Google Cloud announced Prepare for Post-Quantum Cryptography, a public Gemini Notebook that consolidates Google’s post-quantum cryptography research, engineering blogs, and migration guidance into a single interactive resource. The tool is aimed at CISOs, policymakers, and security teams who need to understand the quantum threat and turn dense technical material into actionable next steps. Users can ask questions grounded in the curated sources, listen to an audio overview, test themselves with flashcards, explore an interactive diagram of the quantum threat, and read a concise briefing document.

The post explains why PQC is urgent. Google’s Willow chip and Quantum Echoes algorithm are cited as evidence that quantum computing is moving from theory to reality. Google research estimates that breaking ECDLP-256 and RSA-2048 encryption would require roughly 500,000 and 1 million noisy qubits, respectively. The post argues this means current online security is more vulnerable to future quantum computers than previously thought. In store-now-decrypt-later attacks, adversaries can steal encrypted data today and wait until a sufficiently powerful quantum computer exists to decrypt it, putting health records, financial data, intellectual property, and government secrets at risk. Google has published a migration timeline with plans to transition to PQC by 2029 and urges other organizations to consider similar timelines.

The Prepare for Post-Quantum Cryptography notebook is built from curated Google sources covering quantum computing breakthroughs, industry PQC standards, Google’s own deployments, and the latest research. Suggested prompts include asking what a CISO should prioritize in the first 90 days of a PQC migration, explaining store-now-decrypt-later in plain terms, and explaining how hybrid ML-KEM key exchange works in Chrome. The article cautions that, as with all generative AI, the notebook can make mistakes and responses should be checked against the linked sources.

For CISOs, Google recommends starting by understanding where vulnerable cryptography lives, identifying and prioritizing data and systems most at risk, anticipating system-wide effects of migration, and building crypto-agility into security plans, using lessons from past incidents like Heartbleed. For policymakers, Google recommends urging critical infrastructure owners and operators to recognize condensed timelines, incorporating PQC readiness into existing risk mitigation plans, engaging with global counterparts to harmonize standards development, and including technical and security experts when writing quantum-safety policy.

Google’s existing PQC deployments include hybrid Kyber/ML-KEM key exchange in Chrome, PQC in Android, quantum-safe digital signatures in Cloud KMS, and PQC for internal communications. Google also co-founded the Post-Quantum Cryptography Alliance at the Linux Foundation with Amazon Web Services, Cisco, IBM, and NVIDIA to support open-source tools like Open Quantum Safe.

The article also describes how teams can create a similar notebook for their own organization: curate trusted sources, write neutral factual prompts, add AI disclaimers and a welcome note, and have experts review all generated output. It closes by noting that the quantum transition has already started, and encourages starting with an understanding of the threat, then assessing the cryptographic inventory and building a migration roadmap.