Post-quantum cryptography: Europol and the GAO sound the alarm

In the same week, two institutions, one European and one American, called for a faster move to post-quantum cryptography (PQC). Europol published two reports on 7 October 2026; the Government Accountability Office (GAO), the US federal government’s spending watchdog, published one on 6 October. In the same days, a study by F5 Labs, reported by CSO Online, measured how widespread PQC really is on the web.

There is no CVE to fix and no product to rush-update: the issue is the cryptography that key exchange and digital signatures rely on today, which a sufficiently powerful quantum computer could break. Some countermeasures, however, can be applied right away.

What happened

Europol published two studies:

• the first assesses how encrypted communications and stored files could become vulnerable to harvest now, decrypt later (HNDL) attacks: data stolen today and kept until it can be decrypted. According to Europol, an organisation’s exposure depends on the protocols, configurations and key management practices it uses;
• the second covers cryptocurrency wallets: according to Europol, cryptocurrencies will not collapse because of quantum computing, but their long-term security requires a phased transition to quantum-resistant algorithms.

The GAO published a redacted version of a report sent to federal agencies in September 2025. It made 89 recommendations to 23 agencies in three areas: a prioritised inventory of vulnerable cryptography, an estimate of the funding needed for PQC, and PQC testing. None of the agencies reviewed had fully addressed all three. The causes cited: a lack of cryptography expertise, of processes to build inventories and estimate funding, and of plans for testing.

When will “Q-day” arrive?

There is no consensus on when cryptographically relevant quantum computers (CRQCs) will appear. The sources cite Google, but differently: according to Infosecurity Magazine, Google indicated in March that they could arrive as early as 2029; according to CyberScoop, Google has set 2029 as the target for its own transition to PQC. CyberScoop also reports research by Oratomic, a Caltech spin-off, suggesting a CRQC could need far fewer physical resources than earlier estimates.

For defenders, the date matters less than it seems: data that must remain confidential for years is already exposed to HNDL. The risk was also recognised by the White House order of June, which according to CyberScoop requires high-value federal systems to adopt PQC for key establishment by the end of 2030 and for digital signatures by the end of 2031. For national security systems, the NSA is already moving classified systems towards the CNSA 2.0 standards.

How far has migration gone: the F5 Labs data

According to F5 Labs, 54% of the top one million websites support post-quantum key exchange. The figure, however, needs context:

• much of that support comes from CDNs that switched PQC on by default: excluding Cloudflare-hosted sites, the share drops to 22%;
• the study only looks at the site’s public front end, not the link between the CDN and the origin server or internal traffic, which F5 Labs says could be an even more attractive target for HNDL;
• more than one site in ten still lacks TLS 1.3, a prerequisite for the post-quantum key exchange tested;
• among government and telecommunications sites, support stops at 35%;
• the figure measures key exchange: PQC certificates are not yet available for the public internet, and their larger size will cause problems. According to F5 Labs, Merkle Tree Certificates should help browsers, but many other environments will need PQC certificates.

The sources do not fully agree on how to read this. Keyfactor, quoted by CSO Online, believes web data does not reflect companies’ PQC programmes, which are further ahead in finance, telecommunications and government, with healthcare accelerating. Deloitte warns instead that a mature plan is not the same as a completed migration. According to a June KPMG survey cited by CSO Online, only 27% of CISOs are implementing PQC.

On standards, NIST finalised its first PQC standards in 2024; according to PQShield, the IETF only published the standard for hybrid key exchange mechanisms in TLS 1.3 in August 2026.

Impact for European and Italian companies

Europol’s recommendations apply to any organisation. The sources point to sectors whose data stays sensitive for a long time as the most exposed: finance (HSMs, payment infrastructure, PKI and third-party services), telecommunications, healthcare, government, and industrial environments with OT that will stay in service for years.

For NIS2 entities, policies on the use of cryptography are part of the risk management measures the directive requires: a cryptography inventory is also the starting point for migrating to PQC. A CDN with PQC enabled protects the leg between the user and the CDN, not the origin, internal APIs, service-to-service traffic or the corporate PKI.

What to do now

1. Harden protocols as Europol asks: TLS 1.3 and SSH2, legacy protocols disabled and forward secrecy enforced.
2. Reduce stored data: identify and delete sensitive data you no longer need, to limit what an attacker can harvest today.
3. Inventory your cryptography beyond the website: internal applications, APIs, VPNs, SSH, identity systems, code signing and embedded libraries. Keep it in a cryptographic bill of materials with a named owner.
4. Prioritise data that must stay confidential for years and the systems that take longest to change.
5. Adopt hybrid key exchange where available, checking the CDN-to-origin link too.
6. Automate certificate management ahead of 47-day certificates, so you can change algorithms and certificates without one-off projects.
7. Plan funding and testing, two of the three areas where the GAO found gaps in federal agencies.

How ARXDOME helps

ARX Expose shows what of your company is visible from the internet, including certificates, open ports and recognised products: a starting point for the external part of the inventory. ARX Sentry collects the inventory of systems, software and ports on monitored machines, useful for finding where to act internally.

Last updated: 8 October 2026