AI is now firmly entangled in our everyday business. McKinsey captures this, noting that larger organizations are moving beyond experimentation to scale AI agents. The data behind AI has always been valuable, and cybercriminals have proven this point over and over. However, AI has made data more strategically valuable than ever. Vast volumes of customer, financial, operational, and proprietary information are used to train models, automate decisions, and create new services. Protecting this data is paramount. Encryption is a stalwart of protection, but as quantum computing rears its head, can we still rely on it in the coming years?
The Data That Drives AI
AI models are being trained on increasingly vast data sets. This data is an essential ingredient in AI’s ability to identify patterns and interdependencies. The appetite for training data is enormous. The data cycle includes training, testing, and validating the AI model. According to Epoch AI, the stock of human-generated public text is around 300 trillion tokens, and AI models are likely (with 80% confidence) to have fully used it between 2026 and 2032. Organizations must consider AI training data carefully, as it can include sensitive, financial, and potentially proprietary company information.
The vast amounts of data that AI requires are only one aspect of the data security question. The persistent, time-based nature of AI training data means organizations must protect it not only now but as quantum computing enters the picture. Information can be strategically important over long periods. An organization must have a way to identify this data and persistently protect it as our technologies become ever more powerful and current security techniques, like encryption, are threatened.
How AI Increases Data Exposure
Large language models (LLMs) and chatbots have created a broad data surface, opening up new routes to exposure. A recent report from the National Cybersecurity Alliance (NCA) found that 43% of employees have shared sensitive workplace information with AI tools without their employer knowing – known as shadow AI. The shared data included financial and client data. Shared chatbot conversations aren’t always private. A recent analysis of chatbot security found that over 143,000 conversations with chatbots Claude, Copilot, and ChatGPT were available on Archive.org.
The use of public data, including published copyrighted works, is well known. However, using corporate data for AI training is increasingly common. Fine-tuning and retrieval-augmented generation (RAG) use proprietary corporate data to add bespoke capability to a pretrained LLM. This bespoke LLM is then tailored to an organization’s operations. The data used to create this bespoke LLM may well contain sensitive corporate information, even customer data and PII. Maintaining security throughout the data’s use in the AI training lifecycle is a growing challenge.
AI agents have added another layer of risk to corporate data. IBM identified these risks when it analyzed a data leak at a pharmaceutical company. IBM noted that AI agents don’t need to be rogue; even when they follow protocol, data can still leak.
Securing data from AI misuse is a pressing issue now, and it will stay that way. Even if data is encrypted, the risk does not go away. The concept of “harvest now, decrypt later” describes how cybercriminals harvest encrypted data now in readiness for when quantum computing can decrypt the data. Sensitive and proprietary data, including intellectual property, does not always have a short shelf life. For example, data retention laws set required data-storage periods. Some are decades long. Regulation 11(3) of the Control of Substances Hazardous to Health Regulations 2002 stipulates that all work-related medical examinations related to hazardous substances must be stored for a minimum of 40 years. Data does not, it seems, necessarily degrade or decay; it persists, its value persists, and its security must persist. Harvesting data now leaves the door open for future quantum-enabled ransom scenarios, with cybercriminals appearing years after a breach and demanding payment for decrypted, highly sensitive company data.
The Quantum Decryption Problem
Cryptographically relevant quantum computers are not here yet, but they aren’t far off. The specter of “harvest now, decrypt later” cannot be ignored. The Global Risk Institute (GRI), in its analysis of the risk of quantum decryption of the asymmetric algorithm RSA-2048, notes that “the experts’ estimates suggest that, for cybersecurity purposes, the threat should be considered looming.” The GRI’s 2025 survey puts the likelihood of a quantum computer able to break encryption algorithms such as RSA-2048 at 28–49% within ten years, and 51–70% within 15. This leads us to one conclusion: organizations must prepare for tomorrow, today.
Preparing Data For Tomorrow, Today
The GRI suggests quantifying the risk of “harvest now, decrypt later” based on three criteria:
- Shelf life: How long do you need to keep your data secure?
- Migration time: How long will it take to move your systems to quantum-safe cryptography?
- Quantum threat time: When will a cryptographically relevant quantum computer (CRQC) be ready?
On a practical level, organizations can prepare for the risk of all three criteria, including unknowns like quantum threat time. To prepare your data for future security, you should address four key areas:
Data classification: Understanding what data is at risk is the foundation of security now and in the future. Classify data by sensitivity and risk level, and encrypt it according to those requirements.
Cryptographic inventories: By creating an inventory of all your encrypted assets, including algorithms used, protocols, keys, certificates, and dependent apps, you can prepare for your quantum migration.
Post-quantum cryptography (PQC): NIST has released three post-quantum encryption standards in readiness for quantum computing. PQC algorithms are viable on classical computing platforms and can integrate seamlessly into existing internet protocols. It is generally accepted that some current encryption algorithms, including AES-256, are quantum-safe. Others like AES-128 are partially quantum safe.
Crypto-agility: Taking your organization and its data safely into a post-quantum cryptography era requires an agile approach to your data and encryption ecosystem. Crypto-agile organizations take a holistic approach, ensuring their cryptography and data governance can adapt to both AI and quantum risks.
AI + Quantum Risk Mitigation Comes Down To Preparedness
AI and quantum computing are aligned in a way that puts data at risk from unforeseen leaks that cybercriminals can bank for future use. AI and its quantum partner create an immediate issue for organizations whose sensitive information must remain confidential for years, or even decades. As AI increases both the volume and value of organizational data, businesses need to identify which information has long-term value, understand where and how it is encrypted, and determine how easily existing cryptography could be replaced. Quantum readiness needs to become part of today’s data and cybersecurity strategy, rather than tomorrow’s technology project.
