Digital Watch Observatory
Digital Governance in 50+ issues, 500+ actors, 5+ processes
Home | Updates | US watchdog warns of gaps in quantum-resistant cybersecurity
A new GAO assessment highlights the urgency of upgrading federal cybersecurity systems as advances in quantum computing could eventually undermine existing encryption methods.
The United States Government Accountability Office (GAO) has warned that federal agencies are not adequately prepared for the cybersecurity risks posed by future quantum computers. In a report, the watchdog found that none of the 24 agencies assessed had fully addressed the preparatory practices needed to transition to quantum-resistant cryptography.
Although current quantum computers cannot break the cryptographic methods at issue, experts believe a sufficiently powerful machine could emerge as early as the 2030s, although estimates vary. Such a development could undermine systems used to authenticate users and protect sensitive information. Attackers could also collect encrypted data now and decrypt it later when the necessary quantum capabilities become available.
GAO identified three areas requiring action: maintaining prioritised inventories of systems using vulnerable cryptography, assessing the funding needed to upgrade those systems, and testing post-quantum cryptographic algorithms in agency environments. The review attributed shortcomings partly to limited cryptography expertise, inadequate processes for identifying funding needs, and insufficient planning for testing.
The report is a public version of a sensitive assessment issued in September 2025, in which GAO made 89 recommendations to 23 agencies. These included measures to identify vulnerable systems and plan the transition to post-quantum cryptography. GAO maintains that all recommendations remain warranted, highlighting the need for agencies to address the gaps before quantum computing poses a practical threat to their systems.
Preparing for quantum threats requires governments to rethink how they manage the lifecycle of digital infrastructure, rather than treating cryptographic security as a one-off technical decision. The challenge extends beyond developing stronger algorithms to ensuring that legacy systems, procurement processes and budgets can accommodate the transition. Progress will depend on whether institutions can turn technical guidance into coordinated, adequately funded implementation before existing protections become vulnerable.
More news
The Digital Watch is an initiative of the Geneva Internet Platform, supported by the Swiss Confederation and the Republic and Canton of Geneva. The GIP is operated by DiploFoundation.
The GIP Digital Watch observatory reflects on a wide variety of themes and actors involved in global digital policy, curated by a dedicated team of experts from around the world. To submit updates about your organisation, or to join our team of curators, or to enquire about partnerships, write to us at [email protected]. We look forward to hearing from you.
About the Author
