Beyond AI: Building a Quantum Security Strategy for What’s Next
-
November 04, 2026
-
This article from Risk Mangement Magazine was first published on October 22, 2026. The article is also available at: https://www.rmmagazine.com/articles/article/2026/10/22/building-a-security-strategy-for-the-quantum-computing-era
While organizations focus on the immediate imperatives of AI and machine learning, a parallel technological revolution demands equal strategic attention: quantum computing. The U.S. government underscored the urgency of “quantum preparedness” with the release of a June 2026 Executive Order, “Ushering in the Next Frontier of Quantum Innovation,” which frames quantum information processing as a pillar of future economic power and national security.1 Quantum technology is a strategic asset in an intensifying global race with geopolitical consequences, yet remains overshadowed by the world’s captivation with AI.
For corporate leaders building forward-looking security strategies, existing controls will need to be assessed, re-evaluated and fortified to defend against developing quantum threats or attacks. Replacing cryptography across a complex enterprise can take years, and data being stolen today may still be sensitive when quantum decryption becomes viable. Proactive quantum-readiness efforts should be made immediately to ensure networks, critical assets, and data are safe from tomorrow’s emerging AI-accelerated quantum risks.
The Emerging Technology Threat Landscape
Like AI tools, quantum technologies require access to organizational networks and data. Without proper safeguards, this access becomes a critical vulnerability, exposing sensitive data and offering threat actors new vectors to compromise infrastructure, systems, and information.
Just as threat actors quickly weaponized AI for cyberattacks, they will move swiftly to exploit quantum capabilities. Today’s public-key cryptography encryption methodologies are designed to protect sensitive information, but quantum computing has the power to crack these algorithms, rendering these encryption methodologies obsolete.2 Sophisticated threat actors know that encrypted data retains long-term value. Government agencies including the National Institute of Standards and Technology (“NIST”) have specifically warned that threat actors may already be employing a “harvest now, decrypt later” tactic, exfiltrating encrypted data today to unlock it once quantum decryption becomes viable.3
Beyond decryption and data theft, quantum technologies threaten critical infrastructure. Industrial control systems, including power grids, water treatment facilities and transportation networks, often rely on legacy encryption. Compromising these systems poses a threat to national security.4 Similarly, critical military systems that depend on cryptographic keys will be vulnerable to quantum threats. These risks are compounded by the race to be the first to develop practical quantum capabilities; the first entity to do so will gain a competitive and geopolitical advantage.
Balancing Technological Advancement and Security Resilience
To integrate new solutions, organizations increasingly rely on third-party vendors. While these partnerships offer transformative potential — enhancing efficiency, decision-making, and customer engagement — they also introduce significant cyber risks. Third-party providers often have access to sensitive corporate data, proprietary algorithms and critical infrastructure, yet may possess weaker cybersecurity defenses than the organizations they serve. New dependencies created by cloud platforms, specialized hardware, software providers, and research partners all create additional access points for threat actors. This disparity introduces vulnerabilities across the supply chain.
Further, for organizations developing their own quantum capabilities, these systems rely on complex supply chains and operational technologies that are exceedingly vulnerable to cyber threats. In the race to innovate and remain competitive, organizations must not lose sight of the security implications. Implementing emerging technologies without proper safeguards expands the attack surface and risks handing threat actors the very tools they need to conduct attacks. Balancing innovation with rigorous risk management is no longer optional; it is required for safely navigating the quantum computing era.
Start Preparing Now
While the timing surrounding widespread adoption of quantum technologies remains uncertain, organizations that have not started preparing are already at risk. Transitioning to post-quantum cryptography (“PQC”) encryption standards requires significant time, financial investment, and technological development. Cryptographic migrations can take years, while sensitive data may need to remain protected for decades — so it is imperative to begin building a transformation roadmap now.
In August 2024, NIST released its first three post-quantum cryptography standards, widely regarded as best practice and available for implementation today.5 NIST continues to expand these frameworks, and released working drafts of post-quantum cryptography updates for personal identity verification (“PIV”) standards in June 2026.6 Adopting these standards is a critical first step toward quantum-resistant cryptography. Beyond adhering to the NIST standards, organizations should secure their future by taking these steps:
Understanding Risks: Every organization has a unique risk profile. Leaders should scan all systems, algorithms, and cryptography to identify potential vulnerabilities to quantum computing. A comprehensive assessment must evaluate governance, policies, employee awareness and stakeholder alignment, to build a robust risk management framework. Creating a cryptographic inventory allows an organization to understand all of their encryption tools and algorithms ahead of PQC implementation.
Developing a Strategic Roadmap: A thorough quantum readiness assessment will reveal security gaps and high-risk areas. Use these insights to develop a strategy that prioritizes systems based on data sensitivity and longevity. An actionable resilience plan to achieve quantum resilience should set clear milestones and timelines while aligning with evolving regulatory standards, including the piloting of mitigation approaches now.
Ensuring the Proper Budget: Protecting networks from quantum threats requires dedicated security spending. Leaders must forecast the costs of mitigating quantum risks and incorporate them into future budgets. Executive buy-in is essential to secure the necessary resources.
Leading with Security: As organizations adopt new technologies, security must remain at the forefront. Crypto agility should be built into all modernization efforts, and external vendors should be required to provide their PQC roadmaps prior to onboarding. By identifying potential third-party risks, data privacy concerns, and expanded attack surfaces before deployment, organizations can prevent threat actors from exploiting new vulnerabilities.
Leveraging External Resources: Quantum computing is highly scientific and rapidly evolving. Organizations should engage third-party PQC experts to assess their networks and provide tailored recommendations for migrating solutions and fortifying quantum protections.
As quantum computing becomes mainstream, the urgency to prepare grows. AI-readiness, while critical, is not a substitute for a tailored quantum security strategy. By acting now and integrating post-quantum readiness into core security processes, organizations can stay ahead of the threat before it arrives.
Reprinted with permission from Risk Management Magazine.
Footnotes:
1. United States, Executive Office of President Donald Trump, Executive Order 13314: Ushering in the Next Frontier of Quantum Innovation. 22 Jun. 2026. Federal Register, vol. 91, no. 121, 25 Apr. 2026.
2: “What is Post-Quantum Cryptography?,” NIST (February 27, 2026).
3: Ibid.
4: Arjun Ramadevanahalli and Jeffrey Veltri, “Understanding the Cybersecurity Risks Flooding the Water and Wastewater Systems Sector,” Morgan Lewis (January 5, 2026).
5: “NIST Releases First 3 Finalized Post-Quantum Encryption Standards,” NIST (August 13, 2024).
6: “Working Drafts: Post-Quantum Cryptography Updates to the PIV Standards,” NIST (June 12, 2026).
The views expressed herein are those of the author(s) and not necessarily the views of FTI Consulting, Inc., its management, its subsidiaries, its affiliates, or its other professionals.
Related Insights
Published
November 04, 2026
Key Contacts