Before Quantum Computers Scale Up, Someone Has to Secure Them

Quantum computers do not yet pose a threat to modern encryption. They are not yet powerful enough. But the security of the quantum computers themselves, the machines being built in university labs and corporate research centers, has received surprisingly little attention. A program at the University of Maryland aims to fix that before the technology matures.

The SEQCURE program, run by the Maryland Institute for Quantum Applications (MIQA) at the university's Applied Research Laboratory for Intelligence and Security (ARLIS), is applying Zero Trust Architecture principles to quantum computing systems. Sponsored by the Secretary of the Air Force's Concepts, Development, and Management Office, the initiative represents one of the first systematic efforts to evaluate quantum computing security across multiple domains.

What Zero Trust means for quantum systems

Zero Trust is a cybersecurity framework, codified in NIST Special Publication 800-207, built on a simple premise: no user, device, or system component should be trusted by default, even if it sits inside a network perimeter. Every access request must be verified. Every interaction must be authenticated.

Applying this framework to quantum computing is not straightforward. Quantum systems have unique characteristics that conventional security models were not designed to address. The hardware operates at temperatures near absolute zero. The software stack includes quantum programming languages, compilers, and error correction layers that have no direct analog in classical computing. Many quantum computers are accessed through cloud platforms, adding network security considerations. And the facilities housing quantum hardware have their own physical security requirements.

ARLIS researchers are evaluating security postures across six key areas: cloud, hardware, software, facility, data, and users. Each domain presents distinct challenges.

Why this matters now

Quantum computing is still in its early stages. No quantum computer has demonstrated a practical advantage over classical machines for real-world problems. But government agencies, defense contractors, and technology companies are investing heavily in the technology, and some quantum systems are already being used for research in materials science, cryptography, and optimization.

If security standards are not developed while the technology is young, quantum systems will be deployed with the same patchwork of afterthought security measures that plagued the early internet. The SEQCURE program's goal is to establish recommendations before quantum systems reach operational deployment, so that security is designed in rather than bolted on.

Paul Lopata, Chief Quantum Scientist and Acting Director of MIQA at ARLIS, framed it as ensuring that quantum systems are resilient from the start. The program's output will include comprehensive reports and recommendations aimed at both government and industry stakeholders.

Industry collaboration

ARLIS is working with quantum hardware and cloud providers to conduct its security analyses. The collaboration is important because quantum computing hardware varies significantly between manufacturers. Superconducting qubit systems, trapped ion systems, and photonic systems each have different physical requirements, different control electronics, and different software interfaces. A security framework that works for one architecture may not apply to another.

By evaluating multiple vendor environments, the program aims to produce recommendations that are broadly applicable rather than specific to a single platform.

Limitations of the current effort

The SEQCURE program is a research initiative, not a regulatory mandate. Its recommendations will be advisory. Whether government agencies or commercial quantum computing providers adopt them depends on procurement requirements, market incentives, and the pace of technology development.

The program is also focused on the security of quantum computers themselves, not on the more widely discussed threat that quantum computers pose to existing encryption standards. Post-quantum cryptography, the effort to develop encryption algorithms resistant to quantum attacks, is a separate and much larger research area.

Quantum computing technology is evolving rapidly. Security analyses conducted in 2025 and 2026 may need significant revision as hardware capabilities, software stacks, and deployment models change. The recommendations will need to be treated as living documents rather than fixed standards.

The research timeline runs through 2025 to 2026, with ongoing security analyses and reporting to stakeholders.