Cloud CISO Perspectives: New Gemini Notebook can help CISOs and policymakers prepare for PQC

extract

Cloud CISO Perspectives: New Gemini Notebook can help CISOs and policymakers prepare for PQC Stephanie Kiel Head of Cloud Security Policy, Government Affairs and Public Policy, Google Cloud Get original CISO insights in your inbox The latest on security from Google Cloud's Office of the CISO, twice a month. Subscribe Welcome to the first Cloud CISO Perspectives for October 2026. Today, Stephanie Kiel explains the latest on our approach to post-quantum cryptography, and shares a new tool to help CISOs and executives prepare their organizations for PQC. As with all Cloud CISO Perspectives, the contents of this newsletter are posted to the Google Cloud blog. If you’re reading this on the website and you’d like to receive the email version, you can subscribe here. New Gemini Notebook can help CISOs and policymakers prepare for PQC By Stephanie Kiel, Head of Cloud Security Policy, Government Affairs and Public Policy, Google Cloud Post-quantum cryptography (PQC) is one of the most urgent security shifts of the decade — and one of the easiest to tune out. For security leaders and policymakers, the research is dense, scattered across papers and engineering blogs, and can be challenging to turn into action. To help, we're launching Prepare for Post-Quantum Cryptography, a public Gemini Notebook that brings Google's PQC research, engineering blogs, and migration guidance together in one place. Ask it questions, listen to an audio overview, or test yourself with flashcards, and quickly get up to speed on the quantum threat. Why PQC matters now Quantum computing is rapidly moving from theory to reality. Our Willow chip and Quantum Echoes algorithm mark substantial progress, and Google research estimates that breaking ECDLP-256 and RSA-2048 encryption — the public-key cryptography schemes protecting much of our online data — would require around 500,000 and 1 million imperfect quantum computer components (noisy qubits), respectively. To help, we're launching Prepare for Post-Quantum Cryptography, a public Gemini Notebook that brings Google's PQC research, engineering blogs, and migration guidance together in one place. This research has consequences now. It indicates that today’s online security is more vulnerable to future quantum computers than previously thought. In Store Now, Decrypt Later attacks, adversaries may steal encrypted data now and wait to decrypt it once a sufficiently powerful quantum computer exists. Data that we’ve long considered sensitive — health records, financial data, intellectual property, and government secrets — is already at risk. With continued advances in architecture, quantum algorithms, and quantum error correction shrinking future quantum hardware requirements, waiting to upgrade our digital locks is not a viable option. To help organizations stay ahead of the curve, Google has published a migration timeline noting our plans to transition to PQC by 2029, and we urge others to consider the same. As the technology advances, policymakers should consider urging critical infrastructure owners and operators to recognize condensed timelines, and build PQC readiness into existing risk mitigation plans. We also recommend governments engage with global counterparts to promote a harmonized approach to standards development, and include technical and security experts in the building of policy and regulatory requirements focused on quantum safety. Google's PQC expertise, in one notebook The Prepare for Post-Quantum Cryptography notebook turns years of Google expertise into an interactive primer that anyone can use. It's built on curated Google sources covering the quantum era, quantum computing breakthroughs like Willow, Quantum Echoes, and surface code error suppression, industry PQC standards, Google's own deployments, and the latest research. In the Gemini Notebook, you can: - Get answers grounded in Google's sources. - Listen to a podcast-style audio overview. - Test your PQC knowledge with flashcards. - Explore an interactive visual diagram of the quantum threat. - Read a concise briefing document. Try these prompts To get started, here are a few questions to ask the notebook: - For CISOs: "What should a CISO prioritize in the first 90 days of a PQC migration?" - For anyone new to PQC: "Explain store-now-decrypt-later in plain terms." - For developers: "How does hybrid ML-KEM key exchange work in Chrome?" As with all generative AI, the notebook can make mistakes, so check its responses against the linked sources. What's at stake Previous cryptographic migrations, such as moving from SHA-1 or upgrading TLS, have taken a decade or more. Waiting for the availability of a cryptographically-relevant quantum computer before beginning the migration journey represents a significant security risk given the importance of public-key cryptography for securing digital essentials like web traffic, software updates, digital identities, and signatures. For CISOs, we recommend that you start by: - Understanding where vulnerable cryptography lives in your organization. - Identifying and prioritizing data and systems most at risk from quantum threats, and developing a plan for addressing these risks. - Anticipate system-wide effects that PQC migration could have. - Building crypto-agility into your security plans, using learnings from past experiences like Heartbleed. Additional detail on these recommendations is available in our previous blog post. For the broader security community, the transition only succeeds if this knowledge is accessible to everyone — not just organizations with dedicated cryptography teams. How Google is putting PQC into practice We’ve been deploying PQC for years. Highlights include: - Hybrid Kyber/ML-KEM key exchange protecting Chrome traffic - PQC in Android - Quantum-safe digital signatures in Cloud KMS - PQC for Google's internal communications - Wiz PQC readiness scanner across code, cloud, and runtime We also co-founded the Post-Quantum Cryptography Alliance at the Linux Foundation with industry leaders including Amazon Web Services, Cisco, IBM, and NVIDIA to support open-source tools like Open Quantum Safe. Build a PQC notebook for your own team Here’s how you can create a resource similar to our PQC Gemini Notebook, specific to your organization’s needs: - Curate trusted sources. Start with a focused set of authoritative research, standards, and guidance. - Write neutral prompts. Keep instructions factual so outputs stay grounded in your sources. - Add AI disclaimers and a welcome note. Tell readers what the notebook covers and remind them that AI can make mistakes. - Review all output with human oversight. Have experts check every artifact before you share it. Start preparing today The quantum transition has already started, but preparing your organization doesn't have to begin with a 100-page whitepaper. Start by understanding the threat, then assess your cryptographic inventory and build a migration roadmap. You can get started with the Prepare for Post-Quantum Cryptography Gemini Notebook and share it with your team today. To learn more about Google Cloud’s approach to PQC, check out our dedicated Google Cloud PQC Resource Hub. In case you missed it Here are the latest updates, products, services, and resources from our security teams so far this month: - Securing enterprise agility in the machine-speed era: Learn what executives need to know about today’s threat landscape, how security teams should respond, and why Google AI Threat Defense can help. Read more. - Gemini 4 Argon available on Google Cloud: We’re making our new frontier model, Gemini 4 Argon, available for everyone on Google Cloud. Here’s how it can help boost the defender’s advantage. Read more. - Android's next-gen enclave for on-device AI: Learn about Android’s enclave architecture for personalized on-device AI experiences. Read more. - The Wiz Red Agent caught a Fortune 500 firm’s data exposure that other tools missed: Using an attacker’s mindset, the Red Agent found a public page exposing sensitive data in minutes. Read more. - Chrome's response to recent ccTLD registry hijacks: Following recent .gh, .sl, and .as ccTLD domain hijacks, Chrome immediately blocked unauthorized HTTPS certificates via CRLSets to protect users automatically. Read more. - Wiz Blue Agent POV: Investigating data theft across AWS and GitHub: See how the Blue Agent investigated a multi-platform attack in minutes, following evidence across AWS and GitHub to uncover compromised credentials, stolen source code, and custom data exfiltration tooling. Read more. - Introducing Wiz AI SAST: Application security that understands you: Find, validate, and fix complex business logic flaws with an AI code scanner backed by Wiz Research, operationalized in your existing security program. Read more. - Introducing WizOS Helm Charts to secure the Kubernetes supply chain: WizOS Helm Charts can help eliminate hidden CI/CD risks and unmaintained dependencies with hardened, signed, and CVE-scanned charts for Kubernetes. Read more. - What’s new in Wiz Service Catalog: Smarter discovery, governance, and service-level context can help build your service catalog faster, keep service context current, and give teams a clearer path from cloud risk to accountability. Read more. Please visit the Google Cloud blog for more security stories published this month. Threat Intelligence news - Vulnerability discovery and exploitation trends in the AI era: To counter the increased risk from rapid vulnerability discovery and exploitation, organizations should transition from unprioritized mass-patching to threat-intelligence-driven triage, combining targeted edge-defense with automated, agentic remediation. Read more. - Defending against active exploitation of Citrix NetScaler ADC and Gateway appliances: Mandiant Consulting and Google Threat Intelligence Group (GTIG) identified active, in-the-wild exploitation of a zero-day vulnerability affecting Citrix NetScaler ADC and NetScaler Gateway appliances. Here’s our containment and remediation guidance. Read more. - ShinyHunters renewed mass exploitation campaign targeting Oracle PeopleSoft: Mandiant and Google Threat Intelligence Group (GTIG) have identified renewed mass exploitation of CVE-2026-35273 by UNC6240 (ShinyHunters), along with expanded global targeting across multiple sectors. Read more. - Proactively defend by hardening code pipelines and CI/CD infrastructure: Check out our actionable blueprint for software and platform architects designed to safeguard the software supply chain against threat vectors that are actively being exploited, third-party risks, and architectural vulnerabilities throughout the entire software development lifecycle. Read more. Please visit the Google Cloud blog for more threat intelligence stories published this month. Now hear this: Podcasts from Google Cloud - Cloud Security Podcast: Patching browsers with AI, agents, Rust, and your tabs: Jasika Bawa and Doug Turner of Chrome Security explore how Google Chrome now uses AI agents to autonomously identify and patch security vulnerabilities at an unprecedented scale, significantly accelerating the browser's update cadence. Listen here. - Cloud Security Podcast: All about Project Atlas, Wiz's AI vulnerability research: Nir Orfeld, head of vulnerability research, Wiz, discusses how his team uses multi-agent AI systems for discovering high-impact zero-day vulnerabilities in cloud infrastructure. Listen here. - Cloud Security Podcast: How Google eliminates classes of vulnerabilities at scale: How do you build the foundations for a secure Google-scale enterprise that stays secure even if an AI is writing the code and nobody has time to review it? Christoph Kern, principal security engineer, Google, explores what secure-by-design really means in the AI era. Listen here. To have our Cloud CISO Perspectives post delivered twice a month to your inbox, sign up for our newsletter. We’ll be back in a few weeks with more security-related updates from Google Cloud.