Key Takeaways
- Federal networks are under relentless pressure from increasingly fast, AI‑driven cyber attacks that can launch in minutes rather than months.
- The Cybersecurity and Infrastructure Security Agency (CISA), the nation’s primary civilian cyber defender, has lost experienced staff and institutional knowledge, weakening its ability to respond.
- Adversaries are already harvesting encrypted government data with the intent to decrypt it later using quantum computers—a “harvest‑now, decrypt‑later” strategy.
- Recent assessments fault‑tolerant quantum computers capable of breaking RSA and elliptic‑curve encryption could appear as early as 2029, six years sooner than previously expected.
- Post‑quantum cryptography (PQC) provides a proven technical solution; migrating to PQC now stops the harvest‑now, decrypt‑later model at its source.
- Successful PQC migration requires a comprehensive cryptographic inventory, vendor engagement, prioritization of the most sensitive data, hybrid approaches during transition, and continuous management.
- Rebuilding CISA’s workforce and expertise is essential to coordinate and execute the rapid, large‑scale migration across thousands of federal systems before the 2029 quantum deadline.
A Defense Under Siege
Federal systems confront a compounding crisis: classical threats such as ransomware, malware, and supply‑chain attacks persist, while artificial intelligence‑powered adversarial tools have accelerated attack speed to hours or minutes. Unlike human‑driven campaigns that required weeks of reconnaissance, AI platforms continuously probe endpoints, adapt defenses in real time, and generate novel vectors at a scale no analyst can match. This relentless pressure stretches the already thin defensive capacity of government networks spanning defense, civilian agencies, and critical infrastructure.
CISA’s Diminished Capacity
The Cybersecurity and Infrastructure Security Agency (CISA) was created to be the nation’s premier civilian cyber defender, coordinating responses and protecting federal networks. Yet a wave of departures—driven by budget constraints, policy uncertainty, and broader federal workforce erosion—has stripped CISA of seasoned analysts, threat‑intelligence specialists, and incident‑response coordinators. The loss of institutional knowledge means the agency now operates with dramatically fewer skilled personnel while the threat landscape grows more sophisticated by the day, leaving a widening gap between attack volume and defensive capability.
The Harvest‑Now, Decrypt‑Later Strategy
Beyond immediate disruption, adversaries are systematically exfiltrating encrypted federal data—communications, personnel files, intelligence assessments, infrastructure schematics—intending to store it until quantum computers can decrypt it. This “harvest‑now, decrypt‑later” approach exploits the fact that today’s encryption relies on mathematical assumptions that quantum algorithms, notably Shor’s algorithm, can break. By collecting data now, attackers plan to reap the full value of stolen secrets once a cryptographically relevant quantum computer (CRQC) becomes available.
Accelerated Quantum Timeline
Early estimates placed a viable CRQC around 2035, but recent research—particularly a March 2026 Google paper—suggests fault‑tolerant quantum computers capable of breaking RSA and elliptic‑curve encryption could emerge as early as 2029. This six‑year acceleration means that data harvested today and protected only by classical cryptography will be readable to adversaries within the operational planning horizon of current national‑security leadership, turning a future risk into an imminent threat.
Post‑Quantum Cryptography as the Solution
The technical remedy exists: post‑quantum cryptography (PQC). PQC algorithms are based on mathematical problems that even quantum computers cannot solve efficiently, ensuring that data encrypted today remains secure against future CRQCs. In 2024, the National Institute of Standards and Technology (NIST) finalized the first PQC standards—ML‑KEM (formerly CRYSTALS‑Kyber), ML‑DSA (CRYSTALS‑Dilithium), and SLH‑DSA (SPHINCS+). These provide a solid foundation for migration, but adopting PQC is not a simple switch; it requires a multi‑year, coordinated effort.
Steps Toward Quantum Resiliency
Effective migration follows a structured, iterative process:
- Comprehensive cryptographic asset inventory – Identify every system, protocol, and data store relying on RSA or elliptic‑curve encryption.
- Deploy PQC tools with crypto‑agility – Implement solutions that allow rapid algorithm swaps and incorporate zero‑trust principles.
- Engage vendors immediately – Work with suppliers and integrators on PQC‑readiness roadmaps, especially for long‑lifecycle operational technology (OT) systems that cannot be upgraded quickly.
- Prioritize the most sensitive data – Protect first those assets whose exposure would cause the greatest national‑security harm.
- Use hybrid cryptography as an interim measure – Maintain backward compatibility while layering quantum‑resistant protection where it matters most.
- Continuous management – Treat the migration as an ongoing cycle, monitoring for emerging vulnerabilities in PQC implementations and adjusting as needed.
Rebuilding CISA’s Expertise Is Essential
The complexity and scale of a federal‑wide PQC transition demand sustained institutional expertise, centralized coordination, and the ability to track and remediate new vulnerabilities. Rebuilding CISA’s workforce is therefore not merely a staffing issue; it is a prerequisite for executing a technically demanding national‑security migration on a fast‑approaching deadline. Without experienced analysts to oversee inventory, validate vendor roadmaps, manage hybrid deployments, and respond to incidents, the migration will falter, leaving critical data exposed.
Urgency Over Long‑Range Planning
Treating quantum computing as a distant, exotic problem is no longer tenable. Adversaries are already aligning their collection efforts with the 2029 quantum horizon, and federal agencies must match that urgency. Delaying action until a 2035 timeline—based on outdated assumptions—leaves the nation vulnerable to a near‑term cryptographic collapse. The time to act is now: secure the data, strengthen CISA, and migrate to post‑quantum cryptography before the window closes.