GAO quantum report shows DC is taking quantum seriously

A recent federal report on the need for government agencies to prepare for a post-quantum future is the latest indication that the technology must be taken seriously.

The Government Accountability Office (GAO) report, “Quantum Computing: Federal Actions Needed to Prepare for Emerging Cyber Threat,” was initially filed in September 2025. A public, less sensitive version was released on October 6.

Andrew Hoog, co-founder of mobile app security company NowSecure, told IT Brew that the report’s recommendations for agencies are a strong case for preparing for (and securing) commercial quantum computing.

“Very large prime numbers are what literally underpin encryption today, and if you can bring a new type of computing that allows you to factor those large prime numbers, you crack the encryption,” Hoog said.

Accessibility. Now that commercial quantum is close to an accessible reality for many attackers, even bedroom hackers, post-quantum encryption is fast becoming a critical need for IT pros focused on securing valuable data. As attackers focus on the “harvest now, decrypt later” tactic—downloading vast tranches of information today for quantum-assisted decryption at some future date—it is a priority to proactively address the issue.

Preparing for quantum is important in large part because the technology’s evolution is moving rapidly. Last month, TieTechnology COO Mike Wehrs told IT Brew that IT pros need to be vigilant because “this stage of harvesting is not over.” Prioritization of data is key, he said.

“If this file were to be out in 2030, in 2035, would this be a problem for me or my business or for my customers?” Wehrs said, raising a future scenario that’s more inevitable than hypothetical. “If the answer is, ‘God, if that got out in 2035, it would still be a disaster,’ then that should be on your high priority list of things that you go and figure out how to lock down now.”

What to do. In the report’s recommendations, GAO told federal agencies to invest in encryption and establish data repositories. Ultimately, the office made 89 recommendations to 23 agencies—12 agencies fully agreed, two partially agreed, seven were neutral, and one rejected three of four directives.

Government agencies should take the issue seriously, Hoog said, and listen to GAO.

“There are so many threats and risks, this is one that’s incredibly important—because large data capture of internet traffic is easy to do, it’s being done,” Hoog said. “We should expect that nation state attackers are doing this, and so we have to think about the data that’s being put out there.”