Cloud CISO Perspectives: New Gemini Notebook can help CISOs and policymakers prepare for PQC

This research has consequences now. It indicates that today’s online security is more vulnerable to future quantum computers than previously thought.

In Store Now, Decrypt Later attacks, adversaries may steal encrypted data now and wait to decrypt it once a sufficiently powerful quantum computer exists. Data that we’ve long considered sensitive — health records, financial data, intellectual property, and government secrets — is already at risk. 

With continued advances in architecture, quantum algorithms, and quantum error correction shrinking future quantum hardware requirements, waiting to upgrade our digital locks is not a viable option. To help organizations stay ahead of the curve, Google has published a migration timeline noting our plans to transition to PQC by 2029, and we urge others to consider the same.

As the technology advances, policymakers should consider urging critical infrastructure owners and operators to recognize condensed timelines, and build PQC readiness into existing risk mitigation plans. We also recommend governments engage with global counterparts to promote a harmonized approach to standards development, and include technical and security experts in the building of policy and regulatory requirements focused on quantum safety. 

Google’s PQC expertise, in one notebook

The Prepare for Post-Quantum Cryptography notebook turns years of Google expertise into an interactive primer that anyone can use. It’s built on curated Google sources covering the quantum era, quantum computing breakthroughs like Willow, Quantum Echoes, and surface code error suppression, industry PQC standards, Google’s own deployments, and the latest research.

In the Gemini Notebook, you can:

• Get answers grounded in Google’s sources.

• Listen to a podcast-style audio overview.

• Test your PQC knowledge with flashcards.

• Explore an interactive visual diagram of the quantum threat.

• Read a concise briefing document.

Try these prompts

To get started, here are a few questions to ask the notebook:

• For CISOs: “What should a CISO prioritize in the first 90 days of a PQC migration?”

• For anyone new to PQC: “Explain store-now-decrypt-later in plain terms.”

• For developers: “How does hybrid ML-KEM key exchange work in Chrome?”

As with all generative AI, the notebook can make mistakes, so check its responses against the linked sources.

What’s at stake

Previous cryptographic migrations, such as moving from SHA-1 or upgrading TLS, have taken a decade or more. Waiting for the availability of a cryptographically-relevant quantum computer before beginning the migration journey represents a significant security risk given the importance of public-key cryptography for securing digital essentials like web traffic, software updates, digital identities, and signatures.

For CISOs, we recommend that you start by:

• Understanding where vulnerable cryptography lives in your organization.

• Identifying and prioritizing data and systems most at risk from quantum threats, and developing a plan for addressing these risks.

• Anticipate system-wide effects that PQC migration could have.

• Building crypto-agility into your security plans, using learnings from past experiences like Heartbleed.

Additional detail on these recommendations is available in our previous blog post.  

For the broader security community, the transition only succeeds if this knowledge is accessible to everyone — not just organizations with dedicated cryptography teams.

How Google is putting PQC into practice

We’ve been deploying PQC for years. Highlights include:

We also co-founded the Post-Quantum Cryptography Alliance at the Linux Foundation with industry leaders including Amazon Web Services, Cisco, IBM, and NVIDIA to support open-source tools like Open Quantum Safe.

Build a PQC notebook for your own team

Here’s how you can create a resource similar to our PQC Gemini Notebook, specific to your organization’s needs:

1. Curate trusted sources. Start with a focused set of authoritative research, standards, and guidance.

2. Write neutral prompts. Keep instructions factual so outputs stay grounded in your sources.

3. Add AI disclaimers and a welcome note. Tell readers what the notebook covers and remind them that AI can make mistakes.

4. Review all output with human oversight. Have experts check every artifact before you share it.

Start preparing today

The quantum transition has already started, but preparing your organization doesn’t have to begin with a 100-page whitepaper. Start by understanding the threat, then assess your cryptographic inventory and build a migration roadmap.

You can get started with the Prepare for Post-Quantum Cryptography Gemini Notebook and share it with your team today. To learn more about Google Cloud’s approach to PQC, check out our dedicated Google Cloud PQC Resource Hub.