AI is already helping some threat groups automate and accelerate cyber operations, while quantum computing poses a different, prospective risk: a sufficiently capable future quantum computer could break certain cryptographic systems. Today’s quantum computers cannot do that. Organizations should therefore manage AI-related risks in current security operations while beginning the longer work of finding and replacing cryptography that may be vulnerable to future quantum attacks.
How is AI already changing cyber threats?
AI is appearing as an operational aid in reported malicious activity, not as a necessary ingredient in every attack. ENISA’s October 2025 threat landscape describes threat groups using commercial and diverted large language models to automate social engineering and speed up malicious-tool development. It also reports AI-assisted research and reconnaissance, attempts to evade anomaly detection, and the use of synthetic identities or communications.
As an Amazon Associate I earn from qualifying purchases.
These examples come from ENISA’s analysis of incidents from July 1, 2024, through June 30, 2025. The agency says public evidence of AI being misused as a tool is more common than evidence of direct compromise of an AI system. That distinction matters: an attacker using an AI service to help with a campaign is a different problem from an attacker manipulating a model or compromising the components that supply it.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →ENISA’s later landscape summary covers incidents from January 1 through December 31, 2025. It reports 4,709 hacktivist claims against EU Member States during that period; a claim is not the same as a verified successful intrusion. It also reports more than 48,000 new CVEs in 2025, a 22% increase from the prior year. These figures describe different measures of the broader threat environment; neither establishes that AI caused the activity or vulnerabilities counted. ENISA’s 2026 threat-landscape page provides the reporting context.
#1 Best Overall
AI systems and their supply chains can also be targets
AI introduces security questions beyond how attackers use it. ENISA discusses malicious AI lures, compromised AI supply-chain components, and proof-of-concept attacks on model behavior. Organizations that deploy AI need to account for the security and trustworthiness of the systems themselves, including the services and components they depend on. ENISA’s AI and next-generation technologies overview addresses both cybersecurity risks and uses of AI in security.
Can quantum computers break encryption now?
No. The U.S. Government Accountability Office’s October 6, 2026 report states that today’s quantum computers cannot yet break the cryptography it discusses. The concern is a future machine capable of threatening certain cryptographic systems, not a current ability to decrypt protected data at will.
If such a cryptographically relevant quantum computer is developed, it could threaten some systems used for authentication and data confidentiality. One scenario is “harvest now, decrypt later”: an adversary captures and stores encrypted data today in the hope of decrypting it in the future. This does not mean every encrypted data type or cryptographic algorithm is equally vulnerable.
The arrival date is uncertain. GAO reports that most industry experts believe a cryptographically relevant machine could be developed as soon as the 2030s, but estimates vary widely. The 2030s are a possibility cited by experts, not a guaranteed deadline or proof that such a machine already exists.
What is post-quantum cryptography?
Post-quantum cryptography (PQC) refers to cryptographic approaches intended to protect systems against attacks from future quantum computers. It is a migration effort: organizations need to identify where vulnerable algorithms are used, then plan to replace or update affected systems. It is not a response to today’s quantum computers breaking encryption.
NIST’s post-quantum cryptography overview says three PQC standards are ready for implementation. NIST advises organizations to locate uses of vulnerable algorithms and plan system updates or replacements. Its IR 8547 transition document describes moving from quantum-vulnerable algorithms to post-quantum digital-signature and key-establishment schemes. NIST says federal agencies are required to use the standards; many governments, national cryptographic authorities, and standards organizations have also adopted them.
Rank #3
What should organizations prepare for?
AI security and PQC migration are related but separate workstreams. PQC does not prevent AI misuse, and AI tools do not eliminate the need to update vulnerable cryptography. The appropriate work depends on whether the concern is malicious use of AI, security of an AI system, or future risk to cryptography.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errors| Workstream | Threat addressed | Time horizon | Practical work |
|---|---|---|---|
| AI threat operations | Threat groups using AI to support social engineering, reconnaissance, tool development, or evasion | Reported activity now; specific methods and scale can change | Threat-model AI-assisted activity, monitor relevant systems and accounts, and ensure incident-response processes can handle suspicious AI-enabled activity. |
| AI system security | Malicious lures, compromised supply-chain components, or attacks on model behavior | Current security concern as organizations adopt AI | Assess AI systems and dependencies, include them in security and vulnerability-management processes, and plan for incident tracking, response, reporting, and indicator sharing. |
| PQC migration | Future quantum attacks against certain vulnerable cryptographic systems | Prospective capability; arrival timing is uncertain | Inventory cryptographic uses, identify vulnerable algorithms, test replacements and interoperability, and fund and plan system updates. |
Start with an inventory and a migration plan
For PQC, an inventory is a practical first step because an organization cannot prioritize systems it has not identified. Record where cryptography is used, which algorithms and dependencies are involved, and which systems need testing or replacement. Build a plan that accounts for interoperability, funding, expertise, and the time required to update systems. NIST’s standards and transition guidance provide the implementation starting point.
The obstacles are not merely theoretical. In its 2026 public report, GAO found that none of 24 selected U.S. federal agencies fully addressed the PQC preparation practices it evaluated. It identified gaps involving cryptographic expertise, inventory processes, funding identification, and testing plans. That finding applies to those selected agencies and that review—not to every federal agency, private company, or organization.
Include AI in security operations without treating it as a substitute for security
AI can also support defense. The White House’s June 6, 2025 executive order says AI has potential to help identify vulnerabilities, scale threat detection, and automate cyber defense. It directs federal agencies to incorporate management of AI software vulnerabilities and compromises into vulnerability-management processes, including incident tracking, response, reporting, and indicator sharing. ENISA likewise notes that AI techniques can enhance security operations and help mitigate adversarial attacks, while emphasizing the need to secure and establish trust in the AI systems being used.
For organizations, that means assessing AI tools as part of the security environment: understand what systems and data they touch, how their components are maintained, and how an AI-related compromise would be detected and handled. Using AI for defensive work can complement security operations; it does not remove the need for human oversight, sound incident response, or PQC migration.
Keep U.S. federal deadlines in their proper scope
The June 6, 2025 U.S. executive order directed CISA, in consultation with NSA, to publish and regularly update product categories in which PQC-supporting products are widely available. It also set a direction for federal agencies to support TLS 1.3 or a successor as soon as practicable and no later than January 2, 2030. These are U.S. government directions, not a universal deadline imposed on every private organization or country. Organizations outside that scope should follow applicable requirements and use NIST guidance to plan their own migration.
Best Value
How do the two technologies change the security timeline?
AI and quantum computing should not be treated as one combined “future threat.” AI-related malicious activity is already described in incident reporting, alongside defensive applications and risks to AI systems. Quantum risk is a future cryptographic capability whose arrival remains uncertain, but whose potential consequences make early migration planning prudent. Security teams can address present AI-related exposure and begin PQC inventory and testing in parallel, with separate owners, plans, and measures of progress.
For additional operational context, ENISA’s July 7, 2026 publication, ENISA’s view on cybersecurity in the Frontier AI Era, offers an initial set of recommendations for authorities, defenders, and service providers developing capabilities for machine-speed threats. ENISA describes these recommendations as an evolving starting point, not an all-inclusive checklist.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
