Moe Ibrahim, Vice President of Sales Engineering, Asia Pacific and Japan, Exabeam |
GUEST OPINION: Quantum computing is quickly evolving from being a theoretical risk to a significant challenge for IT security.
Once expected to remain a decade away from practical application, quantum capability is now being discussed in timeframes as short as two to three years, largely due to advances in artificial intelligence accelerating research and optimisation in the field.
There is a growing consensus that the technology will fundamentally alter the economics of cyberattacks, enabling adversaries to process cryptographic problems at speeds that render many current protections obsolete.
The concern is not just future risk. Encrypted data being harvested today could be decrypted once quantum capability matures, creating a delayed but severe security event. For Australian enterprises, particularly those in finance, energy, telecommunications, and government services, the implications of this are significant.
Encryption under pressure
Much of today’s digital security architecture relies on public-key cryptography standards such as RSA, Elliptic Curve Cryptography, and Diffie-Hellman. These systems are designed around computational difficulty: problems that are extremely hard for classical computers to solve within a useful timeframe.
Quantum computing changes that assumption. By dramatically accelerating factorisation and discrete logarithmic problems, quantum systems could reduce what currently takes months or years of computation to seconds or microseconds in some scenarios.
Even increasing key lengths, moving from 2048-bit RSA to 4096-bit or beyond, may only provide temporary relief. The deeper issue is structural, and organisations may need to transition to post-quantum cryptographic systems entirely rather than incrementally scaling existing approaches.
This creates a significant challenge for enterprise architecture teams. Cryptographic agility – designing systems that can swap encryption methods without major redesign – will become essential. Without it, organisations risk being locked into legacy protections that degrade rapidly once quantum capability becomes commercially available.
Machine learning becomes an attack surface
While quantum computing dominates corporate attention, machine learning systems are increasingly identified as a parallel security vulnerability. As enterprises embed AI into decision-making, operations and automation, the models themselves become high-value targets.
Threat scenarios include adversarial inputs designed to deceive models, inference attacks that extract sensitive training data, and model inversion techniques that reconstruct confidential information.
Data poisoning and backdoor attacks can subtly corrupt training datasets, leading to manipulated outputs that may evade detection for extended periods.
Advertisement
Model theft is another emerging risk, where attackers extract proprietary algorithms or replicate model behaviour for competitive or malicious use. The result is not only data loss, but potential erosion of intellectual property and strategic advantage.
The need for quantum readiness programs
Quantum risk is not solely a technology problem, but a governance and strategic planning issue. A structured quantum readiness program is increasingly being positioned as a necessary step for enterprise resilience.
Such programs typically begin with a full cryptographic inventory designed to identify where encryption is used across systems, how keys are managed, and which business functions depend on them. This mapping allows organisations to prioritise assets based on criticality and exposure.
From there, organisations are expected to pilot post-quantum cryptographic algorithms in controlled environments, often using hybrid models that combine classical and quantum-resistant techniques. This staged approach allows for gradual migration while maintaining operational continuity.
Critically, the emphasis is on abstraction and automation. Cryptographic systems should not be hard coded into applications but instead managed through flexible layers that allow rapid swapping of algorithms as standards evolve.
Immediate steps
The practical response framework being recommended to enterprises focuses on three parallel tracks: cryptographic transition, machine learning security, and operational governance.
On cryptography, organisations are encouraged to establish inventories, classify data sensitivity, and begin phased testing of post-quantum algorithms. Early adoption of standards being developed by bodies such as NIST is expected to be a key pathway.
On machine learning, the focus is shifting toward resilience engineering. This includes limiting model output exposure, strengthening API controls, implementing anomaly detection for model behaviour, and enforcing strict data provenance rules to prevent poisoning attacks.
Governance and operations involve continuous monitoring systems, incident response playbooks capable of operating at machine speed, and clear escalation pathways. Some organisations are also beginning to explore “human-on-the-loop” models, where automated systems operate independently but remain subject to rapid human oversight in critical scenarios.
The overarching theme is agility. Organisations that can rapidly adapt cryptographic standards, retrain models, and respond to emerging vulnerabilities will be better positioned than those relying on static security assumptions.
The question is no longer whether quantum computing will change cybersecurity, but whether organisations are preparing quickly enough to avoid being caught on the wrong side of that change.
Advertisement