Executive briefing · 2026

Quantum re-encryption mandates

A briefing for CTOs and CIOs on the federal post-quantum deadlines, the agent control plane and board oversight

John Fisher · 2026

For US federal agencies, and soon for federal contractors, the move to post-quantum cryptography (PQC) now has compliance deadlines.^1,2 Federal law and executive orders require agencies to replace quantum-vulnerable public-key algorithms, such as RSA and elliptic-curve cryptography, with quantum-resistant ones, and critical infrastructure operators are being helped, though not yet required, to plan the same move.^3,1 This briefing also covers research on corporate readiness, what the deadlines mean for the agent control plane, and how AI is shortening the time from a cryptographic weakness to a working attack.

1. Federal policy beyond NSM-10

White House National Security Memorandum 10 (NSM-10) set the first federal strategy for post-quantum readiness in May 2022, with a goal of mitigating as much quantum risk as feasible by 2035, and required agencies to inventory vulnerable systems.⁴ The instrument that now governs federal systems is Executive Order 14412, “Securing the Nation Against Advanced Cryptographic Attacks,” signed on June 22, 2026 and implemented through OMB Memorandum M-26-15.^1,2 It builds on the post-quantum standards that the National Institute of Standards and Technology (NIST) released on August 13, 2024: FIPS 203 (ML-KEM) for key establishment, and FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA) for digital signatures.⁵

2. The harvest-now, decrypt-later threat

The harvest-now, decrypt-later (HNDL) threat is the reason to fund PQC now. US government sources warn that adversaries, possibly including state-sponsored groups, may already be intercepting and storing high-value encrypted enterprise traffic.¹ Classical computers cannot decrypt it, but it costs little to keep, and it can be decrypted once a cryptanalytically relevant quantum computer (CRQC) is built. Any data that must stay confidential into the 2030s is therefore already at risk if it is captured today under classical public-key cryptography alone.¹

3. Compliance deadlines and milestones

Executive Order 14412 of June 22, 2026 and OMB Memorandum M-26-15 set deadlines for federal high-value assets and high-impact systems, excluding National Security Systems.^1,2 The order also directs the FAR Council to propose, within 180 days, a rule extending the requirements to covered federal contractors.^1,6

4. Supply chain effects and the agent control plane

The deadlines bind federal agencies now, and covered contractors will be bound once the FAR rule is final.^1,2 That rule would require covered contractors to comply with NIST’s standards, including the post-quantum algorithms, by December 31, 2030, but by mid-October 2026 none had been proposed, and the order does not define covered contractors.^1,6 Enterprises that sell software, cloud infrastructure (SaaS, PaaS or IaaS) or managed services to the US government should plan for the 2030 date. Which providers are covered, and how they show compliance, will be settled in the rulemaking.

The agent control plane belongs early in the inventory and the migration. Agents exchange instructions and data with tools, models and other agents across clouds and services, over encrypted connections such as TLS. Any of that traffic protected only by classical key exchange can be recorded now and decrypted later, and NIST expects key establishment to move first, particularly in interactive protocols such as TLS.⁸ OMB’s memorandum already expects infrastructure that terminates TLS to support post-quantum key exchange, and API gateways and application workloads to issue and validate post-quantum-signed tokens.² Hybrid key exchange, which adds ML-KEM to today’s elliptic-curve exchange, is on by default in major browsers and common TLS libraries, yet in early 2026 only about one in ten origin servers could use it.⁹ The server-to-server traffic that agents generate therefore lags behind browser traffic. Research on AI infrastructure by the Cloud Security Alliance recommends upgrading the TLS between services in agentic architectures, starting with hybrid key exchange.¹⁰

5. Audits, cryptographic discovery and board action

Boards should ask to see a maintained inventory of where cryptography is used and a record of migration progress, and the action plan they oversee runs in four stages.^11,12

1. Inventory. Scan applications, data stores, APIs and agent traffic endpoints to find where asymmetric encryption protects data today.
2. Prioritize. Secure the most critical business functions, high-value financial transactions and long-lived data first.
3. Migrate in phases. Adopt the NIST ML-KEM and ML-DSA standards,⁵ and build crypto-agility into API gateways and cloud boundary controls, so that algorithms can be swapped without changing core code.
4. Govern. Treat quantum readiness as an enterprise-wide program with formal board oversight and cross-functional coordination, built into governance, risk and compliance processes.^11,12 Name a migration lead and report progress to the board on a regular cadence, for example quarterly.

6. How AI shortens the path to cryptanalysis

CIOs and CTOs should not count on years of slack, because AI is shortening the time between finding a cryptographic weakness and exploiting it.

In July 2026, Anthropic reported that its Claude Mythos Preview model, working largely autonomously, found new mathematical attacks on a weakened, seven-round version of the Advanced Encryption Standard (AES) and on HAWK, a candidate post-quantum signature scheme still under NIST evaluation.^13,14 The AES attack is 200 to 800 times faster than the best earlier human-developed attack on that weakened cipher, though it remains far from practical.¹³

Anthropic stated that these findings do not threaten the encryption standards deployed today.^13,14 In separate tests in June 2026, the same model turned newly patched software flaws into working exploits within hours, work that has historically taken days to weeks.^15,16

7. Governance gaps

Corporate readiness is low, and that is a regulatory and operational risk. A 2026 board discussion guide in the Director’s Handbook on Cyber-Risk Oversight, published by the National Association of Corporate Directors and the Internet Security Alliance, cites Bain research finding that roughly 90% of companies are unprepared for quantum threats, with most executives reporting no plan and no budget for the transition.^12,11 It also cites an ISACA study finding that only 4% of organizations have a defined quantum strategy.¹²

CIOs and CTOs who start cryptographic discovery now can make quantum readiness a point of difference, and part of the case that their systems can be trusted.

Endnotes

1. The White House, “Securing the Nation Against Advanced Cryptographic Attacks,” Executive Order 14412 of June 22, 2026, 91 Fed. Reg. 38483 (June 25, 2026). https://www.federalregister.gov/documents/2026/06/25/2026-12909/securing-the-nation-against-advanced-cryptographic-attacks https://www.whitehouse.gov/presidential-actions/2026/06/securing-the-nation-against-advanced-cryptographic-attacks/
2. Russell T. Vought, “Execution of the Migration to Post-Quantum Cryptography,” Office of Management and Budget Memorandum M-26-15, June 24, 2026. https://www.whitehouse.gov/wp-content/uploads/2026/06/M-26-15-Execution-of-the-Migration-to-Post-Quantum-Cryptography.pdf
3. Quantum Computing Cybersecurity Preparedness Act, Public Law 117-260, December 21, 2022. https://www.govinfo.gov/app/details/PLAW-117publ260
4. The White House, “Promoting United States Leadership in Quantum Computing While Mitigating Risks to Vulnerable Cryptographic Systems,” National Security Memorandum 10, May 4, 2022. https://www.govinfo.gov/content/pkg/DCPD-202200355/html/DCPD-202200355.htm
5. National Institute of Standards and Technology, “NIST releases first 3 finalized post-quantum encryption standards,” August 13, 2024. https://www.nist.gov/news-events/news/2024/08/nist-releases-first-3-finalized-post-quantum-encryption-standards
6. Kurt Sanger and Nathalina A. Hudson, “Post-quantum cryptography: 2026 requirements for federal contractors, defense industrial base subcontractors, technology vendors and regulated industries,” Buchanan Ingersoll & Rooney (via Mondaq), September 21, 2026. https://www.mondaq.com/unitedstates/cybersecurity/1845034/post-quantum-cryptography-2026-requirements-for-federal-contractors-defense-industrial-base-subcontractors-technology-vendors-and-regulated-industries
7. National Security Agency, “The Commercial National Security Algorithm Suite 2.0 and Quantum Computing FAQ,” version 2.1, December 2024. https://media.defense.gov/2022/Sep/07/2003071836/-1/-1/0/CSI_CNSA_2.0_FAQ_.PDF
8. Dustin Moody, Ray Perlner, Andrew Regenscheid, Angela Robinson, and David Cooper, “Transition to Post-Quantum Cryptography Standards,” NIST IR 8547 (initial public draft), National Institute of Standards and Technology, November 12, 2024. https://csrc.nist.gov/pubs/ir/8547/ipd
9. Bas Westerbaan, “State of the post-quantum Internet in 2025,” Cloudflare, October 28, 2025; see also Cloudflare, “Bringing more transparency to post-quantum usage, encrypted messaging, and routing security,” February 27, 2026. https://blog.cloudflare.com/pq-2025/ https://blog.cloudflare.com/radar-origin-pq-key-transparency-aspa/
10. Cloud Security Alliance AI Safety Initiative, “Harvest now, decrypt later: Quantum risk to AI infrastructure,” May 18, 2026. https://labs.cloudsecurityalliance.org/research/ai-infrastructure-post-quantum-harvest-now-decrypt-later-v1/
11. Syed Ali, Frank Ford, Mark Leggate, and Alexandra Juegelt, “How businesses can prepare for post-quantum cybersecurity threats,” Bain & Company, January 20, 2026. https://www.bain.com/insights/how-businesses-can-prepare-for-post-quantum-cybersecurity-threats/
12. Gregory Touhill and Larry Clinton, “Board discussion guide on quantum computing,” Director’s Handbook on Cyber-Risk Oversight, National Association of Corporate Directors and Internet Security Alliance, 2026. https://isalliance.org/wp-content/uploads/2026/06/2026_Directors-Handbook-Cyber-Risk_QuantumComputing.pdf
13. Anthropic, “Discovering cryptographic weaknesses with Claude,” July 28, 2026. https://www.anthropic.com/research/discovering-cryptographic-weaknesses
14. Dustin Volz, “Anthropic AI model finds flaws in tough-to-crack encryption algorithms,” The New York Times, July 28, 2026. https://www.nytimes.com/2026/07/28/us/politics/anthropic-ai-encryption-security-aes.html
15. Anthropic, “Measuring LLMs’ impact on N-day exploits,” June 8, 2026. https://www.anthropic.com/research/n-days
16. Casey Charrier and Robert Weiner, “How low can you go? An analysis of 2023 time-to-exploit trends,” Google Cloud (Mandiant), October 15, 2024. https://cloud.google.com/blog/topics/threat-intelligence/time-to-exploit-trends-2023

Notices and disclosures

Copyright and license. © 2026 John Fisher. This briefing is licensed under the Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International License (CC BY-NC-ND 4.0), https://creativecommons.org/licenses/by-nc-nd/4.0/. You may copy and share it, in whole or in part, without changes and for non-commercial purposes, if you credit John Fisher and link to the license. Suggested credit: John Fisher, Executive Briefing: Quantum Re-Encryption Mandates (2026), CC BY-NC-ND 4.0. The license covers John Fisher’s own text and figures; it does not cover trademarks, or the quotations, data and other material of the sources cited, which belong to their owners.

Disclosure. John Fisher works for Salesforce. He wrote this briefing independently, on his own time and not as part of his work at Salesforce, using only public information. The views in it are his own, not those of Salesforce or any other company named, and it is not sponsored or endorsed by Salesforce or any of them.

Trademarks. Salesforce, MuleSoft and Informatica are trademarks of Salesforce, Inc. or its affiliates. Google and Google Cloud are trademarks of Google LLC. Anthropic and Claude are trademarks of Anthropic, PBC. Cloudflare is a trademark of Cloudflare, Inc. Other product, company and organization names may be trademarks of their respective owners. Names are used only to identify the products, services, standards and organizations discussed; their use does not imply endorsement or sponsorship by any of them, or any affiliation beyond the employment disclosed above, and citing a research firm, publisher, standards body or regulator does not mean it reviewed or endorses this briefing.

Sources and quotations. Statistics, findings and short quotations from other publications remain their owners’ work; they are cited for commentary and research, and each source is listed in the endnotes. Links were checked when this edition was prepared and may change.

Regulatory and technical information. Deadlines, standards and research findings are based on public sources checked in September 2026. They change, so check the current text of each order, memorandum and standard before acting on it.

Not professional advice. This briefing is general information to inform executive planning. It is not legal, regulatory, compliance, financial or investment advice, or a security assessment of any organization; seek qualified advice before acting on those matters. It is provided as is, without warranty of any kind, and to the extent the law allows, John Fisher is not liable for any loss arising from its use.

About John Fisher

I’m John Fisher. At Salesforce, I help enterprises architect the data foundation that AI depends on: MuleSoft for integration and APIs, Informatica for data management, and the MCP and A2A protocols that connect agents to tools, data and each other. Before Salesforce, I spent fourteen years at TIBCO leading solution engineering for enterprise accounts. Across both companies, my work has sat where enterprise architecture, integration and data meet business strategy.

I’m also a statistician. I hold a master’s in computer science and mathematics from Drexel University and a master’s in applied statistics and data science from West Chester University of Pennsylvania. At the West Chester Statistical Institute, I lead the statistical analysis for research teams publishing peer-reviewed studies. And I’m building Aethos, an open-source, AI-first programming language for data cleaning, machine learning and AI.

My writing is where I work through what happens when AI agents move past experiments and start acting across real enterprise systems. The questions that interest me most are architectural: how an agent proves who it is, what policy decides what it may reach, how its cost is measured and controlled, what evidence it leaves behind, how agents built on different platforms work together, and what it takes to run all of that at scale.

Some of what I write names Salesforce, MuleSoft or Informatica technology. It’s the technology I know most deeply, so it’s often the quickest way to make an idea concrete. I use it as one example of a broader pattern, not as the only answer, and the target architectures I start from are vendor-neutral by design.

The views here are my own, drawn from public information, and they don’t represent Salesforce. Some of these ideas are settled; others are still taking shape, and I expect to revise them as the technology and the standards change. If you see things differently, or have seen something work in practice, I’d like to hear from you on LinkedIn: linkedin.com/in/johnrfisher.