Your agency's post-quantum cryptography roadmap looks impressive. You've inventoried systems using RSA and ECC, budgeted for algorithm replacements, and are tracking NIST post-quantum standardization.
Yet, you're still missing most of the quantum attack surface.
Focusing narrowly on cryptographic migration creates a dangerous blind spot. Quantum computing threatens federal operations in ways that won't show up in your PKI inventory or your FIPS 140-2 module list. These myths persist because they let agencies reduce an overwhelming threat to a manageable project plan. Reality is messier.
Myth 1: The Quantum Threat Is a Cryptography Problem
Reality: The quantum attack surface extends far beyond cryptographic systems prioritized for migration.
Quantum computing will break specific algorithms, but it will also accelerate attacks against systems not categorized as cryptographic targets. Consider optimization problems: quantum systems excel at solving complex constraint satisfaction problems exponentially faster than classical computers. Your network segmentation model, access control policies, and resource allocation algorithms all become optimization targets. An adversary with quantum capability can model your entire security architecture as a constraint problem and identify the weakest path through your defenses in hours instead of years.
This isn't theoretical. Your Risk Management Framework authorization boundary assumes certain computational limits on adversary capability. Those assumptions break when quantum systems can rapidly test millions of policy permutations to find gaps in your Role-Based Access Control implementation or identify the optimal sequence of low-privilege actions that escalate to system compromise.
Myth 2: You Can Wait Until NIST Finalizes Post-Quantum Standards
Reality: The data you're protecting today is already at risk from harvest-now-decrypt-later attacks, and your non-cryptographic vulnerabilities are accumulating technical debt.
Your NIST SP 800-53 controls assume adversaries can't store encrypted traffic for future decryption. That assumption died the moment quantum computing became a realistic capability. Every CUI transmission, every Federal Information Security Modernization Act-covered dataset, every encrypted backup you create today could be decrypted by a quantum-capable adversary in five to ten years.
But the timeline problem goes deeper. Your current security architecture makes decisions based on computational cost assumptions that quantum systems invalidate. You're building authentication flows, designing audit logging retention periods, and setting key rotation schedules based on classical computing constraints. Each of these decisions becomes technical debt the moment quantum capability arrives. You can't fix them all with a cryptographic library swap.
Myth 3: This Is an IT Security Problem
Reality: Quantum threats require enterprise risk management across mission functions, not just security controls updates.
Check your OMB Circular A-130 responsibilities. Information security isn't isolated from mission delivery, and quantum threats amplify that integration. When quantum computing changes the computational landscape, it affects every system that makes decisions under uncertainty or processes optimization problems.
Your agency's mission applications likely include resource scheduling, logistics optimization, financial modeling, or pattern recognition in large datasets. These aren't security systems, but they become quantum attack surfaces. An adversary with quantum capability can reverse-engineer your decision models, identify the inputs that produce desired outputs, or manipulate optimization results by understanding your algorithms better than you do.
This means your CIO can't solve quantum risk alone. Your mission owners need to understand which business processes rely on computational assumptions that quantum systems break. Your acquisition teams need to evaluate vendor systems for quantum-resistant architectures beyond just cryptographic modules. Your privacy officers need to reconsider what constitutes adequate de-identification when quantum systems can re-identify anonymized datasets orders of magnitude faster.
Myth 4: Your Supply Chain Risk Management Covers Quantum Threats
Reality: Your current supply chain assessments don't evaluate quantum-specific attack vectors in vendor systems.
You're already assessing vendor compliance with NIST SP 800-171 or FedRAMP baselines. You're reviewing their cryptographic implementations. But you're probably not asking: How do their machine learning models respond to quantum-accelerated adversarial attacks? What optimization algorithms do they use for resource allocation, and can those be manipulated by quantum-capable adversaries? How quickly could a quantum system reverse-engineer their proprietary algorithms from observed inputs and outputs?
Your DFARS 252.204-7012 flow-down requirements mandate specific security practices, but they're calibrated to classical computing threats. A vendor can fully comply with your contract requirements and still introduce quantum-vulnerable decision systems into your mission architecture. Their authentication might be quantum-resistant, but their fraud detection model might be trivially poisoned by a quantum-optimized attack.
Myth 5: You Can Build a Quantum-Resistant Perimeter
Reality: Quantum threats collapse the distinction between perimeter and insider threat models.
Your current security architecture separates external and internal threats. You invest heavily in perimeter controls, then apply lighter-weight monitoring inside the boundary. Quantum computing undermines this model by accelerating the adversary's ability to move laterally once inside.
Consider your Enterprise Mission Assurance Support Service authorization package. You've documented your security controls. You've defined your authorization boundary. You've assessed your residual risk. All of that analysis assumes an adversary inside your boundary still faces significant computational barriers to privilege escalation, lateral movement, and data exfiltration.
Quantum capability changes the math. An adversary who compromises a single low-privilege account can use quantum optimization to rapidly identify the sequence of actions that leads to domain administrator access. Your audit logging captures the activity, but your Security Technical Implementation Guide-compliant log analysis can't process the volume fast enough to detect the attack before it succeeds.
What to Do Instead
Start with threat modeling that includes quantum-accelerated attacks on non-cryptographic systems. For each mission-critical application, identify decision points that rely on computational complexity for security. Document optimization algorithms, machine learning models, and resource allocation systems as quantum attack surfaces.
Expand your Risk Management Framework assessment procedures to include quantum-specific threat scenarios. When you assess AC-3 (Access Enforcement) or AU-6 (Audit Review, Analysis, and Reporting), consider how quantum capability changes the adversary's ability to exploit gaps in your implementation.
Update your acquisition language. Your vendor assessments should ask specific questions about quantum-resistant architecture beyond cryptographic modules. Require vendors to document which algorithms and decision systems in their products rely on computational complexity assumptions.
Build cross-functional quantum risk teams now. Your CISO needs to work with mission owners, acquisition leads, and program managers to identify quantum attack surfaces across the enterprise. This isn't a project your security team can own alone.
The agencies that survive the quantum transition won't be the ones with the fastest crypto migration schedules. They'll be the ones who recognized that quantum computing changes the entire threat landscape, not just the encryption layer.
