Cybersecurity Risks

The National Institute of Standards and Technology (NIST) has released a draft of its “Cybersecurity Framework Profile for Artificial Intelligence” (open for public comment until Jan 30, 2026) to help organizations think about how to strategically adopt AI while addressing emerging cybersecurity risks that stem from AI’s rapid advance. Building on the #NIST Cybersecurity Framework 2.0, the Cyber AI Profile translates well-established risk management concepts into AI-specific cybersecurity considerations, offering a practical reference point as organizations integrate AI into critical systems and confront AI-enabled threats. The Cyber AI Profile centers on three focus areas: • Securing AI systems: identifying cybersecurity challenges when integrating AI into organizational ecosystems and infrastructure. • Conducting AI-enabled cyber defense: identifying opportunities to use AI to enhance cybersecurity, and understanding challenges when leveraging AI to support defensive operations. • Thwarting AI-enabled cyberattacks: building resilience to protect against new AI-enabled threats. The Profile complements existing NIST frameworks (CSF, AI RMF, RMF) by prioritizing AI-specific cybersecurity outcomes rather than creating a standalone regime.

Spot the difference? Sometimes the only difference between a safe site and a fake one is a single letter. And in some cases, it is not even the same alphabet. Cyber criminals now register domains that look identical to trusted brands, swapping one character for a Cyrillic or Greek equivalent, or using tricks like “rn” instead of “m”,. On a mobile screen or in a rush, your brain fills in the gaps and you click before you think. That is all they need. A few practical habits that really help: 🔍 Never trust the blue text alone What you see in an email can be different to the real link underneath. Hover over it on a laptop or long press on mobile and check the actual address before you click. ✉️ Be suspicious of “urgent” emails Anything that pressures you to act quickly, re-enter your password, or confirm bank details should ring alarm bells. Slow down, even if it seems to be from a familiar brand. 🌐 Type it yourself for anything important For banking, payments, HR portals or anything sensitive, do not use the link in the email. Open a fresh browser window and type the address manually or use a saved bookmark. 🔐 Use multi-factor authentication If someone does trick you into entering credentials, MFA can be the barrier that stops them getting into your account. The tech behind cyber crime keeps evolving, but the weakest link is still human behaviour. Share this with your team and remind them that one careless click can open the door to your entire organisation. Utilize Plc National Cyber Security Centre National Crime Agency (NCA)

As I’ve been digging into the #CybersecurityFramework 2.0, and helping clients navigate the changes, I’ve found several areas where the new additions feel pretty significant. If you’re already using the #CSF and trying to figure out where to focus first, take note of these new Categories: ◾ The POLICY (GV.PO) Category was created to encompass ALL cybersecurity policies and guidance. Now, on one hand it might seem like a "well, of course" moment to consolidate all cybersecurity policies into one place - on the other hand, policies were previously sprinkled throughout the CSF, and were tied to specific actions like Asset Management or Incident Response. Now, it's all in one area, which makes a ton of sense and simplifies things, but also means we've got to remember that this one Category covers everything! ◾ Another significant addition is the PLATFORM SECURITY (PR.PS) Category which largely pulls together key topics from the previous Information Protection Processes & Procedures (PR.IP) and Protective Technology (PR.PT) focusing on security protections around broader platform types (hardware, software, virtual, etc.). If you’re looking for things like configuration management, maintenance, and SDLC – you’ll now find them here.  ◾ The TECHNOLOGY INFRASTRUCTURE RESILIENCE (PR.IR) Category pulls largely from the previous Information Protection Processes & Procedures (PR.IP) and Protective Technology (PR.PT) as well, but also pulls in key aspects from Data Security (PR.DS). This new Category highlights the need for managing an organization’s security architecture and includes security protections around networks as well as your environment to ensure resource capacity, resilience, etc. So, what does all this mean for your organization? Whether you're just starting out, or you're looking to refine your existing cybersecurity strategies, CSF 2.0 offers a more streamlined framework to use to bolster your cyber resilience. Remember, staying ahead in cybersecurity is a continuous journey of adaptation and improvement. Embrace these changes as an opportunity to review and enhance your cybersecurity posture, leveraging the expanded resources and guidance provided by #NIST! Have you seen the updated mapping NIST released from v1.1 to v2.0? Check it out here to get started and “directly download all the Informative References for CSF 2.0” 👇 https://lnkd.in/e3F6hn9Y

🧠 Quantum computing: What business leaders need to do right now Right now, criminal and state-sponsored hackers are intercepting and storing encrypted data they cannot yet decode. Likely targets include everything from corporate secrets and medical records to legal agreements and military communications. Why would these actors bother to steal data they can’t read? Because they are betting on developments in quantum computing that will eventually let them crack this encrypted data wide open. This isn’t a fringe theory. The NSA (National Security Agency), NIST (National Institute of Standards and Technology), and ENISA (European Agency for Cybersecurity) are all treating this “harvest now, decrypt later” scenario as a live threat that is serious enough to demand immediate action. The NSA has mandated that all U.S. national security systems must transition to quantum-resistant cryptography by 2035—with new acquisitions required to be compliant by 2027. In Europe, ENISA issued updated guidance in April 2025 warning that the threat is “sufficient to warrant caution, and to warrant mitigating actions to be taken,” and recommending that organizations begin deploying post-quantum cryptography immediately. NIST has launched a parallel global effort to develop the new cryptographic standards on which these transitions will depend. The message from all three bodies is the same: Organizations run a grave risk if they wait to begin upgrades until quantum computers can break current encryption standards. That is the reason business leaders need to pay attention to quantum computing now — not because the technology is ready, but because the risk is grave, and the cost of preparation is trivial compared with the cost of being caught flat-footed. 🔗 Find out how in our new Fast Company article here: https://lnkd.in/g54y88UE.

Last week, Ethereum announced it is forming a post-quantum working group because they can read the room: cryptography isn’t a “future upgrade,” it’s a ticking dependency and a grown-up admission that digital trust has a shelf life. In 𝑵𝒐𝒘 𝑾𝒉𝒂𝒕? I called this the Big Crunch: the moment quantum collapses the economics of breaking today’s public-key cryptography. Unlike Y2K, this isn’t a bug you patch. It’s a global migration you either start early or you finish in panic. And timelines are already wobbling, Google research from 2025 suggested breaking RSA could need 20x fewer qubits than previously thought of. Unfortunately, most leaders treat quantum like a storm on the horizon: “interesting, but not today.” That’s a mistake. Attackers can already copy encrypted traffic and files now, store it, and unlock it later when quantum tools get good enough. That’s not theory. It’s a rational investment strategy from an adversary's perspective. And if a major system ever gets quietly cracked, you won’t hear about it when it happens. You’ll hear about it after someone has made money from it. After all, the incentives reward silence; think Enigma, but automated, monetized and at scale. The smart path is boring, but effective: start upgrading before the break, and form working groups like Ethereum to start today. It also means running hybrid encryption, today’s algorithms paired with post-quantum ones, across the places where trust lives: web connections (TLS), logins and identity, enterprise software, key management and HSMs, cloud services, and blockchain signatures. Do it early and you turn a cliff-edge event into a controlled rollout. Wait too long and it’s not just your future data at risk, old encrypted backups, archived emails, contracts, customer records, IP can become readable years later. In other words: you don’t just lose security going forward. You lose your history.

Happy to see my article has been published at ABP Live on "Beyond AI: Why Quantum-Safe #Cryptography Is a Business Imperative in 2025" The alarming rise in cyberattacks—both in India and globally—makes one thing painfully clear: traditional encryption is no longer enough. In India alone, businesses stand to lose ₹20,000 crore this year, while global cybercrime costs are projected to reach $13.82 trillion by 2028. Even worse? The impending quantum era threatens to render our current cryptographic systems obsolete. Technologies like RSA, which power everything from internal communications to critical external collaborations, are vulnerable to quantum-enabled decryption. So what must businesses do right now? Embrace Quantum-Safe Messaging: Opt for end-to-end encrypted platforms designed to withstand quantum attacks, especially for communications with clients, partners, and vendors. Follow Standards and Best Practices: NIST has already rolled out the first wave of Post-Quantum Cryptography (PQC) standards—like ML-KEM for encryption and ML-DSA for digital signatures. Think Strategically, Not Just Tactically: Transitioning to PQC is more than a technical upgrade—it’s a strategic initiative. Build governance, crypto-agility, and roadmap planning into your cybersecurity strategy. What the world is doing: - Europe aims to migrate to quantum-safe encryption by 2030, starting with risk assessments and awareness campaigns in 2026 - The UK’s NCSC is urging organizations to begin full migration planning by 2028 and complete it by 2035 - Setting an example in the private sector, it has integrated post-quantum encryption into its WireGuard and Lightway protocols using NIST’s ML-KEM algorithm Reports from India’s BFSI sector show a worrying lack of readiness—yet almost 58% of CISOs recognize the threat within the next three years Key takeaway: Quantum-safe cryptography isn’t a futuristic concept—it’s a present-day necessity. The threat of "store now, decrypt later" attacks means the data we transmit today may be vulnerable tomorrow. Waiting isn’t an option Whether you’re in BFSI, government, telecoms, or healthcare, the time to act is now. Let’s lead the shift toward a secure quantum future. #QuantumSafe #Cybersecurity #PostQuantumCryptography #CryptoAgility #DigitalTrust #QuantumReady #QNulabs QNu Labs

Wildwood Surgical Center waited over a year to notify patients after a June 2025 network breach exposed Social Security numbers and medical records to an unauthorised third party. The Toledo facility discovered suspicious activity in June 2025 but sent notification letters in July 2026. The compromised data includes diagnoses, treatment details and financial information, creating severe identity theft risks. This delay highlights a persistent operational flaw in healthcare cybersecurity. Organisations often prioritise containment and legal consultation over immediate transparency, treating notification as a compliance exercise rather than a critical component of patient care and trust. Yet, the deeper vulnerability lies in data architecture. Storing highly sensitive diagnostic records alongside routine billing information on the same accessible network ensures that a single perimeter failure compromises everything from medical history to bank accounts. Audit your data storage architecture immediately. Separate clinical records from financial and personally identifiable information, enforcing strict access controls so a breach in one domain cannot cascade into another. Protecting patient data requires much more than just strong firewalls; it demands intelligent separation so that a single point of failure never destroys an entire life. #CyberSecurity #DataPrivacy #Healthcare

Headline: China Cracks RSA Encryption Using Quantum Annealing—Global Data Security Now Under Pressure ⸻ Introduction: A Chinese research team has achieved a milestone with profound cybersecurity implications: successfully cracking a small RSA-encrypted integer using a quantum computer. Though modest in scale, this experiment signals that quantum systems are starting to undermine the very cryptographic foundations that secure today’s banking, commerce, and communication systems. The race to build quantum-resistant encryption is no longer theoretical—it’s urgent. ⸻ Key Details 🔓 Cracking RSA with Quantum Annealing • Researchers: Wang Chao and team from Shanghai University. • Hardware Used: A D-Wave Advantage quantum annealer, built by D-Wave Systems. • Achievement: The team factored a 22-bit RSA semiprime integer, a task previously unsolved on this class of hardware. 🔐 What Makes RSA Strong—and Vulnerable • RSA Encryption: Based on the difficulty of factoring large semiprime numbers (products of two primes). • Classical Challenge: Conventional computers require subexponential time to factor 2048-bit keys—considered secure for now. • Largest Cracked Classically: RSA250 (829-bit key) using supercomputers over weeks. • Quantum Approach: The Chinese team translated factorization into a QUBO (Quadratic Unconstrained Binary Optimization) problem, solvable by quantum annealing. 🧠 Why This is a Warning Shot • Early Stage, But Symbolic: While a 22-bit number is trivial by today’s standards, the methodology proves scalability potential. • First Step Toward Quantum Decryption: Demonstrates quantum annealers can be adapted for cryptographic tasks—not just optimization. • Signals Future Risk: Today’s encryption might withstand current tech, but scalable quantum systems could break RSA entirely in years, not decades. ⸻ Why It Matters • Global Cybersecurity Threatened: Banking, defense, healthcare, and internet infrastructure all rely on RSA and similar public-key systems. This experiment shows those systems may soon be obsolete. • Quantum Arms Race Accelerates: The demonstration by Chinese researchers will likely intensify global investment in both quantum computing and post-quantum cryptography. • Urgent Need for Migration: Governments and corporations must begin transitioning to quantum-resistant encryption standards, or risk catastrophic breaches in the near future. • Tactical and Strategic Implications: Countries that master quantum decryption first may gain unparalleled capabilities in espionage, warfare, and economic control. ⸻ Keith King https://lnkd.in/gHPvUttw Arzan Alghanmi

Three weeks ago, our Devsinc security architect, walked into my office with a chilling demonstration. Using quantum simulation software, she showed how RSA-2048 encryption – the same standard protecting billions of transactions daily – could theoretically be cracked in just 24 hours by a sufficiently powerful quantum computer. What took her classical computer billions of years to attempt, quantum algorithms could solve before tomorrow's sunrise. That moment crystallized a truth I've been grappling with: we're not just approaching a technological evolution; we're racing toward a cryptographic apocalypse. The quantum computing market tells a story of inevitable disruption, surging from $1.44 billion in 2025 to an expected $16.22 billion by 2034 – a staggering 30.88% CAGR that signals more than market enthusiasm. Research shows a 17-34% probability that cryptographically relevant quantum computers will exist by 2034, climbing to 79% by 2044. But here's what keeps me awake at night: adversaries are already employing "harvest now, decrypt later" strategies, collecting our encrypted data today to unlock tomorrow. For my fellow CTOs and CIOs: the U.S. National Security Memorandum 10 mandates full migration to post-quantum cryptography by 2035, with some agencies required to transition by 2030. This isn't optional. Ninety-five percent of cybersecurity experts rate quantum's threat to current systems as "very high," yet only 25% of organizations are actively addressing this in their risk management strategies. To the brilliant minds entering our industry: this represents the greatest cybersecurity challenge and opportunity of our generation. While quantum computing promises revolutionary advances in drug discovery, optimization, and AI, it simultaneously threatens the cryptographic foundation of our digital world. The demand for quantum-safe solutions will create entirely new career paths and industries. What moves me most is the democratizing potential of this challenge. Whether you're building solutions in Silicon Valley or Lahore, the quantum threat affects us all equally – and so does the opportunity to solve it. Post-quantum cryptography isn't just about surviving disruption; it's about architecting the secure digital infrastructure that will power humanity's next chapter. The countdown has begun. The question isn't whether quantum will break our current security – it's whether we'll be ready when it does.