AI Is Changing The Speed And Scale Of Cyber Risk

AI tools are helping criminals speed up vulnerability discovery, exploit development, malware variation and reconnaissance. Attackers no longer need to spend time studying weaknesses, weaponizing them or building distribution channels because the kill chain can now be compressed exponentially.

Social engineering shows what this looks like in practice.

AI helps personalize messages and generate variations at scale. AI is also supporting convincing voice, video and text-based impersonation. Financial transactions, credential sharing, file sharing, executive instructions and vendor relationships are at risk due to AI attacks.

​There is another facet of AI risk: AI inside the business. Employees are using productivity tools to summarize meetings, research tools to conduct sensitive research, AI browsers and even code generators. Increasingly, they are also beginning to use agentic AI systems that can act, decide and interact across multiple tools and workflows on their behalf. While some may be approved and governed by the organizations, others are being used without authorization, giving rise to shadow AI.

As these systems become more autonomous, the need for guardrails becomes far more urgent: Clear usage policies, access controls, human oversight, data boundaries, audit trails and technical restrictions are essential to ensure these tools do not expose sensitive information, take unauthorized actions or create risks at speed and scale.

So, there are two distinctions to be made here. The first is harnessing AI to launch attacks against an organization, and the second is when attackers use prompt injection, poisoned inputs and excessive permissioning to influence AI output. Both are equally dangerous.

It’s no surprise to learn, according to World Economic Forum research in collaboration with Accenture, that 94% of security leaders expect AI "to be the most significant driver of change in cybersecurity in the year ahead," while 87% see "AI-related vulnerabilities as the fastest-growing cyber risk."

Quantum Makes Long-Term Security A Present-Day Issue

While AI is compressing the response window, quantum is compressing the planning window. This means you need to begin planning for a post-quantum threat landscape now.

One of the most urgent post-quantum issues is called “harvest now, decrypt later” (HNDL), where adversaries capture encrypted data today and store it until quantum computers are capable of breaking the public-key cryptography that protects it.

If you don’t want to be caught on the back foot when quantum computing dents your encryption posture, it's time to transition to quantum-resistant cryptography now. The process is lengthy, and it involves mapping where encryption is used, which applications depend on vulnerable algorithms, which vendors are involved, which certificates and keys matter and which systems cannot be changed quickly.

Already, NIST is offering post-quantum cryptography (PQC) standards. Meanwhile, security vendors are moving post-quantum protection from theory into live enterprise security platforms by embedding quantum-safe encryption into secure access service edge (SASE), zero trust, secure web gateways and wide area network (WAN) connectivity. The market is acting as a bellwether for such a transition, with investments in PQC set to go from $1.2 billion in 2026 to $13.3 billion in 2035, according to Juniper Research.

Post-quantum risk is no longer a distant concern. Kicking the can down the road can leave organizations with less time to fix a deeply embedded cryptographic problem.

The Roadmap For Security Leaders​

Preparing for these risks involves a multistep approach that addresses key vulnerabilities from both AI and quantum computing: ​​

• Conduct a risk assessment. The combination of unsanctioned AI use, sensitive data exposure, autonomous task execution and limited organizational visibility creates elevated operational, security, compliance and reputational risk. The risk increases further with agentic AI because the technology can move beyond assisting employees to acting on their behalf, which expands the likelihood of error, misuse, credential abuse, data leakage and unintended business disruption.

• Accelerate patching. AI helps attackers discover vulnerabilities and exploit them quickly. You will not have enough time to patch this vulnerability using a traditional ad hoc approach. Ensure you have clearer asset visibility and integrate patching into automated, AI-driven workflows that prioritize vulnerabilities and reduce delays in fixing them.

• Co-opt AI for defense. Embed AI into your defensive posture for pattern recognition to identify vulnerabilities, detect abnormal behaviors and reduce exposure before attackers are able to move freely across the IT environment.

• Leverage threat models for AI tools. Get better control over your AI assets by evaluating AI tools against risks such as prompt injection, data leakage, poisoned inputs, credential exposure and over-permissioned access.

• Control shadow AI. Create an inventory of AI tools in use, implement comprehensive role and function-based usage policies and keep an eagle eye over logging and the kind of information that is being shared with external AI platforms.​

• Review credentials, permissions and AI agents. Make sure you have clarity into the credentials being used by AI agents, their access rights and the actions they can take, and ensure human oversight over high-impact actions and output.

• Build a post-quantum security posture. Post-quantum migration might take years. Organizations should start the process now by appointing a program owner, securing executive sponsorship, inventorying cryptographic dependencies and planning how software, systems, certificates and vendors will move to quantum-resistant protections.​

Closing Thoughts

Cybersecurity fundamentals don't change with AI and quantum. The priority is to strengthen and evolve the security posture. It’s not about chasing every security headline but about ensuring you can quickly respond to the evolving threat landscape.

Having someone on your team or a trusted partner who can rethink security for AI systems and understands the promise and peril of frontier models can be invaluable in helping you stay ahead of threats that are evolving faster than ever.​

Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?