Securing AI for the Quantum Era: A CISOs Cyber Security Guide

Two of the most impactful trends in technology, Agentic AI and quantum computing, are poised to deliver capabilities once considered science fiction. However, their advancement brings significant security implications that organizations must address proactively to prevent misuse and system failure. The core challenge lies in maintaining the trust of citizens and customers by ensuring their data remains safe and secure.

The Risks of Agentic AI

When AI agents are given an objective and the autonomy to achieve it, several critical risks emerge, mirroring the challenges of managing a human workforce.

• Data Breaches: This is the primary concern. Autonomous agents with access to sensitive data can become vectors for breaches, exposing highly valuable information:

  • Personally Identifiable Information (PII) and Personal Health Information (PHI), the latter of which is often more valuable to attackers.
  • Intellectual Property (IP), the “secret sauce” or “keys to the kingdom” for any business or government entity.

• Ethical Considerations: An autonomous agent is like an employee and must operate under the same ethical principles. Organizations must ensure that the AI’s decision-making processes are ethical and aligned with human values.

• Explainability: It’s crucial to avoid “black box” AI. We must be able to understand how an AI arrives at its conclusions. As one expert noted, much like a math teacher, we need the AI to “show me your work.” Humans must remain the thought leaders, not “passengers or even more so, getting locked in the trunk,” ensuring AI serves our objectives without unintended consequences.

The Quantum Threat to Cybersecurity

Quantum computing offers immense potential for fields like medicine and materials science, but its primary downside is its ability to break the encryption that underpins modern security.

• Undermining the CIA Triad: The foundational pillars of cybersecurity are Confidentiality, Integrity, and Availability. Quantum computing directly threatens two of these:

  • Confidentiality: By breaking cryptography, quantum computers can expose sensitive, secret information to unauthorized parties.
  • Integrity: We rely on cryptographic techniques to verify that data and systems have not been tampered with. If these techniques fail, we can no longer trust the integrity of our information.

• Harvest Now, Decrypt Later: The quantum threat is not a distant problem; it is an immediate one. Adversaries are currently capturing and storing encrypted data that has a long shelf life. They are waiting for the day a sufficiently powerful quantum computer comes online to decrypt this trove of stolen information.

How Organizations Can Prepare

Proactive preparation is essential to mitigate the risks of both AI and quantum computing. This involves applying well-established security principles to these new domains.

Preparing for Agentic AI

1. Establish an Oversight Committee: Create a multidisciplinary group to oversee the use of AI. This committee should not just include technologists but also representatives from the business, legal, and social functions to ensure a balanced approach.
2. Develop Governance, Risk, and Compliance (GRC): Implement clear policies, processes, and procedures for how AI will be developed, deployed, and used within the organization. This framework is a critical and substantial task in a new and evolving field.

Preparing for the Quantum Threat

1. Form a Quantum Task Force: Assemble a dedicated team to address the quantum menace.
2. Create a Cryptographic Inventory: You cannot secure what you cannot see. The first step is to conduct a thorough inventory of all cryptographic systems and algorithms in use, creating a Cryptographic Bill of Materials (CBoM). One client discovered 4,000 custom crypto implementations, a task that would take over a decade to remediate at a rate of one per day.
3. Prioritize Based on Risk: Once the inventory is complete, assess the risk to prioritize which systems to upgrade first. Focus on protecting the most critical data assets, such as PII, PHI, and intellectual property.
4. Vendor Management: Ensure that third-party vendors and technology suppliers are also adopting quantum-safe cryptography (also known as post-quantum cryptography). New software acquisitions should be future-proofed by meeting these new standards.
5. Strive for Crypto-Agility: The ultimate goal is to build systems with crypto-agility. This is the ability to easily “plug and play” new cryptographic algorithms, allowing for quick replacement of a compromised or deprecated algorithm without a complete system overhaul.

Concluding Advice for CISOs

• Be Proactive: The “train is coming down the track.” It is crucial to get ahead of these threats rather than reacting after a catastrophic event.
• Translate Risk into Cost: Communicate the risks to leadership in financial terms. Leaders who control the budget need to understand the potential cost of inaction to justify investment in remediation.
• Train Everyone:
  • Leaders: To secure necessary funding and support.
  • Workers: To ensure the people responsible for implementation understand the mission and are equipped to execute it effectively.

Ultimately, an “ounce of prevention is better than a pound of cure.” Investing in proactive security measures now is far less expensive than dealing with the consequences of a breach later.

• Tags:
• Agentic AI
• Cybersecurity
• Feature
• Quantum Computing
• Cryptography
• Risk Management
• CISO