AI and quantum computing raise new identity and cryptography risks

At a glance

What this is: This is an analysis of how AI and quantum computing intersect, with the central finding that their combination can accelerate both defensive capability and identity and cryptographic risk.

Why it matters: It matters because IAM, NHI, and cryptography programmes may need to account for faster attack capability, weaker explainability, and future decryption risk at the same time.

Context

AI and quantum computing are being discussed here as converging technologies rather than separate trends. The article argues that the fusion changes the identity and cryptography problem space because it affects how quickly systems can process data, how well they can discover patterns, and how exposed today’s trust anchors may become.

For identity security teams, the important question is not whether the technologies are impressive but which assumptions break when compute power scales faster than current control models. That affects machine identity protection, cryptographic planning, and how much confidence practitioners can place in static trust boundaries.

Key questions

Q: How should security teams prepare for quantum risk in identity systems?

A: Security teams should inventory all cryptographic dependencies, prioritise systems that protect high-value or long-lived data, and begin testing quantum-resistant migration options. The goal is to reduce exposure before adversaries can exploit store-now, decrypt-later scenarios. This is especially important where machine identities, certificates, and signing workflows create durable trust.

Q: Why does quantum computing matter to machine identity security?

A: Machine identities often rely on certificates, keys, and signed trust assertions that are only as strong as the cryptography behind them. If quantum computing undermines those primitives, the issue becomes identity assurance, not just data confidentiality, because workloads and services may no longer be able to prove who they are.

Q: What is the business impact if organizations delay post-quantum planning?

A: Delayed planning increases the chance that sensitive data will be harvested now and decrypted later, while identity infrastructure remains anchored to weakening algorithms. That creates long-duration exposure, especially for records, signatures, and credentials that must remain trustworthy for years rather than months.

Q: How do teams decide where AI helps and where it increases risk in quantum programmes?

A: Use AI where it improves analysis, optimization, and error correction, but do not let that hide unresolved trust, governance, or explainability gaps. The decision point is whether AI is improving observability and readiness, or merely making the underlying quantum risk look more manageable than it is.

Technical breakdown

Quantum computing and cryptographic trust boundaries

Quantum computing threatens the assumptions behind classical public-key cryptography because it can make hard mathematical problems easier to solve at scale. The article specifically points to RSA and ECDSA, which underpin a large share of identity, signing, and trust infrastructure. If those primitives weaken, the issue is not just confidentiality but the integrity of authentication, signing, and verification workflows that depend on them. That creates a long-tail risk for identities, certificates, and systems that rely on durable cryptographic trust.

Practical implication: inventory cryptographic dependencies now so identity and signing controls can be prioritised by exposure.

AI as an accelerator for quantum operations

The article also argues that AI could help quantum computing by improving decision-making, analysis, optimization, and error correction. Error correction matters because quantum systems are fragile, expensive, and difficult to stabilise. AI-assisted tuning could shorten the path from experimental systems to more practical ones, which means the risk horizon for cryptographic disruption may compress faster than many programmes expect. That does not make quantum ubiquitous overnight, but it does change planning assumptions for defenders.

Practical implication: treat AI-assisted quantum progress as a planning variable in cryptographic migration timelines.

Explainability and bias get worse when AI and quantum combine

The article highlights a less obvious risk: layering AI and quantum systems can magnify complexity, reduce transparency, and amplify bias already present in the data. In identity terms, that matters because assurance depends on being able to explain why a system trusted a subject, a token, or a workflow. When model behaviour becomes harder to inspect, governance has to rely on evidence, provenance, and control boundaries rather than confidence in model output. That is a material shift for security decision-making.

Practical implication: require stronger provenance and oversight where AI decisions influence identity or cryptographic trust.

Threat narrative

Attacker objective: The attacker objective is to break or undermine the cryptographic foundations that protect identities, communications, and sensitive data.

1. Entry begins with threat actors obtaining sufficiently powerful quantum capability, which the article frames as a future but plausible escalation in offensive capacity.
2. Credential or trust compromise follows when quantum systems can attack RSA and ECDSA, undermining the cryptographic roots that protect identity and data.
3. Impact arrives through store-now, decrypt-later risk, more sophisticated attacks, and the potential collapse of trust in existing cryptographic assurances.

Breaches seen in the wild

• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
• CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity assurance now depends on cryptographic endurance, not just current-day access control: The article’s core risk is that RSA and ECDSA may not remain durable trust anchors as quantum capability advances. That shifts identity security from a purely operational control problem into a cryptographic migration problem. Practitioners should treat the lifetime of protected identities and the lifetime of cryptographic trust as the same planning horizon.

Quantum-enhanced AI compresses the gap between discovery and exploitation: If AI helps quantum systems optimise analysis, error correction, and decision-making, the offensive and defensive cycle can accelerate together. That matters because security programmes are often designed around slower technology adoption curves. Practitioners need to assume faster capability maturation in the threat environment, even if practical quantum deployment remains uneven.

Explainability becomes an identity governance requirement, not a model quality metric: The article correctly notes that complexity, transparency, and explainability become more difficult when AI and quantum are layered. For identity teams, this is not a theoretical concern because trust decisions must be auditable when they affect certificates, signatures, and privileged access. The implication is that governance must move from opaque confidence to evidence-backed assurance.

Quantum risk is already an identity problem because ‘keys to the kingdom’ are the target: CyberArk’s discussion of threat actors gaining the keys to the kingdom is a reminder that quantum is not just a compute story. It is a control-plane story about who can still be trusted when foundational cryptography weakens. That means machine identity and PKI planning belong in the same risk conversation as quantum readiness.

Ephemeral trust will matter more than durable trust constructs: As cryptographic certainty erodes, programmes will need shorter trust lifetimes, stronger revocation discipline, and better visibility into where identity assertions are consumed. The article does not spell out that operating model, but it points clearly toward it. Practitioners should prepare for a world where trust is refreshed more often and assumed less often.

What this signals

Post-quantum planning is already an identity programme concern: Teams should not wait for quantum hardware to become mainstream before mapping the authentication, signing, and certificate paths that would be exposed first. The practical question is where trust assumptions last longer than the cryptography that supports them, because that is where migration pressure will surface earliest.

AI will likely compress the operational timeline around quantum readiness: If AI continues to improve optimisation and error correction in quantum systems, defenders may have less time than expected to modernise trust infrastructure. That makes inventory, prioritisation, and dependency mapping more valuable than speculative roadmap debate.

Cryptographic endurance is becoming a governance metric: Identity programmes should be able to explain not only who is trusted today but how long that trust remains defensible. In practice, that means treating machine identity and certificate lifespan as strategic controls, not background implementation details.

For practitioners

• Map cryptographic dependencies across identity systems Identify where RSA, ECDSA, and related primitives support authentication, signing, certificate validation, and system trust so migration risk can be prioritised.
• Build a post-quantum migration inventory Catalogue certificates, keys, workloads, and service dependencies that would be affected if current cryptographic assumptions weaken, including externally facing and internal trust paths.
• Separate AI acceleration from crypto readiness Do not treat AI-enabled analysis gains as proof that cryptographic trust is safe. Evaluate identity assurance and key management on their own migration timelines.
• Review where machine identities depend on long-lived trust Focus on workloads, certificates, and non-human credentials whose validity may outlast the assumptions behind the cryptography that secures them.
• Add explainability checks to identity governance Require traceable evidence for high-impact trust decisions where AI-assisted systems influence authentication, signing, or access outcomes.

Key takeaways

• AI and quantum computing together create a dual-use risk picture in which faster analysis, better optimisation, and weaker cryptographic assumptions can all emerge at once.
• The main exposure is not abstract computing power but the trust fabric behind identity, signing, certificates, and long-lived protected data.
• Practitioners should inventory cryptographic dependencies now, because post-quantum readiness is increasingly an identity governance issue as much as a cryptography issue.

Key terms

• Post-Quantum Cryptography: Cryptographic algorithms designed to remain secure against attacks from sufficiently powerful quantum computers. In practice, PQC is a migration problem as much as an algorithm problem because organisations must replace trust anchors, certificates, and secrets without breaking identity-dependent systems.
• Store now, decrypt later: An attacker captures encrypted data today with the expectation that future cryptographic advances will make it readable later. This is especially relevant where identity traffic, secrets, or certificates protect information that must remain confidential for years.
• Cryptographic agility: The ability to change cryptographic algorithms, key lengths, or trust models without reworking every application. For machine identities, it reduces the risk that long-lived services will fail when standards shift or when post-quantum migration becomes necessary.
• Machine Identity: The digital identity of a machine, device, or workload, such as a server, container, or VM, used to authenticate it within a network. Sometimes used interchangeably with NHI, though NHI is the broader category.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.