DCW FRONTIER FOCUS
Special Edition Frontier Focus from Filip Talac, Founder and CEO, Quantum Fort
"The Quantum Fault Line: Cybersecurity, Control, and the Post-Quantum Threat"
Core thesis: The next cybersecurity crisis isn't just about quantum computers breaking encryption; it's about that risk colliding with the rise of autonomous systems that act without human approval. Together, these two trends create a "control problem," not just a cryptography problem.
Why the next cybersecurity crisis may not be about broken encryption alone, but about the erosion of human control over increasingly autonomous digital systems.
Most discussion about quantum cybersecurity starts with encryption. A sufficiently capable quantum computer could break much of the public-key cryptography we depend on today. RSA, elliptic-curve cryptography, Diffie-Hellman and related systems rely on mathematical problems that are extremely difficult for classical computers. Shor’s algorithm changes that equation if we can build a cryptographically relevant quantum computer at sufficient scale.
That matters. But I think we’re focusing on only half of the problem. The larger risk isn’t simply that someone might decrypt information we thought was secure. It’s that quantum disruption could arrive at the same time we’re giving software systems more authority to act without us. Those two trends are moving independently, but they’re heading toward the same fault line.
On one side, the mathematical foundations of digital trust are changing. On the other, AI agents, automated infrastructure and machine-to-machine systems are increasingly making decisions, issuing instructions and executing actions without waiting for a human to approve every step. Put those together and the post-quantum problem stops being just a cryptography problem. It becomes a control problem.
Cryptography does more than hide data
We tend to talk about encryption as if its primary job is keeping data secret. That is important, but cryptography does much more. It tells your browser that it’s really communicating with your bank. It tells an operating system that a software update came from the stated vendor. It allows two machines that have never met to establish trust across an untrusted network. It validates transactions, protects firmware, signs code and supports the identity infrastructure behind almost every serious digital system.
Confidentiality is only one part of this. Authentication and integrity matter just as much. That’s why the post-quantum transition is already underway. NIST finalized its first three major post-quantum cryptography standards in August 2024: ML-KEM for key establishment, and ML-DSA and SLH-DSA for digital signatures. NIST now explicitly recommends that organizations begin applying these standards rather than waiting for a large-scale quantum computer to appear.
This isn’t because somebody knows the exact date when current cryptography becomes unsafe. Nobody does. The problem is migration time. Cryptography is buried everywhere: applications, certificates, identity systems, APIs, VPNs, embedded equipment, industrial devices, firmware, cloud services and products that may stay deployed for 10 or 20 years. You don’t just replace or reconfigure that infrastructure over a weekend.
The attack can start before the quantum computer exists
There’s another reason waiting is a bad strategy. An attacker can steal encrypted information now and keep it. This is known as a harvest-now-decrypt-later attack. Threat actors don’t necessarily need to decrypt it today. They only need to believe that the information will still have value when better decryption capability becomes available. That changes how we should think about exposure. A password that expires next month is one problem. Genomic data, defense information, intellectual property, government communications, critical-infrastructure architecture or proprietary research that must remain confidential for decades is a very different problem.
So the post-quantum threat has a strange property: part of the attack can happen years before the cryptographic breakthrough that makes the attack useful. This is why governments are treating migration as a current engineering problem rather than future speculation. U.S. national security policy calls for a transition away from vulnerable cryptography over the coming decade, with the broader goal of post-quantum transition by 2035. But even that framing is still mostly about cryptography. There’s a second transition happening at the same time.
Machines are no longer just tools
Traditional computer systems mostly waited for humans. A person authenticated. A person initiated the transaction. A person deployed the software. A person investigated the alert. That model is disappearing. Software now detects conditions and responds automatically. Security platforms isolate endpoints. Trading systems execute transactions. Infrastructure reconfigures itself. AI agents call APIs, access databases, generate code and interact with other agents. Industrial systems make operational adjustments thousands of times faster than any person could. That automation is useful and often necessary, but it changes what a compromised digital identity means.
If I compromise the credentials of a human employee, I may gain access to a system. If I compromise the identity of an autonomous machine with permission to execute transactions, deploy code or instruct other machines, I’ve potentially compromised an actor. That’s a different security model. Cybersecurity is shifting from protecting systems that humans operate to governing systems that can act.
Human authority and operational control
The result is a growing separation between formal human authority and actual operational control. Humans may still technically be responsible for a system. There may still be an administrator. There may even be a human “in the loop”. However, if we ask a more practical question:
Can that human understand what’s happening, decide what to do and stop the system before the action becomes irreversible? Sometimes the answer is no. Systems operate too quickly. Decision chains cross too many services. One algorithm triggers another. Machine-generated actions propagate through APIs and automated workflows. By the time the person watching the dashboard understands what happened, the system may already have executed hundreds of downstream actions. That doesn’t mean automation is bad. It means human presence and human control aren’t the same thing. A person watching an autonomous system isn’t necessarily controlling it.
Trust Break
This is where quantum risk intersects with autonomous systems. Imagine an autonomous environment in which machines decide whether to trust other machines based on certificates, signatures, cryptographic keys and digitally authenticated instructions. Now imagine weakening the cryptographic architecture beneath that environment. The first question people normally ask is:
Can the attacker read our encrypted data?
I would ask several more. Can the attacker impersonate a trusted machine? Can malicious software appear to be legitimately signed? Can a forged instruction look authentic? Can one compromised machine identity cause other autonomous systems to execute actions automatically? And if that starts happening, can a human stop it quickly enough?
This is why authentication may ultimately matter more than confidentiality in some post-quantum scenarios. NIST’s post-quantum standards don’t just address key establishment. Two of the first three standards specifically address digital signatures because signatures are fundamental to establishing authenticity and detecting modification. If confidentiality fails, information becomes exposed. If authentication fails, systems can lose the ability to determine who is issuing instructions. For autonomous infrastructure, that can be worse.
The autonomy multiplier
Automation also changes the speed of compromise. A traditional intrusion might look like this:
credential compromise → attacker access → reconnaissance → human action
An autonomous compromise could look more like this:
identity compromise → machine acceptance → automated execution → machine-to-machine propagation → cascading action
The attacker doesn’t necessarily need continuous access. They may only need to introduce one instruction that the system believes came from a trusted source. That’s the autonomy multiplier. Automation converts some cybersecurity failures from intrusion problems into propagation problems. We already design networks assuming compromise can spread. The additional challenge is that autonomous systems can spread decisions, not just malware. That distinction matters.
The Quantum Fault Line
I think organizations need to look at post-quantum exposure across three dimensions. Cryptographic Exposure: How dependent is the system on quantum-vulnerable cryptography? Machine Autonomy: How much authority can software exercise without human approval? Human Control Distance: How difficult is it for a human to understand, interrupt, contain or reverse what the system is doing? The highest-risk systems sit where all three are high. That intersection is the Quantum Fault Line.
Consider a legacy database containing old, encrypted records. It may have high cryptographic exposure but almost no autonomous authority. Now consider an AI-enabled operational platform that can authenticate to multiple systems, issue instructions, trigger transactions and modify infrastructure. If its trust relationships depend on vulnerable cryptographic infrastructure and humans can’t quickly interrupt its decisions, the risk profile is fundamentally different. The same logic applies to financial infrastructure, cloud orchestration, telecommunications, defense systems, software supply chains, autonomous transportation and parts of critical infrastructure.
The question isn’t simply, “Are we quantum safe?” The better question is, “What happens if trust becomes uncertain while the machines keep operating?”
Crypto-agility won’t solve this by itself
Organizations need cryptographic inventories. They need to know where RSA and elliptic-curve systems exist. They need post-quantum migration plans, crypto-agile architectures, certificate strategies, vendor assessments and protections for long-lived data. NSA guidance already calls for national security systems to transition to quantum-resistant algorithms, including software and firmware signing, certificates and network components.
But replacing algorithms doesn’t answer the governance problem. Which machines can act autonomously? Which decisions can cause irreversible consequences? Which systems can authorize other systems? How far can a compromised machine identity propagate? Who can stop an autonomous process? How quickly? And can the organization reconstruct why the machine acted after the fact? Those are control questions, not cryptography questions.
From Zero Trust to Verifiable Control
Zero Trust gave cybersecurity a useful rule: don’t assume something is trustworthy because of where it sits on the network. The next step may be broader. Don’t just verify identity. Verify control. We need to know who or what is acting, what authority it has, where that authority came from, what decision produced the action and whether a human can meaningfully intervene. Call it Verifiable Control. For critical autonomous systems, identity, authorization, provenance, decision traceability, containment and human override should be treated as parts of the same security architecture. That last part matters. An emergency stop that takes 45 minutes to invoke isn’t meaningful control over a system making decisions in milliseconds.
The real post-quantum question
Quantum computing isn’t going to flip a switch one morning and suddenly make the internet stop working. The transition will be gradual and uneven. Old cryptography will coexist with new cryptography. Legacy systems will remain deployed. Vendors will migrate at different speeds. Autonomous systems will become more capable while organizations are still trying to understand where their cryptographic dependencies live.
That overlap is the real risk. For decades, cybersecurity has quietly depended on two assumptions. The first is that the mathematics underneath digital trust remains hard enough to protect us. The second is that humans ultimately control the machines. Quantum computing puts pressure on the first assumption. Autonomous systems put pressure on the second. The most serious cybersecurity problems may emerge where those pressures intersect.
The defining question of the post-quantum era may not be whether we can keep information secret. It may be whether, when digital trust starts to fail, we can still determine who or what is actually in control.
Filip Talac
