new to PQC: "Explain store-now-decrypt-later in plain terms." For developers: "How does hybrid ML-KEM key exchange work in Chrome?"
As with all generative AI, the notebook can make mistakes, so check its responses against the linked sources.
What's at stake
Previous cryptographic migrations, such as moving from SHA-1 or upgrading TLS, have taken a decade or more. Waiting for the availability of a cryptographically-relevant quantum computer before beginning the migration journey represents a significant security risk given the importance of public-key cryptography for securing digital essentials like web traffic, software updates, digital identities, and signatures.
For CISOs, we recommend that you start by: Understanding where vulnerable cryptography lives in your organization.
Identifying and prioritizing data and systems most at risk from quantum threats, and developing a plan for addressing these risks.
Anticipate system-wide effects that PQC migration could have.
Building crypto-agility into your security plans, using learnings from past experiences like Heartbleed.
Additional detail on these recommendations is available in our previous blog post.
For the broader security community, the transition only succeeds if this knowledge is accessible to everyone — not just organizations with dedicated cryptography teams. We’ve been deploying PQC for years. Highlights include:
We also co-founded the Post-Quantum Cryptography Alliance at the Linux Foundation with industry leaders including Amazon Web Services, Cisco, IBM, and NVIDIA to support open-source tools like Open Quantum Safe.
Build a PQC notebook for your own team
Here’s how you can create a resource similar to our PQC Gemini Notebook, specific to your organization’s needs:
Curate trusted sources. Start with a focused set of authoritative research, standards, and guidance.
Write neutral prompts. Keep instructions factual so outputs stay grounded in your sources.
Add AI disclaimers and a welcome note. Tell readers what the notebook covers and remind them that AI can make mistakes.
Review all output with human oversight. Have experts check every artifact before you share it.
Start preparing today
The quantum transition has already started, but preparing your organization doesn't have to begin with a 100-page whitepaper. Start by understanding the threat, then assess your cryptographic inventory and build a migration roadmap.
You can get started with the Prepare for Post-Quantum Cryptography Gemini Notebook and share it with your team today. To learn more about Google Cloud’s approach to PQC, check out our dedicated Google Cloud PQC Resource Hub.
Here are the latest updates, products, services, and resources from our security teams so far this month:
Please visit the Google Cloud blog for more security stories published this month.
Please visit the Google Cloud blog for more threat intelligence stories published this month.
To have our Cloud CISO Perspectives post delivered twice a month to your inbox, sign up for our newsletter. We’ll be back in a few weeks with more security-related updates from Google Cloud.