At 47G’s Zero Gravity Summit, QuSecure’s Garfield Jones, Microsoft’s Michael Salazar and IonQ’s Craig Miller, moderated by Holland & Knight’s Marissa Serafino, urged organizations to inventory systems and data and adopt post-quantum cryptography now.
Salt Lake City, Utah — October 29, 2026
Quantum computing is usually described as almost here. At 47G’s Zero Gravity Summit today a panel of security and quantum executives argued that “almost” is the wrong frame, because the decisions that matter most (what to inventory, what to encrypt differently, whom to train) cannot wait for a breakthrough.
“We can’t really wait for a breakthrough in the technology to make those decisions,” said moderator Marissa Serafino, a technology attorney at Holland & Knight, as she opened “Quantum Power: Strategic Offense and Resilient Defense” at the Salt Palace Convention Center in downtown Salt Lake City. She was joined by Garfield Jones, senior vice president of global strategy and research at QuSecure; Michael Salazar, principal director of security and AI at Microsoft; and Craig Miller, director of public sector strategy and operations at IonQ. Salazar and Miller both grew up in Utah.
“Quantum is now”
Miller defined the threat as a cryptographically relevant quantum computer, a machine powerful enough to break the encryption that protects most of today’s data. Serafino noted that quantum always seems to be five years away. Miller said Google’s view is that it arrives “by the end of the decade,” and that IonQ is “a little more optimistic or pessimistic, depending on how you think about it,” expecting it “probably a year before that.” His takeaway for companies at the summit: “Quantum is now and your security needs to be now too.”
Salazar said Microsoft pulled its own internal target forward from 2030 to 2029. Jones noted that government timelines still reference 2030, “but if you know these guys, it’s 2029, 2028.” He rejected the idea that uncertainty is a reason to wait. “I don’t know when it’s going to come, so I’m not going to do anything,” he said. “That’s not right.”
Start with the inventory
Asked what has to happen technically between now and then, Miller started with visibility. “First people need to understand their entire network and where it’s at,” he said. Then comes the budget conversation. “If you could go three years into the future and say that your adversary or your competition had all of your data, would you do something about it?” he asked. The new algorithms mean bigger key sizes, probably hardware updates, and closer monitoring of data both at rest and in transit.
Salazar compared security work to housekeeping. “It’s a bit like cleaning your house,” he said, noting that he has three young children. A clean house at the end of one day does not stay clean. Jones, who has four older children, agreed: “They still dirty the house.” Salazar said his company is trying to reduce that toil for customers, including by making hardware that the large cloud providers have access to more available. He added that Microsoft is connecting its red-team researchers, who track nation-state adversaries, to its quantum work so customers better understand the “harvest now, decrypt later” threat, in which stolen encrypted data is stored until it can be cracked.
Jones said the inventory has to include data, not just machines. “Adversaries are not after our hardware,” he said. “They’re after our data.” His version of an old line: “Data is our new oil. Heck, we’re not even using gas that much anymore.” Health records, intellectual property and classified material all belong on the list, he said, along with a plan for what to move to post-quantum cryptography, or PQC, first.
Salazar said the first priority is data in transit. When data moves from one point to another, “we really don’t know who’s in between there,” he said, while data at rest has additional layers of protection. He also offered a rule of thumb: add how long a secret must stay secret to how long migration will take. If the total is longer than the probable arrival of Q day, the day a quantum computer can break current encryption, “it already needs to be taking place.” Some secrets, he said, need to stay secret for 10, 15, 20 or 30 years. Migration will require “agility” and hybrid environments, he added, and he urged organizations to move away from custom configurations toward the PQC algorithms NIST has already approved. “You just go on NIST and there’s a lot of PQC stuff there that’s ready to go.”
“Trust now, forge later”
Jones said the conversation about key exchange is only half the story. Digital signatures and certificates are also at risk, he said, in what he called “harvest now, forge later” or “trust now, forge later.” Once a quantum computer breaks the key behind a signature, he said, “they can forge anything they want.” Mortgage statements and other important documents are exposed, he said.
Washington, Salt Lake and the NSA
Serving as moderator, Serafino asked what the U.S. needs to do beyond basic research funding. Miller pointed to two executive orders issued this summer. One was about moving quantum computers from first use into widespread use. The other, on post-quantum cryptography, put a timeline on the federal government to have “a plan,” a budget and implementation. “Now it’s an executive order, so it’s a bit of an unfunded mandate, but it is a call to action,” he said.
He credited Governor Spencer Cox with moving quickly afterward on a Utah executive order, saying the goal is to turn the state’s advantages “towards the quantum economy that is coming” while protecting “the economy we have now.”
The White House signed two quantum executive orders on June 22, 2026, including Executive Order 14413 on quantum innovation. Governor Cox signed Utah Executive Order 2026-06 on August 10, creating the Utah Quantum Initiative, led by the Governor’s Office of Economic Development with the Nucleus Institute invited to co-lead, and a Quantum Coordination Council chaired by the office’s commissioner. The council must complete a statewide quantum landscape report, mapping research infrastructure, manufacturing capacity and workforce assets, by March 30, 2027. The order’s stated priorities center on research, workforce, commercialization, supply chain and defense-sector strategy; it does not explicitly address post-quantum cryptography migration.
The White House signed two quantum executive orders on June 22, 2026, including Executive Order 14413 on quantum innovation. Cox signed Utah Executive Order 2026-06 on August 10, creating the Utah Quantum Initiative, led by the Governor’s Office of Economic Development with the Nucleus Institute invited to co-lead, and a Quantum Coordination Council chaired by the office’s commissioner.
The state’s quantum planning began with a roundtable series in December (first two meetings). At the third Quantum Roundtable on June 29 in Lehi, about six weeks before Cox signed his order, participants reviewed a draft strategic plan with seven pillars, one of them on digital identity and quantum-ready security tied to post-quantum cryptography standards. The order’s priorities track most of the other pillars, but not that one. Miller, who also spoke at that roundtable, raised the NSA’s Utah Data Center there as a federal compute asset the state could build on.
Salazar said industry has to lead. He called for public-private partnership that goes beyond talk, investment through DARPA and the Defense Innovation Unit, and relief from “all of the drag that comes with federal contracting.” Industry owns the hardware and the cloud, he said. He praised NSA leadership and said the agency, NIST and the government are positioning themselves in a way that shows this is “more than just fluffy EO language.”
Miller, who said he is a former NSA mission partner, added a Utah angle: The NSA's Intelligence Community Comprehensive National Cybersecurity Initiative Data Center (commonly referred to as the Utah Data Center) in Bluffdale is an opportunity to move quantum efforts out of research and “into the operational field” for the signals intelligence community. He also offered an analogy. For AI the pivotal event was the ChatGPT moment, he said; for quantum, “it will be Q day.” If everyone could go back two years before ChatGPT, “maybe we’d have gotten more educated on how to use artificial intelligence.”
Quantum key distribution and China
Miller raised a technology he said the U.S. is not looking at closely enough: quantum key distribution, or QKD, which moves cryptographic keys over a separate channel. It is a bigger topic in Europe, he said, and IonQ makes a device that does it. “Even if we’re not going to use quantum key distribution, we need to understand it as a nation so that we can exploit it when our adversaries use it,” he said, adding that China “probably has the largest or the longest land-based quantum key distribution network out there.”
Where AI and quantum meet
Serafino asked where the two technologies actually intersect. Salazar said to separate what AI does for quantum from what quantum may do for AI. AI is already helping with vulnerability discovery, deployment and cutting security toil, he said, while quantum’s effect on AI is still being worked out by researchers.
Jones was more worried. “I’m a little terrified. I’ll be honest. I don’t want to sound like an alarmist,” he said, of pairing AI with quantum computers. Then, recalling the panel’s earlier promise to end on a positive note, he flipped it: the same capability could help design cancer drugs and optimize financial portfolios.
Miller offered evidence the field is moving. Nvidia, he said, just opened a quantum lab in Boston, and its CUDA-Q software could do for quantum what CUDA did for GPUs. IonQ plans to put a quantum computer in that lab. Salazar said Microsoft just opened a quantum lab in Maryland, less than 12 months after announcing it. “Microsoft operates a bit at the pace of something akin to a government, like a turtle,” he joked.
The bottlenecks
Jones said critical infrastructure is a forgotten part of the migration. Operational technology components often cannot handle the new algorithms, which are “significantly bigger” than today’s. Cloud providers can help move cloud data to PQC, he said, but “you’re still leaving your critical infrastructure components basically out in the cold.”
On hardware, Miller cited helium-3, needed for superconducting systems. The growing nuclear industry is the best terrestrial source, he said, and companies including IonQ, Microsoft and Google are vertically integrating partly to know where their bill of materials comes from “before you get into a conflict with our pacing adversary.” Jones added cryogenics: “Qubits don’t like hot weather. So I could never be a qubit because I like warm weather.” Materials research, including synthetic materials, is another area for investment, he said.
All three named the workforce as the biggest constraint. “Getting the workforce ready now is a big bottleneck,” Miller said. Salazar made the Utah pitch, saying the state has “a workforce that is unlike really anywhere else in the country,” one “native to Utah that wants to be here” and another arriving because it sees opportunity. If he were starting a career, he said, quantum would be among the problems he would want to work on, and these are “nationally relevant problems.”
What to watch
The panelists’ shared argument was that the work cannot be postponed until the technology is proven: inventory systems and data, prioritize what is in transit and long-lived, adopt NIST’s algorithms, and train people now. The practical tests are whether the executive orders turn into funding, whether critical infrastructure gets a migration path, and whether Utah’s quantum council delivers on its early deadlines.
