Is cryptographic infrastructure ready for AI and quantum?

The first is artificial intelligence. AI adoption is generating an increase in the presence of machine identities within enterprise networks, beginning to access sensitive data and applications and creating efficiencies in business processes. At the same time, AI is also making it easier for cyberattackers to analyse software and systems for vulnerabilities, steal data at scale, and automate attacks.

The second is quantum computing. Large-scale cryptographically relevant quantum computers do not exist today, but their potential development threatens the integrity of conventional public-key cryptography, which until now has worked on the basis that the underlying algorithms are too resource-intensive for classical computers to reverse-engineer. The risk of Harvest Now, Decrypt Later (HNDL) approaches to sensitive data is a very real one. 

With today’s cryptographic infrastructure under quantum-related risk, it all points to the need for organisations to begin their audit and migration now, particularly for highly sensitive information that must remain confidential.

The relationship between AI and quantum is particularly important because they create different pressures on the same cryptographic foundations – and they also have the potential to interact with each other in interesting ways. 

AI is a challenge of both scale and the ability to ensure cryptographic infrastructure can keep up with the velocity at which data can be ingested and analysed. As the prevalence of AI applications and agents grows, it means more identities, connections, data and machine-to-machine interactions requiring authentication and protection. Organisations therefore need cryptographic infrastructure capable of supporting rapidly expanding workloads without creating performance bottlenecks.

The growth of quantum meanwhile raises a different problem - algorithmic transition.

Many of the public-key algorithms underpinning today's digital infrastructure could eventually become vulnerable to sufficiently capable quantum computers. Emphasising the increasing need for organisations to move now, Europol recently released a report in conjunction with University Carlos III of Madrid (UC3M) on the topic, specifically analysing the risks from HNDL and making a range of recommendations for organisations, from deprecating legacy protocols, to securely deleting unnecessary sensitive data and making investments in long-term resilience.

The transition to Post-Quantum Cryptography (PQC) essentially means switching to encryption algorithms that are quantum-resistant. It requires an overhaul across the certificates, public key infrastructure, and their cryptographic services more broadly.

The migration is already beginning. The 2026 Thales Data Threat Report found that 59% of surveyed organisations were prototyping and evaluating PQC algorithms. It also identified the harvest now, decrypt later threat as the leading quantum concern among respondents. 

The pressing quantum threat, in combination with AI increasing the scale at which cryptography must operate, is leading to increased interest amongst organisations in improving their cryptographic agility to allow them to more quickly move in the face of changing standards.

Partly an architectural challenge, this agility refers to an organisations’ ability to discover, manage and change their cryptographic assets, algorithms and policies, without having to redesign the surrounding infrastructure every time requirements evolve.

Ultimately, organisations first need visibility into their cryptographic estate: where keys, certificates and algorithms are being used, what applications depend on them, which data they protect and how long that data needs to remain secure.

They then need infrastructure capable of supporting coexistence and transition. The scale at which encryption is used within organisations means that for many, the transition will be gradual. Conventional and post-quantum cryptography are likely to operate alongside one another for some time, making the ability to introduce new mechanisms without disrupting critical applications particularly valuable.

That is why quantum readiness should be understood as an ongoing resilience programme rather than a one-off technology upgrade. Much of the work for organisations to ‘get their house in order’ contributes to wider cybersecurity and resilience priorities at the same time – from discovering cryptographic assets and assessing sensitive-data exposure, to actively working to reduce risks. 

Thales' launch of the Luna 8 HSM (Hardware Security Module) provides one practical example of what this shift means for cryptographic infrastructure.

Luna 8 is the next generation of HSM designed to deliver the level of cryptography agility required for the post-quantum future. It provides an upgradeable architecture intended to accommodate new algorithms, standards and capabilities as requirements evolve.

Built for high-volume use cases, it is also designed to deliver the scale of enterprise encryption needs. When deployed at its maximum capacity, enterprises can get as many as 30 HSM instances per appliance, with double the density for the same rack space. 

Making the PQC transition is about more than any single HSM, however. Quantum migration is an organisation-wide discovery, inventory and transition challenge.

The organisations best prepared for what comes next will be those that prioritise cryptographic agility, so as security requirements evolve, they can be sure their data will remain secure.