Google Cloud launches PQC notebook for security chiefs

Google Cloud has launched a public Gemini Notebook on post-quantum cryptography, designed to help Chief Information Security Officers, executives and policymakers prepare for a shift to new cryptographic standards.

The notebook brings together Google's research, engineering material and migration guidance on post-quantum cryptography, or PQC, in a single interactive resource. Users can ask questions, listen to an audio overview, use flashcards and view a visual explanation of the quantum threat.

The release comes as technology groups and security teams assess how quickly quantum computing could undermine widely used public-key encryption systems. According to Google's research, breaking ECDLP-256 and RSA-2048 encryption would require about 500,000 and 1 million noisy qubits respectively.

That feeds into broader concern over so-called store-now-decrypt-later attacks, in which attackers collect encrypted information today and try to unlock it once quantum machines are powerful enough. Data seen as especially at risk if it must remain secret for many years includes health records, financial information, intellectual property and government material.

Stephanie Kiel, Head of Cloud Security Policy, Government Affairs and Public Policy at Google Cloud, set out the rationale for the tool in a note accompanying the launch.

"Post-quantum cryptography (PQC) is one of the most urgent security shifts of the decade - and one of the easiest to tune out. For security leaders and policymakers, the research is dense, scattered across papers and engineering blogs, and can be challenging to turn into action," Kiel said.

The notebook is built on selected internal material covering quantum computing, industry standards, Google's own deployments and recent research. It also carries a warning that generative AI systems can make mistakes and that responses should be checked against the cited source material.

Migration pressure

Google has argued that organisations should begin preparing before a cryptographically relevant quantum computer becomes available. It has published a migration timeline that targets a move to PQC by 2029 and is urging other organisations to consider a similar timeframe.

Past cryptographic transitions have often taken years, making early planning a central issue for security teams. Google pointed to earlier migrations, including the move away from SHA-1 and changes to TLS, as evidence that replacing deeply embedded cryptography can take a decade or longer.

For security leaders, the first steps should include identifying vulnerable cryptography across the organisation, ranking the most exposed data and systems, assessing the broader operational effects of migration and building greater flexibility into cryptographic planning.

Kiel also addressed the policy implications.

"As the technology advances, policymakers should consider urging critical infrastructure owners and operators to recognize condensed timelines, and build PQC readiness into existing risk mitigation plans," Kiel said.

"We also recommend governments engage with global counterparts to promote a harmonized approach to standards development, and include technical and security experts in the building of policy and regulatory requirements focused on quantum safety," she added.

Existing work

Google said it has already introduced post-quantum measures across several parts of its technology estate. These include hybrid Kyber and ML-KEM key exchange for Chrome traffic, PQC work in Android, quantum-safe digital signatures in Cloud KMS and the use of PQC for internal communications.

The company also pointed to work beyond its own services. Wiz offers a PQC readiness scanner across code, cloud and runtime environments, while Google co-founded the Post-Quantum Cryptography Alliance at the Linux Foundation with Amazon Web Services, Cisco, IBM and NVIDIA to support open-source tools including Open Quantum Safe.

The notebook is also presented as a model that other organisations could replicate internally. Teams creating similar resources should start with trusted source material, use neutral prompts, warn users about AI errors and ensure human experts review all outputs before wider sharing.

The launch reflects a broader shift in how cybersecurity teams are approaching quantum risk. Rather than treating it as a distant research question, suppliers and large users are beginning to frame it as an inventory, migration and governance issue.

Google summed up that shift in its guidance to customers and security teams: "The quantum transition has already started, but preparing your organization doesn't have to begin with a 100-page whitepaper. Start by understanding the threat, then assess your cryptographic inventory and build a migration roadmap."