Dejan KosuticThis article is based on an episode from the Cyber & AI Perspectives podcast. Prefer listening instead? Listen to the audio version below.
What’s the biggest cybersecurity mistake companies are making today? It might not be ignoring AI. It might be that paying so much attention to AI is making them miss everything else. So today, I’ll speak about three important trends, unrelated to AI, that we should not forget about.
AI dominates the cybersecurity conversation, but it’s far from the only trend that matters. Quantum computing, supply-chain security, and cyber resilience are reshaping how organizations need to think about cybersecurity — and focusing too much on AI could mean overlooking risks that are just as important.
It’s interesting how AI has become our main focus lately -— of course it has; we can now write faster, work faster, think faster. In cybersecurity, AI has also had a profound effect – — on the one hand, it has made attackers much more capable, and on the other, it has changed how defenders operate.
But this focus on AI makes us forget about some important cybersecurity trends that are not directly related to AI. And that’s dangerous, because while everyone is watching AI, some important things in cybersecurity are not receiving enough attention. Let me give you three examples.
1. Quantum Computing and Post-Quantum Cryptography
The first trend is quantum computing and post-quantum cryptography. Quantum computing is a new type of computing that uses the principles of quantum mechanics to solve certain kinds of problems dramatically faster than today’s classical computers. Its biggest impact on cybersecurity will be the ability to break many of the public-key encryption algorithms currently used to protect data and communications — so imagine bad actors compromising your digital identities or decrypting your most sensitive data or emails.
Quantum computing is not here yet — the most optimistic expectation is that it will become operational in 2028, but more likely it will happen in the 2030s. But that’s not the problem — the problem is the attack called “harvest now, decrypt later,” which basically means that bad actors can record your communications today and decrypt them later when quantum computing becomes a reality. Just imagine someone reading all of your VPN traffic or financial transactions from today a couple of years from now. This is why post-quantum cryptography, or PQC, is important today, not just later on.
2. Supply-Chain Security and Third-Party Risk
The second trend is supply-chain security. It is not something that is as new as quantum computing, but it is nevertheless at least as important. Nowadays, it is impossible to find a company that doesn’t use cloud services like virtual servers or email, and outsourced services like software development or IT support. The problem, of course, is that your security becomes as good, or as bad, as your supplier’s — and many data breaches happen because bad actors have found a way into the systems of a targeted company through their suppliers.
Some companies already manage supply-chain security effectively, and the trend is moving towards the concept of Third-Party Risk Management, or TPRM. However, the problem is that it is not easy to enforce security rules on a company that is not directly under your control, so the challenge is that this is not only a technical problem; it is also an organizational and legal problem. And because of this complexity, most companies still do not manage the security of their suppliers at all, or they manage it inadequately. When you think about the enormity of this problem, supply-chain risk may actually be a more immediate problem than AI-related cyber risk for many companies.
3. From Cybersecurity to Cyber Resilience
The third trend that I wanted to mention today is perhaps less about technology and more about how our thinking about cybersecurity is changing: Companies increasingly have to assume that, sooner or later, a serious cyber incident will affect them.
What does this mean? No matter how much effort we put into protecting our systems, incidents will most likely happen. Of course, this doesn’t mean that our cybersecurity efforts are meaningless — instead, it means that we have to stop thinking about cybersecurity only in the context of prevention. We also need to think about cybersecurity in the context of how we can continue operating after an attack. Another name for this is cyber resilience; a decade ago, business continuity was the more popular term, but nowadays even regulators are starting to use the term “resilience.”
The Bigger Picture
To summarize these three trends, quantum changes the technology, supply-chain risk changes where your security perimeter is, and cyber resilience changes the way we think about cybersecurity itself.
I’m not saying that AI is not important for cybersecurity — it is very important, and anyone working in the cyber industry must carefully watch what happens with AI. What I am saying is that AI is not the only important trend out there. So yes, watch AI very closely. But do not let AI become a blind spot in itself. Quantum will change the cryptography we rely on. Supply-chain risk means attackers don’t necessarily have to attack you directly. And cyber resilience means we have to prepare not only to prevent attacks, but also to recover successfully.
The biggest cybersecurity mistake right now might not be underestimating AI. It might be paying too much attention to AI, causing us to underestimate everything else.
To learn more about quantum, check out the podcast episode “What CISOs Must Do Now About Quantum?,” where I interview Andrew Gault and where we dig deeply into this topic.