Artificial intelligence could help quantum computers advance toward breaking widely used encryption while giving organizations better tools to prepare, according to an analysis published in the Journal of Quantum Information Science.
The paper argues that businesses should address AI security and quantum cybersecurity together. Its practical contribution is a five-part strategic framework for identifying sensitive information, finding vulnerable encryption and planning a transition to quantum-resistant protection.
Troy Coienth Troublefield developed the framework through a review of research, technical reporting, government standards and security assessments. The paper presents no new experiments and does not establish when quantum computers will become capable of breaking today’s widely used public-key cryptography.
Instead, it asks what organizations can do while that timeline remains uncertain.
How AI Could Affect Quantum Cybersecurity
Public-key cryptography helps secure communications and verify digital identities. Systems such as RSA rely on mathematical problems that conventional computers cannot practically solve at sufficiently large sizes.
A powerful enough quantum computer could solve those problems using Shor’s algorithm. Today’s quantum machines remain too small and error-prone to carry out such attacks against widely used cryptography, the paper says.
AI could contribute to progress by helping researchers identify quantum errors and improve how calculations are performed. However, the analysis acknowledges that researchers have not isolated how much AI has shortened the development timeline.
AI’s defensive role could arrive sooner. Automated tools can help organizations find where they use encryption, identify vulnerable methods and organize their replacement.
The framework turns that broad opportunity into five priorities.
Start With Sensitive Data and an Encryption Inventory
1. Prioritize information by how long it needs protection.
The paper recommends beginning with data that must remain confidential for years or decades, rather than trying to predict the arrival of a codebreaking quantum computer.
The concern is “harvest now, decrypt later.” An attacker could intercept encrypted information today and save it until a future quantum computer can unlock it. Replacing encryption later would not protect copies already collected.
Medical records, intellectual property and government information are among the examples discussed in the analysis.
Organizations can begin by asking which information would still cause harm if exposed in 10 or 20 years, how it travels between systems and which cryptographic methods protect those exchanges. Existing retention schedules provide a starting point, although how long information is stored and how long it remains sensitive may differ.
2. Find where vulnerable cryptography is used.
Before changing encryption, an organization needs to know where it operates.
That includes applications, software libraries, digital certificates, connected devices and outside services. It also requires understanding dependencies. Updating one application may accomplish little if the service it connects to still requires an older method.
The paper recommends automated discovery, meaning software that locates cryptography across an organization’s systems. Some tools search for known identifiers; others use machine learning to infer cryptographic use from code or network activity.
The inventory should be maintained as systems change. Troublefield also cautions that independent evaluations of commercial discovery tools remain limited, making verification of their coverage and accuracy important.
Protect AI Systems and Make Encryption Easier to Replace
3. Include AI infrastructure in the security transition.
The same AI systems helping organizations modernize security may hold valuable information themselves.
Training data, model files, credentials and information handled by autonomous AI agents should be included in quantum cybersecurity planning, the paper argues. Their communications and connections need assessment alongside those of other business systems.
An AI agent with broad access to sensitive information creates an additional concern. Organizations need to consider both what it can access today and whether information it exchanges requires protection against future decryption.
The practical recommendation is to assess AI infrastructure during its design and deployment, when changes are easier to make.
4. Build systems that can change cryptographic methods.
Moving to post-quantum cryptography should also make future updates easier.
This capability, called cryptographic agility, means being able to replace a cryptographic method without rebuilding the application around it. It matters because standards can change and newly discovered weaknesses may require another transition.
The paper recommends keeping cryptographic functions separate from the parts of software that perform other business tasks.
For organizations buying technology, the same principle provides a useful procurement question: How will the supplier update its cryptography, and what disruption would that require?
Turn Quantum Security Goals Into a Schedule
5. Work backward from applicable deadlines.
The final priority is to turn preparation into an organized program with staff, funding and measurable milestones.
Troublefield recommends working backward from relevant government requirements and procurement deadlines. Organizations need to establish which requirements apply to their systems and contracts rather than assume a single deadline covers every business.
A migration plan should account for discovery, supplier coordination, testing and deployment, with sensitive information and difficult-to-replace systems receiving early attention.
The framework has limits. The paper does not independently test whether its recommendations reduce migration costs or improve security outcomes. Quantum methods for detecting cyberattacks also remain experimental.
Its practical message is that organizations can begin identifying exposure and planning replacements without waiting for certainty about quantum computing’s arrival.
