Why quantum security must be on every CIO’s 2026 priority list

State chief information officers have placed big bets on artificial intelligence, cybersecurity and modernization in their Top 10 Policy and Technology Priorities for 2026 — but a silent, steadily growing threat is missing from the list: quantum security. 

As states modernize systems and expand digital services, many have delayed planning for the long-term impact of quantum decryption, viewing it as a distant concern. According to ISACA’s global Quantum Computing Pulse Poll, only 5% of the technology and cybersecurity professionals surveyed say quantum computing is a near-term planning priority. 

Yet 62% worry about developments in quantum computing. For state and local agencies — guardians of some of the nation’s most sensitive and interdependent infrastructure — that gap between worry and action is concerning.

At the federal level, the shift towards a post-quantum future is already underway. The Cybersecurity and Infrastructure Security Agency has launched its Post-Quantum Cryptography Initiative, the National Institute of Standards and Technology finalized its first set of post-quantum cryptographic standards, and lawmakers recently re-introduced the National Quantum Initiative Reauthorization Act. 

Together, these actions signal a national acknowledgment that quantum risk is no longer theoretical; they also underscore something else: federal momentum won’t automatically protect state and local systems.

Without strategies in place, disruption to critical infrastructure systems — power grids, water systems, emergency services and more — could result in cascading operational failures.

The Quantum Threat

The quantum threat is often framed as a distant problem. In reality, its implications extend into the day-to-day reliability of essential public services.

Cryptographic protections — the set of methods that uses rules of quantum mechanics to securely encrypt, transmit, and decode information — are foundational to how modern public infrastructure operates. When quantum-capable attacks emerge, those protections will weaken. That means attackers could impersonate legitimate systems, tamper with authenticated communications, or exploit trusted software update mechanisms — undermining the integrity of systems states rely on every day.

Operational technology environments are particularly exposed. While OT systems may rely less heavily on encryption than traditional IT systems, they are frequently connected to IT networks and depend on cryptographic mechanisms for identity, authentication, and software updates. As a result, weaknesses in cryptography, whether exploited through future quantum capabilities or more familiar attack methods, can create pathways into environments that were never designed to withstand modern cyber threats.

This risk is further amplified by the expanding supply chain that supports state and local government operations. Third-party vendors increasingly serve as entry points for attackers because they offer efficient access to multiple systems simultaneously. Supply chain compromises have become harder to detect and significantly more difficult to contain, especially in environments where visibility is already limited.

State and local agencies can prepare for quantum by adopting an “assume breach” mindset and implementing visibility and segmentation controls.

From “Assume Breach” to “Assume Cryptographic Disruption”

Adversaries are harvesting encrypted data today, intending to decrypt it later once quantum capabilities mature. This “harvest now, decrypt later” strategy makes quantum readiness a present-day operational issue, not a future one.

Consequently, communications and transactions secured by current encryption methods – including government records, financial transactions, and sensitive citizen data – may be vulnerable to retroactive exposure. Once attackers bypass cryptographic protections, they can move laterally within environments that were never designed to contain them. 

This reality requires a mindset shift: state CIOs must “assume cryptographic disruption” and accept that not all attacks can be prevented. Because it is impossible to eliminate risk entirely, agencies need controls that prevent a single compromise from cascading into a statewide disruption that affects essential services or causes extended downtime. 

Bottom line: attacks may be inevitable, but disasters are optional — with the right controls in place.

Building Resilience with Segmentation and Visibility in a Post-Breach World

Once encryption is bypassed, the greatest danger is lateral movement. In unsegmented environments, attackers can move laterally and expand impact far beyond the initial point of compromise.

Segmentation remains one of the most effective ways state and local agencies can reduce risk. By enforcing least-privilege communication between systems, segmentation limits how far attackers can move after an initial compromise, even when encryption fails.

Visibility across the network further strengthens security efforts by revealing communication patterns as they emerge. Visibility efforts focus on behavior — who and what is communicating, and where activity looks unusual.

Without this visibility, agencies risk being blindsided by disruptions that ripple across connected systems. Understanding how applications and workloads interact across hybrid, OT, and third-party environments is essential to containing threats before they impact operations.

Recent research shows that undetected threats and operational strain are key drivers of downtime and disruption: 92% of the surveyed organizations experienced at least one security incident involving lateral movement, resulting in an average downtime of more than seven hours.

To get ahead of these risks, CIOs should also begin cryptographic discovery — inventorying where cryptography is used across applications, systems, and vendors — to inform longer-term transition planning. From there, leaders can prioritize protecting high-impact systems by reducing unnecessary connectivity, enforcing strict workload boundaries, and ensuring that breaches can be quickly contained when they occur, without disrupting critical operations.

Together, segmentation and visibility enable state and local agencies to contain attacks.

Remaining Quantum Ready

Quantum computing will reshape cybersecurity, and its most disruptive effects are likely to surface in systems where failure is not an option. For state and local agencies, that risk becomes a direct threat to citizen services and public trust.

By aligning long-term quantum planning with post-breach containment strategies, including an “assume cryptographic disruption” mindset, visibility, and segmentation, state CIOs can strengthen quantum resilience today to ensure the readiness of crucial services the public relies on.

Gary Barlet is public sector chief technology officer at Illumio.