PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchIn an InfoQ episode published October 5, 2026, Chris Swan argues that future cybersecurity depends on making security checks continuous and systematic—not relying on people to catch every risk. The conversation connects hardware-assisted memory safety, automated software-supply-chain evidence, carefully governed AI agents and the practical work of migrating to post-quantum cryptography.
What the episode covers
InfoQ editor Olimpiu Pop speaks with Chris Swan, identified in the episode as an Atsign engineer and QCon London security track host. Reflecting on QCon London 2026, they discuss how security work can be built into the systems that create and operate software. Their examples span the hardware beneath applications, the evidence produced by delivery pipelines, the permissions granted to AI agents and the cryptography organizations will need to update.
As an Amazon Associate I earn from qualifying purchases.
The connecting idea is operational rather than a claim that one tool or technique solves security: controls need to run repeatedly, produce evidence and help teams respond as systems and vulnerabilities change. Swan puts it this way: “We need to systematize those things. We need to automate them in order to have the machines constantly pay attention to what’s happening in those layers and where the vulnerabilities might be emerging.”
What is CHERI hardware memory safety?
CHERI is hardware memory-safety research from the University of Cambridge. In the episode, Swan presents hardware support as a way to reduce some memory-error risks in software ecosystems that still contain extensive C and C++ code, without requiring every existing program to be rewritten in a memory-safe language first.
#1 Best Overall
Swan discusses a possible future role for CHERI in a RISC-V Android profile and mentions selected memory-safety features in some then-current phones. These are his observations and a forward-looking possibility, not evidence that CHERI is broadly deployed in phones. The episode supplies no quantified security gain, benchmark or product comparison.
| Approach | Where protection is introduced | Adoption considerations |
|---|---|---|
| Migration to memory-safe languages | In software implementation: teams change or replace code so memory-safety properties are enforced by the language and its tooling. | Can address risks in migrated code, but legacy software and the work of changing it affect how widely and quickly protection reaches a system. |
| Hardware architectural support, such as CHERI | At the hardware and architecture level, with software and toolchain support needed to use it. | Its reach depends on compatible hardware, toolchains, operating systems and deployment; the episode does not establish broad availability or measure effectiveness. |
The approaches are not mutually exclusive: language migration changes how software is written, while hardware support can add protections beneath software when the surrounding platform supports them. Swan also gives approximate counts of open-source C/C++ and Rust lines, but the episode does not establish the underlying dataset, so those figures should not be treated as independently verified measurements.
How can security governance become continuous?
Rather than leaving governance to a late review, the episode describes generating evidence as part of software delivery. Its examples include a software bill of materials (SBOM), which records software components; SLSA attestations, which provide information about how a build was produced; and automated checks such as OpenSSF Scorecards.
| Review model | What it can provide | Important consideration |
|---|---|---|
| Manual or point-in-time review | A human assessment at a particular stage or moment. | A review can become outdated as dependencies, builds or vulnerabilities change. |
| Controls integrated into delivery | Repeatable checks and records generated as software is built and released. | Automation can make evidence more continuous, but teams still need to interpret results, own the controls and act on findings. It does not guarantee secure software. |
An SBOM and a build attestation answer different questions: one describes components, while the other records aspects of the build process. Neither alone proves that software is safe. The episode also frames the EU Cyber Resilience Act as a reason product security and SBOMs are receiving attention; that discussion is not legal advice, and the regulation’s current scope and implementation timetable should be checked against its text.
A separate policy development concerns a cryptographic bill of materials, or CBOM. In its June 22, 2026 Executive Order 14412, the White House directed CISA and NIST to publish public guidance on minimum CBOM elements. A CBOM concerns cryptographic assets used by hardware or software; it is related to, but distinct from, a general SBOM.
How does the episode frame AI in security?
Swan describes large language models as dual-use. Attackers may use them to accelerate vulnerability work, while defenders can use them to analyze source code and evaluate software before release. He says, “It has to be both. A bad guy with an LLM is a threat because they can do damage quicker and at a larger scale than they would’ve done without.” This is the guest’s assessment, not a measured comparison of attacker and defender outcomes.
The discussion’s practical governance point is to treat autonomous agents as non-human identities that need explicit limits. Fine-grained, task-specific permissions and least privilege help constrain what an agent can do. Organizations also need to be able to identify which agent or identity is acting and what authority it has. The episode does not quantify how effective AI-based testing is or establish that it is safe without human oversight.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →What does post-quantum cryptography change?
Post-quantum cryptography (PQC) refers to cryptographic algorithms or methods designed to resist attacks from both quantum and classical computers. Its purpose is to protect cryptographic operations against future quantum attacks while remaining usable on classical systems; the episode does not suggest that a cryptographically relevant quantum computer is currently available.
Best Value
Standards are only one part of migration. NIST’s post-quantum cryptography page says three finalized PQC standards are ready to be implemented and advises organizations to identify where vulnerable algorithms are in use, then plan updates or replacements. Products, services and protocols may all need changes. Inventory, library availability, interoperability and rollout therefore matter alongside choosing standardized algorithms.
NIST’s page includes a July 28, 2026 update about HAWK and states that the finding does not affect its finalized standards. A withdrawn candidate should not be confused with the three finalized standards.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.When do federal systems have to migrate to PQC?
Executive Order 14412, dated June 22, 2026, sets requirements and milestones for covered U.S. federal systems; its deadlines are not universal deadlines for private organizations. The order’s stated subsection excludes National Security Systems from the specified transition requirement.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
| Provision in the order | Stated timing or scope |
|---|---|
| Agency PQC migration leads | Agency heads are directed to identify leads within 30 days of the order. |
| OMB guidance | OMB is directed to issue guidance within 90 days. |
| Key establishment | Covered federal high-value assets and high-impact systems are directed to transition by December 31, 2030. |
| Digital signatures | Covered federal high-value assets and high-impact systems are directed to transition by December 31, 2031. |
| NIST migration pilot | The order directs completion by December 31, 2027. |
| Public CBOM guidance | CISA and NIST are directed to publish guidance within 270 days. |
These are directives and deadlines in the order, not confirmation that each action has already been completed. Executive Order 14306, dated June 6, 2025, provides earlier policy context on areas including rules-as-code, AI vulnerability management and PQC; its directives should likewise not be mistaken for verified completion.
What should organizations take from the conversation?
The episode does not offer a buying guide or claim that any one technology will remove security risk. Its practical emphasis is on making each layer manageable: understand what software contains and how it was built, constrain automated actors, track cryptographic dependencies, and plan changes before a deadline or vulnerability forces a rushed response. For PQC in particular, the first step NIST highlights is discovering where vulnerable algorithms are used; for hardware memory safety, the episode’s CHERI discussion remains a possibility dependent on compatible platforms rather than a general deployment recommendation.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
