AI and Quantum Are Reshaping Security Budgets
Two technology shifts that each would have reshaped cybersecurity on their own are arriving simultaneously, and security leaders say the combination is forcing them to tear up planning cycles that used to run a full year.
Key facts
The two shifts: The arrival of agentic AI, and the approaching impact of quantum computing on encryption
The symptom: Security planning horizons shortening from twelve months to six
The AI problem: AI agents that act autonomously create governance and accountability questions traditional security models weren't designed for
The quantum problem: "Harvest now, decrypt later" — attackers collecting encrypted data today to decrypt once quantum capability matures
What to do: Inventory where your encryption lives, and treat post-quantum migration as a multi-year project starting now
Why are security plans being rewritten mid-year?
Chris Konrad, Vice President of Global Cyber at World Wide Technology, told CRN he discarded the cybersecurity business strategy he wrote at the start of 2026 and rewrote it by July. He said he no longer works on one-year business plans and has moved to six-month planning cycles.
The driver, according to the CRN analysis, is that two market shifts each considered once-in-a-generation are converging on customers at the same time.
What is the quantum threat, in plain terms?
Most of the encryption protecting internet traffic, financial transactions and stored data relies on mathematical problems that ordinary computers cannot solve in a practical timeframe. A sufficiently powerful quantum computer could solve some of them.
That machine does not exist yet, and credible estimates for when it might vary widely. The reason it matters now is a tactic known as "harvest now, decrypt later" — attackers collecting encrypted data today with the intention of decrypting it once quantum capability arrives. Data that must stay confidential for a decade is already exposed to that timeline.
The National Institute of Standards and Technology, the U.S. standards body known as NIST, has published post-quantum cryptography standards — encryption designed to resist quantum attack. The migration is the hard part: organizations must find every place encryption is used, which for most is a genuinely unknown inventory.
How does agentic AI change the security picture?
By compressing the time between a signal, a decision and a consequence. That framing comes from GovWare, the Singapore cybersecurity conference running October 13–15 under the theme "Anchored in Unchanging Principles: Cyber at Agentic Velocity."
Richard Ireland, CEO of GovWare, said cybersecurity took decades to evolve from a specialist technology concern into an economy-wide responsibility, and that AI is now driving another transformation at far greater speed. As systems make decisions and take action with more autonomy, he said, connecting government, industry and practitioners becomes more important rather than less.
The practical questions the shift raises are about delegated authority: what an AI system is permitted to do without a human approving it, who is accountable when it acts wrongly, and how an organization proves what happened afterward.
What should a business without a security team actually do?
Three things, in order.
Find out where your sensitive data is encrypted and who controls those keys. You cannot migrate what you cannot locate, and the inventory takes longer than the migration planning.
Ask your major vendors about their post-quantum roadmap. For most small and mid-sized organizations, this transition will arrive through software updates from vendors rather than through in-house engineering — which makes vendor readiness your readiness.
Before deploying any AI tool that can take actions rather than only produce text, write down what it is allowed to do and what requires human approval. That document is the thing auditors, insurers and your own incident response will need later.