G7 and CISA: The Quantum Threat Is Here, Time to Act Is Running Out

The G7 Cyber Security Working Group and the U.S. CISA published a joint advisory on September 3, 2026, that upends the post-quantum cryptography timeline. The body urges governments and organizations to begin migration immediately, not when quantum computers capable of breaking RSA and elliptic curves exist. The radical shift lies in the threat paradigm: the "harvest now, decrypt later" technique allows attackers to collect encrypted data today for decryption in the future, making the risk current despite the absence of operational quantum hardware.

The Document That Moves the Clock Forward

The advisory was prepared in June 2026 for the G7 Summit in France, according to CyberScoop. The report lists seven signatories and represents the first coordinated G7-level position on cryptographic migration. The Record, which reported the news on September 4, 2026, quotes the warning verbatim: "This means that organizations may already be exposed to the threat today."

The text states that attackers equipped with quantum technology could impersonate trusted entities, forge data, compromise equipment, or access confidential information. This is not a hypothetical scenario: the advisory classifies it as an economic and business risk, not merely a cryptographic one.

"can no longer afford to postpone" — G7 Cybersecurity Working Group report, September 2026

Why 2035 Became Too Late

The timeline has compressed rapidly. The UK published a roadmap in 2025 setting PQC transition completion for 2035, with banking-finance and telecommunications as early adopters. The acceleration came from Washington: President Trump signed two executive orders in June 2026 advancing government systems migration from 2035 to 2030.

CyberScoop reports that Google and other companies have chosen 2029 as their own transition date. The convergence of these choices creates a cascading effect on the supply chain: vendors without PQC roadmaps risk exclusion from public and private contracts.

The G7 advisory explicitly acknowledges that "The quantum threat remains off the radar for many organizations and not properly resourced, with other security concerns taking precedence." The sentence describes an attention gap the document aims to close with multilateral political pressure.

Standards Already Exist, the Problem Is Finding Them in Code

NIST finalized the first three foundational standards in August 2024: FIPS 203 (ML-KEM for key encapsulation), FIPS 204 (ML-DSA for digital signatures), and FIPS 205 (SLH-DSA, stateless digital signatures). The algorithms are available, but migration requires a complete cryptographic inventory that many organizations have never undertaken.

Technical complexity emerges clearly in the Microsoft case. According to Windows Forum, the company has warned developers and administrators that the Windows code-signing infrastructure is changing certificates: transition to RSA-3072/SHA-384 in 2026, with PQC signing transition in 2027. Windows 11 24H2 and Server 2025 expose hybrid TLS PQC groups in preview, disabled by default.

The critical date is October 19, 2026, the expiration of the Windows Production PCA 2011 certificate. For administrators, this transition entails compatibility issues with certificate pinning and requires prior verification of trust chains.

The Bottleneck Isn't the Algorithm, It's the Inventory

The most relevant angle for organizations is the nature of the problem. Cryptographic research has solved the algorithmic part, but PQC migration is a procurement and supply-chain crisis. RSA and elliptic curves are embedded in firmware, HSMs, legacy applications, and third-party libraries often undocumented.

The G7 advisory explicitly requires treating the quantum threat as "an economic and business risk, and not merely a cryptographic risk." This conceptual shift has concrete consequences for budgets, cyber insurance, and contracts with vendors that have not published migration roadmaps.

The document specifies that the transition must cover "all sectors, not just critical infrastructure," expanding the perimeter of responsibility beyond traditional essential infrastructure.

What to Do Now

• Launch a complete cryptographic inventory: identify all RSA, elliptic curve, and TLS protocol implementations across technology assets, including firmware and legacy systems no longer actively maintained.
• Plan hybrid PQ/T deployment: enable hybrid PQC groups in test environments before production transition, verifying compatibility with clients and third-party systems.
• Verify critical vendor roadmaps: request official documentation on support timelines for ML-KEM, ML-DSA, and SLH-DSA, with particular attention to HSMs, VPNs, and code-signing systems.
• Monitor Microsoft's 2026-2027 deadlines: test the Windows trust chain with new RSA-3072/SHA-384 certificates and prepare for PQC signing transition before the 2027 deadline.

A Governance Question More Than a Lab Question

The September 3, 2026 G7-CISA advisory marks the passage of post-quantum cryptography from conference topic to corporate governance object. Organizations that have ignored the subject so far lack not algorithms, but visibility into where vulnerable cryptography resides in their systems.

The compression of timelines — 2029 for Google, 2030 for the U.S. administration, 2027 for Microsoft code-signing — creates a transition window requiring procurement decisions already in 2026. The risk is no longer theoretical: data collected today with passive interception techniques will remain readable for anyone with access to a quantum computer in the next decade. The only remaining uncertainty is who, between attackers and defenders, will arrive prepared at that moment.

Sources

• https://therecord.media/g7-urges-organizations-to-prepare-for-quantum-threats
• https://cyberscoop.com/g7-quantum-computing-encryption-warning/
• https://windowsforum.com/security-alerts.84/cisa-g7-urge-pqc-inventory-for-windows-2027-signing.443989/
• https://www.cyber.gc.ca/en/news-events/g7-cybersecurity-working-group-statement-preparing-post-quantum-cryptography-migration
• https://quantumzeitgeist.com/quantum-resistant-encryption-anssi-leads-push/
• https://www.cisa.gov/topics/risk-management/quantum

Information verified against cited sources and current as of publication.

Sources

• https://thehackernews.com/2026/08/snowflake-github-actions-flaw-lets.html
• https://www.cve.org/CVERecord?id=CVE-2023-49105
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• https://thehackernews.com/
• https://thehackernews.com/p/upcoming-hacker-news-webinars.html