As a Marvel fan myself, I could not resist asking Ramesh Nagarajan, head of quantum education at Eigensystems, whether this was closer to something out of Age of Ultron than a traditional cyberattack. He didn’t laugh it off.
Speaking at a media session held ahead of the “Y2Q Horizon: Preparing Leaders for Post-Quantum Cryptography” forum organized by the Asian Institute of Management (AIM) and Accumena Reliable Solutions (ARS), Nagarajan, a Marvel fan himself, told me the idea of rogue AI agents using quantum computers to attack systems is “all too real.”
He painted a picture that sounded less like a hacker in a basement and more like a plot device: an AI agent, not a human, wielding quantum power to break classical defenses. He also told me that people are already training AI to harm other people, which makes the scenario less speculative than it sounds.
“If you don’t do something now, the threat of that is becoming more real by the day,” he said.
What struck me was that he wasn’t speaking in hypotheticals. The fiction, in his view, is already catching up to reality.
What is post-quantum cryptography?
Quantum computers use properties like superposition and interference to solve certain problems far faster than classical computers. The danger lies in what they can do to encryption.
Today’s digital economy rests on RSA and elliptic curve cryptography (ECC), which protect bank transactions, emails, healthcare records, and HTTPS connections.
A cryptographically relevant quantum computer, known as CRQC, could break that protection in hours or days, compared to the trillions of years a classical computer would need. Post-quantum cryptography (PQC) is the response: new algorithms designed to withstand quantum attacks.
Nagarajan stressed that organizations do not need a quantum computer to begin preparing.
“You don’t need a quantum computer to plan for the day the quantum computer is going to come,” he said.
The scale of migration
The work is not a simple software patch.
“Cisco routers, switches, load balancers, firewalls, middleware, application logic, presentation logic, all need to be migrated,” Nagarajan said.
Every RSA and ECC implementation must be replaced, across banking, payments, healthcare, and cloud services. Migration also cannot happen in isolation.
“If they are weak, that will be used as an attack point to get into your network,” he warned, referring to business partners and cloud providers.
He described the approach as a “Noah’s Ark of IT,” running classical and quantum-safe systems side by side until the transition is complete.
Harvest now, decrypt later
Nagarajan explained that nation-states and threat actors are already practicing “harvest now, decrypt later,” capturing encrypted traffic today with the intention of decrypting it once quantum computers mature.
Long-held secrets, from government communications to healthcare records, are already exposed in principle.
Timeline and urgency
Estimates for Q-Day vary. Some say a decade, others five years. But the pressure is tightening. Nagarajan noted that NIST recently accelerated its timeline, requiring US government systems to be quantum-secure by December 31, 2030.
Because major vendors like Amazon and Microsoft must comply, the requirement will cascade down to their partners and customers worldwide.
No standard, no time to waste
One major obstacle stands out: there is no agreed migration standard yet.
“Three years from now, a possible tsunami is coming, no industry standard. Can you believe it?” Nagarajan asked.
Until a standard emerges, he recommended that organizations take four concrete steps now. First, build a Cryptographic Bill of Materials (CBOM), recording every cryptographic asset across the OSI stack, because “you cannot migrate what you cannot see.”
Second, deploy observability tools, since “no one tool provides everything. You need three or four of this.”
Third, adopt hybrid mode, running quantum-safe and classical systems in parallel. Fourth, plan the full transition, covering core banking, retail banking, wealth management, payment systems, and healthcare.
The good news
Despite the urgency, Nagarajan offered optimism. “Nobody’s in front or behind except for these couple of countries, the US and China. Everybody’s in the same boat. That’s the good news.”
For countries like the Philippines, he said, “the future of any quantum program has not been written yet.”
