| SecurityWeek’s Cyber Insights 2026 examines expert opinions on the expected evolution of more than a dozen areas of cybersecurity interest over the next 12 months. We spoke to hundreds of individual experts to gain their expert opinions. Here we explore quantum computing and its threat to current encryption, where the use of AI might shorten the timescale to powerful quantum; and the unknown threat of powerful quantum automated by advanced AI. |
It’s hard not to have a dystopian view on the long term future effect of powerful quantum computers wedded to advanced artificial intelligence. But at least we have a few years to prepare.
Quantum computers are coming, with a potential computing power almost beyond comprehension. That’s a given. The known threat is to current public key encryption methods, such as RSA and ECC, which will both be crackable through Shor’s algorithm in short timeframes. It is believed that nation states and advanced criminal gangs are engaged in a widespread harvest now, decrypt later (HNDL) campaign – steal and store data and secrets today, even if they are encrypted, because they can be decrypted later with quantum computers.
But the timing is unquantified. Quantum computers exist today but are too ‘small’ to be a threat. Most projections do not expect a powerful quantum computer to be available within the next five years. But the fly in the ointment is the emergence of artificial intelligence, which could be used to speed the development of quantum (for example, by developing more efficient error correction modes), followed by automating the use of quantum power when it arrives.
In reality, nobody other than the major power intelligence agencies knows the current state of quantum development within other governments. We believe, and hope, that no adversarial nation is more advanced than ourselves.
The main thrust of this discussion will consider the potential of marrying advanced AI with powerful quantum computers. We’ll probably see little evidence in 2026, but it may not be long beyond that. However, one thing is clear – we need to start considering the adversarial threats as well as the domestic potential that will come from the marriage of quantum and AI.
There are two areas to consider: the known threat to current encryption, where the use of AI might shorten the timescale to powerful quantum; and the unknown threat of powerful quantum automated by more advanced AI in the future.
The expectation of PKC cryptanalysis
The coming obsolescence of current public key cryptography caused by increasingly powerful quantum computers is not news. At some point in the relatively near future, quantum computers will be able to run Shor’s algorithm and be able to break current public key cryptography (PKC) “in hours rather than millennia”.
This is the motivation behind the adversarial theft of encrypted data (which almost by definition will include the most sensitive data) in HNDL campaigns; and the multi-year NIST endeavor to develop new post quantum cryptography (PQC; or quantum-resistant encryption algorithms).
Current PKC is doomed. The only question is: When will this happen? This will be with the development of a cryptographically relevant quantum computer (CRQC), often shortened to Q-Day.
John Farley, MD of cyber liability practice at Gallagher, suggests Q-Day is the polar opposite of Y2K. “With Y2K, we all agreed on the exact date and time that it would occur – but we really didn’t know what would happen. With quantum, we don’t have any real consensus as to when Q-Day will occur – but there is certainty that it will have the ability to defeat encryption.”
This lack of a known timeline is important. It justifies, and even encourages, organizations to ignore the gravity of the threat and delay prioritizing the crypto migration to PQC – because, as Farley adds, it’s not like flipping a switch, and will take time and resources.
“I understand the hesitation: budgets are tight, timelines are anyone’s best guess, and no one wants to overspend before the threat fully materializes,” adds David McNeely, CTO at Delinea.
Rob Hughes, CISO at RSA, takes a pragmatic view of the hesitation, based on attackers’ predilection for ample ROI. He highlights that quantum computing requires massive funding and resources – and then points to Scattered Spider who simply persuaded an IT help desk to disable or reset MFA credentials, and launched a ransomware attack causing hundreds of millions of dollars in losses.
“The vast majority of attacks today rely on, and succeed with, phishing, social engineering, password-based authentication, unpatched systems, and patchwork access provisioning. A risk-based approach demands that those risks receive organizations’ immediate attention, action, and investment.” And it’s hard to argue against that.
But that doesn’t change the reality that quantum is coming – nor that the projected timeline is shortening. It’s down from a couple of decades to about ten years, and now…
“Most industry roadmaps predict quantum computers could break current asymmetric cryptography within the next 5 years, and both hardware and algorithmic advances continue to shift that timeline to the left,” warns Jordan Kenyon, senior quantum scientist at Booz Allen Hamilton. “As we look ahead, organizations that are not already within the first phase of their transition to post-quantum security are going to be far behind the curve to protect their infrastructure.”
This is a real problem. Full PQC migration can now barely be completed before Q-Day – so, 2026 is the deadline for getting started. “With federal agencies alone expected to spend over $7B on the transition, the urgency of adopting PQC cannot be overstated.”
Failure is daunting, she continues. “It’s important to recognize that once HNDL collection unravels, it can be hard to mitigate its impact. We may not understand the full national and economic security implications for years.”
Matthew Hartman, chief strategy officer at Merlin Group, adds, “This is not only a data security imperative – it is a national and economic security imperative that could shape the balance of global power in the digital age.”
Still missing from our quantum concerns is the advancing capability of artificial intelligence – and the potential for the two technologies to combine. When we achieve the global Q-Day, the world could be flooded by decrypted data stolen earlier and weaponized by AI at scales never yet seen; but we may imminently also have AI within quantum computers to help defend our networks.
“Quantum machine learning (QML) combines quantum computing and machine learning, targeting complex problems too resource-intensive for classical methods,” explains Mike Wilkes, enterprise CISO at Aikido Security. “Quantum deals with fuzzy values stored in qubits and machine learning deals with fuzzy values with regard to confidence scores on responses, so they actually combine quite well and naturally in this regard.”
He warns, however, that such a quantum computer could still be targeted through the ‘front-end’ classical computer that is needed to prepare data suitable for loading into the quantum computer. “This means that cybersecurity professionals will remain troubled by ‘side attacks’ against the classical computer resources that interface with the quantum computer resources.”
When a quantum computer sufficiently powerful for cryptanalysis arrives, it will be prohibitively expensive. Very few organizations will have one – and the haves will have a major cyber advantage over the have nots. The first quantum computer will likely be owned, and perhaps secretly developed, by a nation. We do not believe any nation has yet done so – but would we know?
“There will not be very many QML environments at first and there will certainly be a massive ‘first mover advantage’ with regard to stealthily breaking the trusted communications of governments, corporations and the military,” continues Wilkes. “It will resemble the strategic thinking that the Allies had to consider after Alan Turing and his colleagues at Bletchley Park broke the Enigma code with an electromechanical machine called the Bombe. They could read the enemy’s communications. But to act on this information would betray the fact that Enigma had been cracked.”
But sooner rather than later after Q-Day, well-resourced adversaries will have access to quantum power. “Well-resourced attackers with on-demand quantum access will hold an advantage over firms unable to afford it by cracking keys in minutes versus years, executing undetectable supply-chain attacks, and simulating defenses to bypass them, exacerbating inequalities unless quantum-as-a-service models democratize access,” explains Kevin Curran, IEEE senior member and professor of cybersecurity at Ulster University.
PQC is our primary defense against this Armageddon. If migration hasn’t yet started, it may already be too late – it is worth noting that some experts believe we have less than five years. “Our expectation,” says Gary Mounsor, senior security consultant at e2e-assure, “is that a nation state will make inroads with the technology into 2027 or 2028 after which Pandora’s Box will be open.”
Quantum and Artificial General Intelligence
Artificial General Intelligence (AGI) is defined as a machine’s ability to outperform human intelligence at machine speed. It is effectively the ability for the machine to reason (that is, think) under its own steam. While many people believe it will be impossible to achieve, all the major foundational AI developers (OpenAI, Google DeepMind, Anthropic, xAI, Aleph Alpha and others) are working toward it. DeepMind defines it as ‘superhuman’ – systems that outperform all humans in all tasks.
Timescales for achievement vary. Musk is reported to have said it could be as early as 2026; Altman that it could be in 2027 or 2028; and Demis Hassabis (DeepMind) has offered 2030. It seems that the emergence of AGI might coincide with the arrival of Q-Day; that is, the emergence of early powerful quantum computing.
Now consider the effect of that level of AI being powered by future quantum computers with a processing capacity almost beyond our current comprehension. Bear in mind that in 2023, important AI experts and business leaders, including the CEOs of Google DeepMind, OpenAI and Anthropic, signed a joint statement: “Mitigating the risk of extinction from AI should be a global priority alongside other societal-scale risks such as pandemics and nuclear war.”
We should add that there is a natural affinity between quantum and AGI. “The dimension of the space available for data is exponentially large in quantum computers, which is of significant importance for AGI,” says Professor Dr Frank Leymann, WSO2 technology fellow. “Models can be much more complex than classically possible, which is considered to be key for the cognitive capabilities of an AGI.”
You could say that AGI will release the full power of quantum, while quantum will foster the growth of AGI. Nevertheless, not everyone is worried about the synergy of quantum and AGI – some believing it won’t happen, and others believing any increased threats can be countered by the improved defense it could offer.
“Combining quantum computing with AGI is not a serious risk for two reasons,” says John Bruggeman, virtual CISO at CBTS. “First, quantum computing is good for a few things but not a fit for many others. Traditional computing will not be replaced by quantum computing. Quantum computers are big, only good for certain tasks, consume lots of energy, and generally run at very, very, very low temperatures (think -455 F or lower).”
Second, he continues, “AGI is decades away from being a reality, if it can even actually happen. LLMs and machine learning (ML) are great, and the work being done on the LLM front is impressive, with agentic tools able to automate a lot of processes – but let’s not confuse that with intelligence.”
Similarly unconcerned is Arjun Kudinoor, quantum security advisor at Protegrity. “Once they are significantly more developed, quantum processors will begin to accelerate AI workflows, unlocking new possibilities in data analysis, optimization, and modeling. This growing feedback loop between quantum technologies and AI is laying out the groundwork for digital security that can learn and evolve faster than the threats it faces.”
However, the opposite view is more prevalent. “The convergence of artificial general intelligence and quantum computing represents more than an incremental technological shift; it is a fundamental transformation in how decisions are made, and conflicts are waged,” says Dario Perfettibile, VP and GM of European operations at Kiteworks.
“When quantum computers can break current encryption in hours rather than millennia, and AGI systems can autonomously identify vulnerabilities, exploit them, and respond to counterattacks faster than human comprehension allows, we enter territory where the traditional human-in-the-loop becomes a liability rather than a safeguard.”
He continues, “This convergence could unlock extraordinary benefits. Yet, the same capabilities enable nightmare scenarios: autonomous cyber-weapons that adapt faster than defenders can patch, or decision systems that escalate conflicts beyond human intervention because mission parameters override safety constraints.”
It isn’t hypothetical, he warns. “Defenders will need quantum-enhanced threat detection simply to identify attacks designed by AGI and executed through quantum-accelerated methods. Without quantum parity, organizations face adversaries who operate in a different computational universe entirely.”
Carlos Moreira, CEO and chairman of the board at SEALSQ, adds, “By 2026, quantum computing and advanced artificial intelligence will converge into a new computational order. Quantum processors, agent-based AI systems, and emerging AGI capabilities will work together at speeds and levels of complexity that surpass human understanding. This convergence will amplify progress but also accelerate risk. Conflict has always driven technological evolution; the difference now is that machines will increasingly operate faster than humans can comprehend or intervene.”
Professor Curran agrees with this. “Combining AGI and quantum computing could vastly accelerate optimization across industries,” he says. “Examples include societal benefits (new medicines, efficient logistics) and harms (ultra-efficient offensive cyber tools, opaque autonomous decision systems). The speed and scale of such systems could outpace policy and human oversight.”
The speed and scale of quantum/AGI attacks is the overriding concern. “Decisions and countermeasures will unfold faster than humans can process, forcing defenders to rely on automation to keep pace,” says Morgan Adamski, cyber, data & tech risk deputy leader at PwC US.
“While this may improve defensive efficiency, it raises profound questions about control, accountability, and unintended escalation. We’re approaching a point where technology will operate at a tempo that challenges human comprehension–and governance must evolve accordingly.”
Nigel Gibbons, director and senior advisor at NCC Group, continues, “If you believe the timelines from leading labs, AGI and quantum computing will arrive within a decade, and automated agents are already here. Combine them, and decision loops collapse from days and hours to seconds or microseconds. In cybersecurity, that means the attacker’s first strike may also be their final strike” he says. “Add into the mix the legacy tech and cyber debt every organization is carrying, and you realize AGI will have freedom to roam and access to all areas.”
Retired lieutenant general Ross Coffman, president at Forward Edge-AI, expands on the attack versus defense scenario. “We are approaching a convergence between artificial general intelligence and quantum computation that will transform security from a human-in-the-loop process into an autonomous system of systems,” he explains.
“Quantum acceleration will enable AI reasoning and learning to occur near-instantaneously. It will allow agents to not only react to data but predict and preempt based on probabilistic modeling that no human team can match.”
The first to secure it will determine who remains standing, he suggests. “The implications are binary: progress or peril.”
AI on its own is already problematic for defenders. Adversarial AI can probe millions of attack vectors per second, adapting in real-time to defenses as they are deployed. By the time a human analyst recognizes a pattern, the attack has already evolved beyond it. “This asymmetry becomes existential when quantum computing is introduced into the equation,” he adds.
“When defense, finance, and infrastructure systems operate faster than humans can audit or override, ‘containment’ ceases to be a policy. It becomes a technical limitation. A self-learning, quantum-accelerated network attacking a nation could, under the wrong stimulus, escalate without human authorization. The potential for a digital misfire – an algorithmic chain reaction – rivals the risk once posed by nuclear command errors.”
But Coffman doesn’t believe all is necessarily lost. “Defenders must fight speed with speed, deploying hardware and software solutions capable of autonomous response. The next era of deterrence depends on installing post-quantum cryptography mesh networks, embedding quantum-resilient encryption, autonomous key management, and zero-trust architectures that are immune to both human error and quantum attack. Systems must secure themselves at machine speed, without waiting for permission to act.”
Aikido’s Wilkes takes a path through dystopian reasoning to at least one positive possible outcome from the alliance of quantum and AI. “There is a long-standing physics theory that if one could calculate the position and spin of every atom in the universe you would be able to predict the future,” he muses.
“This verges on expressing a rather dystopian philosophy that posits freewill and human choice/agency do not actually exist. We are merely chains of interactions with predictable outcomes. QML could be used to prove (or disprove) such a theory.”
But at the very least, he adds, “Think of the case where, if we knew the location and intent of every threat actor and nation state attacker on the internet, we could leverage QML to predict their next attacks and targets.”
Final Thoughts
Quantum computers are not guaranteed but are likely. AGI is not guaranteed but is likely. The combination of the two, if and when they arrive, is not guaranteed – but is almost inevitable.
If or when that happens, the synergy of the two is pure conjecture. While the societal benefit could be enormous, the societal risk could be equally devastating. The power and speed of cyberattacks will be beyond human comprehension – and in this case, the first cut will literally be the deepest.
Will we be able to defend against future attacks? Probably not if cyber attackers or adversarial nations get there before we can use similar capabilities to defend.
Timing predictions for this new world order vary wildly, from 2026, 2027 and 2028 through 2030 to never. The effect is similarly debated, from quantum AGI versus quantum AGI largely cancelling each other (with an asymmetrical advantage to the adversary and a massive advantage to the first mover).
Meanwhile, while we wait, we should hope for the best and prepare for the worst.
Related: Bill Aims to Create National Strategy for Quantum Cybersecurity Migration
Related: MITRE Publishes Post-Quantum Cryptography Migration Roadmap
Related: IBM’s $150 Billion US Investment to Boost Quantum Innovation and National Security
Related: Tech Firms Want to Build Artificial General Intelligence. Who Decides When AGI is Attained?
