Cybersecurity policy has long treated data protection as a systems problem: encrypt the database, secure the network, restrict access, monitor activity, and keep attackers out. All of that still matters. But those defenses have a major blind spot. Once inside the wall the data itself is at risk. Every time data is used, copied, or moved, the risk that a malicious actor will steal and expose the data significantly increases. Policymakers need to consider a tested method that reduces the value of sensitive information if it compromised.

Hospitals, banks, defense contractors and government agencies cannot operate on permanently unreadable data. They need to process records, share information, analyze intelligence and prepare data for artificial intelligence models. The reality is data moves. It travels through cloud platforms, vendors, backups, analytics tools, payment processors, software services, AI pipelines, and partner systems. Every handoff creates another place where information can be copied, cached, logged, and indexed, and another place where it can be mishandled or stolen.

This is the gap encryption does not close. Encryption protects data when it is stored or traveling, only partially protects it when it is transmitted, and does not protect data at all when it is processed. Once an authorized system decrypts information so someone can use it, the data becomes readable again. The defenses have not reduced the sensitivity of the information. If an adversary steals unencrypted data — or decrypts stolen data at a later date when quantum computers are readily available — the adversary now has the sensitive information.

All told, encryption is essential, but it’s also not enough. Washington needs to take that seriously.

One promising answer is vaultless, keyless pseudonymization. The phrase sounds technical, but the idea is straightforward: replace sensitive values with realistic substitutes before the data spreads.

A name becomes another name. A Social Security number becomes another valid-looking Social Security number. A payment card number, patient identifier, or address keeps the same basic format. Databases, billing platforms, and analytics tools can still process the record because it looks structurally familiar. But the identity is no longer exposed to every vendor, platform, or downstream user that touches it.

That is a different mindset from the one that dominates cybersecurity policy. We spend enormous energy trying to protect every system that might handle sensitive data. We should keep doing that. But in a world of cloud services, supply chains and AI systems that retain information in hard-to-track ways, perfect control over every downstream system is more difficult than ever. The question is no longer only about securing systems but also about making exposed or stolen data less useful to threat actors if they acquire it through any means.

Traditional tokenization models swap out real values for “token” terms and store original values — like names, passwords and credit card numbers — in a central vault. That can reduce exposure, but it creates an obvious target. If the vault itself is accessed, the sensitive values behind the tokens may be exposed.

Vaultless, keyless pseudonymization is designed to remove the single point of failure created by a central vault or master key. In a model assessed by our Transformative Cyber Innovation Lab at the Foundation for Defense of Democracies, the protected data could be restored only when the required parties authorized it under controlled conditions; no one party could reverse the pseudonymized tokens on its own.

The test showed the approach could preserve the format of sensitive contents while limiting access to the real values behind them. Unauthorized restoration attempts failed and were logged. Multi-party stakeholder authorized restoration returned the correct values. Intercepted tokens did not reveal the original data value. And the system contained a unique ability to revoke access to the token — regardless of where it exist — by cutting off downstream re-identification.

The assessment showed promise that sensitive data could remain useful for legitimate work while becoming far less valuable to attackers and unauthorized users. Using vaultless, keyless pseudonymization can significantly reduce the impact of a data breach or ransomware attack if the stolen or exposed data has no intrinsic value. 

The federal government should evaluate this methodology to assess what is required to make it work in live, real-world operations. Right now, agencies may be inclined to ignore this type of technology simply because it does not fit neatly into existing categories for encryption, access control, or other cybersecurity processes. This is a mistake.   

The National Institute of Standards and Technology should evaluate what the technology does, what risks it reduces, what new dependencies it introduces, and what evidence is required before it can be trusted in practice. NSA should examine the same questions for classified networks. 

Procurement regulations should also get smarter. Vendors claiming tokenization, pseudonymization, data-layer protection or quantum-resilient properties should have to explain whether raw data enters their infrastructure, whether any token-to-source mapping exists, who can restore original values and what independent review has been completed.

Cybersecurity policy has spent decades trying to keep attackers out. That work will never end. But we need this second objective: make sensitive data less damaging when it inevitably escapes. 

The post Encryption isn’t enough to protect data wherever it goes  appeared first on CyberScoop.

Opaque Systems has developed technology that lets AI systems use sensitive data while keeping it protected by the underlying hardware.

The post Anthropic Acquires Confidential AI Startup Opaque Systems appeared first on SecurityWeek.

IonQ announced Monday that it will acquire Elisity, a zero-trust network security firm, in an all-stock transaction valued at up to $1.3 billion that folds enterprise access control into the quantum computing company’s expanding cybersecurity business.

Elisity, founded in 2019, sells a software policy layer that governs which users, devices, workloads and AI agents can communicate across a network, independent of the underlying network technology. The California-based company reports more than 100 global deployments and says revenue and customer counts have doubled year over year, with no churn among deployed customers.

Maryland-based IonQ, whose core business is quantum computing, has been building a security arm around post-quantum cryptography and quantum key distribution, technologies intended to replace or supplement encryption that future quantum computers may be able to break. 

The combination addresses what the companies describe as a two-front problem: conventional attacks that operate at machine speed, and the risk that encrypted data could be retained until quantum decryption becomes practical, a concept known as “harvest now, decrypt later.”

“Our customers need to contain attacks today, put AI to work safely, and prepare for quantum risk,” Elisity CEO James Winebrenner wrote in a blog post announcing the deal. 

IonQ Chairman and CEO Niccolo de Masi struck a more urgent note in a release announcing the deal: “Q-Day is coming much faster than predicted,” he said, referencing the point at which quantum computers could break current encryption technology. 

Both governments and the technology industry have accelerated their timelines to adopt post-quantum cryptography over the past few years. This is partly due to a belief among executives in the U.S. quantum sector that Chinese scientists and labs have achieved breakthroughs across several different fields of quantum computing over the past two years.

The Trump administration recently issued an executive order directing federal agencies to boost the domestic quantum industry and move up internal timelines for migrating to PQC encryption from 2035 to 2030. Google, a potential industry bellwether, and other companies have opted to move their own migration timelines to 2029.

Winebrenner told CyberScoop those deadlines are easier to set than to meet. Enterprises will hace to start with identifying the information and operations that need protecting, then mapping the identities, communications and cryptographic dependencies that support them.

“You won’t replace every legacy system at once,” he said. The approach is to migrate what can be migrated, test interoperability and operational impact, and tightly control access around systems that need more time. Segmentation helps contain threats, he added, but does not replace the cryptographic upgrades.

Elisity’s planned role in that transition is to connect identity data to cryptographic decision-making. Its roadmap would extend its IdentityGraph product with cryptographic inventory and risk information, allowing customers to rank post-quantum upgrades by business risk.

The deal also reflects how AI agents are reshaping network security. Elisity’s platform already treats AI agents and other non-human identities as subjects of access policy, and the company has joined the Open Secure AI Alliance with priorities that include least-privilege rules for sanctioned agents, containment of agentic threats and control of unsanctioned AI.

Winebrenner identified the hardest unresolved problem in agent control as maintaining trustworthy identity and authorization as an agent’s task, tools and delegated permissions change. “Knowing an agent is approved is only the beginning,” he said. “You need to understand whose authority it is exercising, what it needs to reach right now and when that access should end.” His prescription is least privilege down to the task: “An AI agent should have access only to the resources its task requires, including when it interacts with older infrastructure.”

The deal is expected to close in the fourth quarter of 2026, subject to regulatory approval.

UPDATE: 10/12/2026, 4:25 p.m.: This story has been updated with comments from Elisity CEO James Winebrenner.

The post IonQ to buy zero-trust security firm Elisity in deal valued at up to $1.3 billion appeared first on CyberScoop.

The country is consumed right now with debating artificial intelligence and whether increasingly powerful AI systems could escape human control. Those are valid concerns, but lawmakers are overlooking another technological threat: quantum computing. Unlike AI safety debates, this risk could render today’s encryption obsolete – compromising everything from emails to financial transactions to government communications and military systems.

Quantum computers harness unusual properties of quantum physics to solve certain problems far faster than conventional computers. That potential offers major scientific and economic advances. But a sufficiently powerful quantum computer could crack widely used forms of encryption protecting sensitive digital information globally.

This threat differs from AI safety concerns. Quantum computers won’t develop goals or outsmart humans. The risk is simple: extraordinarily fast quantum machines could break the mathematical “locks” securing data.

Researchers now believe breaking some encryption may require fewer resources than previously thought. This spring, Caltech spinout Oratomic published research suggesting a cryptographically relevant quantum computer could need dramatically fewer physical resources than earlier estimates. Google has accelerated its own preparations, setting 2029 as its target for transitioning to post-quantum cryptography.

To use a rough analogy, researchers are increasingly asking whether a task once thought to require every lightbulb in Chicago might instead be accomplished with the power needed for one office building. If a company like Google, with some of the world’s deepest quantum and cryptographic expertise, is preparing for 2029, Congress should treat that deadline seriously.

The federal government has begun responding. The National Security Agency has selected quantum-resistant algorithms for National Security Systems and is moving classified and other sensitive systems toward its CNSA 2.0 standards. In June, the White House accelerated the broader federal transition, directing high value federal systems to adopt post-quantum cryptography for key establishment by the end of 2030 and digital signatures by the end of 2031.

But some dangers exist now. Foreign adversaries can steal encrypted information today, store it, and wait until they possess the computing power to decrypt it later. Cybersecurity experts call this “harvest now, decrypt later.” The White House identified that threat in its June order. Intelligence reports, military communications, corporate secrets, financial information, and other data that must remain private for years face risk long before a quantum computer capable of decrypting it exists.

Congress has devoted enormous attention in recent years to AI and social media in recent years. The post-quantum cryptography transition demands equal urgency. Lawmakers must identify national vulnerabilities and coordinate the transition across all government agencies.

The intelligence community should conduct a comprehensive assessment of its exposure to quantum decryption, building on the work at NSA. The Defense Department should assess military networks, satellites, communications systems, and critical infrastructure, ensuring future systems can upgrade encryption without replacing entire platforms. Navy and Space Force, which depend on secure communications and undersea cables carrying much of the world’s data, must be included.

The transition cannot stop at the federal level.  States and localities need resources to protect election systems. Hospitals, banks, utilities, communications networks, and critical infrastructure rely on technology that may need to remain secure for decades. Congress should help them identify vulnerable systems and begin upgrades before a crisis forces the issue, while funding the research to maintain U.S. technological superiority.

No single technology will solve this permanently. Quantum-resistant encryption is essential, but the U.S. should develop additional security layers, including hardware-based protections and emerging physical or molecular authentication technologies. Defenses must evolve as computing power advances.

China is not standing still. Through my work on the Select Committee on the Strategic Competition Between the United States and the Chinese Communist Party, I have observed that America retains an enormous innovation advantage. However, the U.S.-China Economic and Security Review Commission has warned that Beijing is likely pursuing quantum capabilities that could threaten existing encryption. China’s 15th Five-Year Plan identifies quantum technology as a future industry, while three state-backed regional venture funds, totaling roughly $17.5 billion, include quantum among the strategic technologies they are intended to support. The amount specifically allocated to quantum has not been disclosed.

Waiting would be a mistake, regardless of China’s current quantum progress.

America has repeatedly recognized technological vulnerabilities too late. The nation was slow to understand how foreign adversaries could exploit social media and discovered critical computer system weaknesses only after foreign governments penetrated them. Congress should not repeat those mistakes.

No one knows exactly when quantum computers will become powerful enough to break today’s encryption. That uncertainty is not a reason to wait. America’s strength has always been in our ability to invent new technologies, master them, and use them to protect our country. Congress should make sure we do that before our encryption becomes vulnerable, not after.

The post Quantum computers could break today’s encryption. Washington needs to prepare now. appeared first on CyberScoop.

PUBLIC DEFENDER By Brian Livingston A new study says quantum computers now in development will enable hackers to steal bitcoins and other cryptocurrencies without knowing the passwords or even the names of the rightful owners. No quantum computers exist yet. But when they do, one estimate is that 32 percent of all bitcoins and a […]

A group of leading House Democrats introduced legislation Monday requiring the Cybersecurity and Infrastructure Security Agency to conduct an assessment of its workforce to determine whether it’s up to the task after the exit of around 1,000 employees during President Donald Trump’s second term.

The concept of a force structure assessment is more common in military branches, including one that Congress previously ordered for Cyber Command. The CISA Force Structure Assessment Act would order the agency to carry out a review of whether the agency still has the necessary personnel, training and certifications after budget cuts and other Trump-era departures.

“America’s cyber defenses are only as strong as the people behind them,” Rep. James Walkinshaw, the Virginia Democrat serving as lead sponsor of the bill, said in a news release. “As cyber threats grow more sophisticated and technologies like artificial intelligence and quantum computing reshape the threat landscape, Congress needs a clear accounting of whether CISA has the workforce, skills, and resources required to keep Americans safe and enable mission delivery. This legislation will identify critical gaps and give Congress concrete information to address them.”

Also sponsoring the bill are the top Democrat on the House Homeland Security Committee, Bennie Thompson of Mississippi, and the top Democrat on its cybersecurity subcommittee, Delia Ramirez, D-Ill.

Additional elements of the force structure assessmewould include a review of the security of federal IT systems and support for state and local governments; the risks posed by AI, quantum computing and other cutting edge technologies; CISA’s threat-hunting and incident response capabilities; support for critical infrastructure and operating technology, including CISA’s role as a sector risk management agency for a number of industry sectors; the operation of the Joint Cyber Defense Collaborative; and international cooperation.

Some lawmakers and other observers have worried those areas have been greatly impacted by staffing cuts, ultimately hurting CISA’s ability to carry out its core functions.

Ramirez dinged GOP lawmakers for “a lack of interest in safeguarding our nation’s cybersecurity and our residents’ civil rights and privacy” in going along with the CISA cuts and other developments at the Department of Homeland Security.

Lawmakers on both sides of the aisle have voiced concern about the scope of cuts at CISA, but Republicans have approved some of them while pushing back on others. CISA itself is currently seeking to hire hundreds of new personnel, even as its latest budget blueprint calls for yet more funding reductions.

“With Iran targeting our critical infrastructure and frontier AI models creating new cyber risks, we must ensure we have a cybersecurity workforce to counter these growing threats,” Thompson said. “After Trump has spent the past two years targeting and slashing CISA’s workforce, we need the agency to assess if it has [the] right personnel in place to fulfill its mission.”

National Cyber Director Sean Cairncross has discussed White House plans to develop a cybersecurity academy meant to consolidate and enhance existing federal cyber training and education programs, with the aim of addressing cyber workforce shortages. His office has reportedly drafted an executive order that would establish that academy.

The post Dems seek top-to-bottom assessment of CISA workforce appeared first on CyberScoop.

A new bipartisan Senate bill would require federal regulators to prepare the U.S. electric grid for cybersecurity threats from quantum computers and create a technical sandbox to study how the technology could impact  both information and operational technology systems.

The Quantum Grid Utility Assurance and Resilient Defense (Quantum-GUARD) Act, introduced by Sens. Mike Rounds, R-S.D., and Chris Coons, D-Del., would direct the Federal Regulatory Energy Commission when reviewing proposed reliability regulatory standards for electricity owners and operators under the Federal Power Act.

FERC updates its reliability standards to account for emerging cybersecurity concerns, and the legislation would expand those reviews to include the future threat of hacks from quantum computers.

The legislation also directs FERC to explore potential uses of post-quantum cryptography in IT and OT systems and “take such action the Commission determines to be appropriate based on that consideration.”

In a statement, Coons said quantum computing brings “new economic opportunities” along with “tremendous cybersecurity risks.”

“As the technology races forward and our adversaries continue to seek vulnerabilities in our critical systems, we need to pass the Quantum-GUARD Act to ensure our government is using every available tool to meet this threat,” said Coons.

The federal government has been an early adopter of post-quantum cryptography for its digital systems. The National Institute for Standards and Technology has worked with cryptographers to develop new “post-quantum” encryption algorithms that will be used by most governments and the private sector.

Under the Biden administration, most federal agencies were required to migrate their systems and data to “PQC” encryption by 2035. In June, an executive order from the Trump administration pushed that timeline up to 2030. 

Ali Shaikh, CEO of Graphiant, a networking infrastructure startup, told CyberScoop that the bill would represent a good start in terms of pushing greater adoption of quantum-resistant encryption, “the real work is upgrading infrastructure, not applications, ahead of the deadlines.”

Evgeny Gervis, CEO of SafeLogic, compared the energy sector’s challenges to previous efforts by FERC and industry to gain adoption at scale for other technological upgrades, like smart grid equipment. Among those challenges is prioritizing security upgrades in a sector where reliability is paramount.

“The highest priority for electric utilities will be preservation of integrity and availability, both services that are widely supported by legacy public key cryptographic controls that are quantum vulnerable,” said Gervis. “It is essential that quantum computers do not undermine the integrity and authenticity of SCADA communications or the software update process.“

The post Bipartisan Senate bill aims to prepare energy sector for Q-Day appeared first on CyberScoop.

One of the most difficult obstacles to overcome in the quantum race will be the supply chain, given how diffuse it is, a top White House official said Wednesday.

“Supply chain is one of the biggest challenges in my mind, and really, the challenge with the quantum supply chain is that quantum is not defined by a single hardware platform,” said Brad Blakestad, director of the National Quantum Coordination Office within the White House Office of Science and Technology Policy.

“If you look at the quantum computing technologies, the quantum sensing technologies, the networking — those are all different,” he said in a webinar hosted by Inside Cybersecurity and USTelecom. “And even within computing, there’s seven different modalities that use completely different components. So we have this not just one monolithic supply chain, but just a bunch of different supply chains that are kind of intertwined in various ways.”

Blakestad made his remarks a little more than a month after President Donald Trump signed two executive orders on quantum computing. He referenced proposed ways to address the supply chain challenge in one of the orders.

“The other major issue or challenge that we face right now is that we’re on the cusp of quantum exploding from a commercialization perspective, but we’re not quite there yet,” he said. “So there’s not the funding, the revenue coming from large-scale quantum companies at this point to really make the supply chain as robust as you would want. So thinking about it from the government perspective, it’s just [that] there are too many places that I would want to bolster and not enough funding to do it.”

Blakestad touted steps to help that along such as the government buying widgets from a company that makes them to certain specifications, or prize challenges.

The quantum supply chain isn’t just diffuse in the United States, an International Institute for Strategic Studies policy paper noted Wednesday. It’s “inherently international: no single country dominates the supply chain, whether specialised materials, cryogenic equipment, hardware, software, fabrication or algorithms,” the authors, Dongyoun Cho and Maria Shagina, wrote.

And a March report from the Center for a New American Security identified strengthening the quantum supply chain as pivotal to the United States seizing the benefits of the technology, citing gaps in the U.S. supply chain and reliance on foreign suppliers such as China and Russia. 

Supply chain wasn’t the only obstacle Blakestad mentioned as looming large.

“The encryption challenge is a real challenge, and we want to make sure that we are aware of when quantum computers will ultimately get to a scale that they start having these sorts of implications and move as quickly as we can,” he said. “So, just by owning the technologies, by owning the workforce, by making the United States the place that people want to come to be on the cutting edge of this technology, I think that kind of addresses both of those issues, and that’s what makes it so critical.”

Another difficulty is measuring progress, Blakestad said: “It’s also very, very hard to benchmark, and to know that you’re actually doing what you’re supposed to, what you are intending to do.”

The post Supply chain challenges loom large in quantum race, White House official says appeared first on CyberScoop.

Beau Bullock // Overview The traditional methodology of a remote attacker who has no preconceptions of a target network used to be fairly static. With organizations moving to “the cloud”, […]

The post Storm Chasing: How We Hacked Your Cloud appeared first on Black Hills Information Security, Inc..