AI security planning has to account for threats that exist today and encrypted data that may become readable years from now.
An Utimaco report identifies three immediate risks across the AI lifecycle: attackers can poison training data, steal models and expose sensitive information during training or inference. It also argues that future quantum computers could break widely used public-key cryptography, turning data captured now into an asset for later decryption.
The answer is not one new algorithm. Organisations need security controls from ingestion to production, a migration path for cryptography and hardware-protected environments for their highest-value data and keys.
AI creates more than an inference problem
Public discussion often focuses on prompts, output leakage and model behaviour at the point of use. Important vulnerabilities appear much earlier.
Manipulated training data can degrade performance in subtle ways that evade normal testing. A copied model can expose intellectual property and enable competitors or attackers to reproduce capabilities. Sensitive records may leak while being prepared, trained on or processed in production.
Controls therefore need to follow the asset throughout its lifecycle. Data sources should be verified, transformations logged and model artefacts signed. Before deployment, systems can check whether the model being loaded is the approved version rather than a modified copy.
The same chain should continue during inference. Access permissions, encryption and audit records must protect the data entering the model as well as the response leaving it.
Crypto-agility prepares for a long migration
The report warns that sufficiently capable quantum systems could make current public-key methods vulnerable within the coming decade. The timeline is uncertain, but attackers do not need to wait. They can collect encrypted material now and store it until decryption becomes practical.
Long-lived training datasets, financial records and intellectual property are particularly exposed to this “harvest now, decrypt later” logic. Information that must remain confidential for years needs protection chosen with that lifetime in mind.
Moving to post-quantum cryptography affects protocols, key management, interoperability and performance. Such changes can take years across a large organisation. Utimaco therefore recommends crypto-agility: the ability to replace algorithms without redesigning every underlying system.
Hybrid cryptography can combine established methods with post-quantum algorithms such as those selected through NIST processes. It provides a transition path while organisations test compatibility and performance.
Hardware enclaves create a chain of trust
Cryptography alone cannot protect a key that is exposed in ordinary system memory or a workload running in a compromised environment. Hardware security modules and confidential-computing enclaves isolate keys and sensitive operations from the main operating system.
Keys can be generated and stored inside a protected boundary. An enclave can prove that it is in an approved state before the hardware releases those keys, a process known as attestation. Even a highly privileged system administrator may be unable to inspect the data processed inside.
This creates a chain of trust from hardware to application. Tamper-resistant logs record access and operations, supporting compliance obligations such as those associated with the EU AI Act.
Hardware protection is not required for every low-risk workload. It is most valuable where models, data or decisions represent high-value assets. Classification helps organisations match the strength and cost of controls to the consequence of exposure.
Quantum risk can seem distant beside active threats, yet infrastructure decisions made today may persist for a decade. Waiting for a cryptographic emergency would force hurried changes across systems that were never designed to adapt.
The practical strategy is layered: strengthen current AI lifecycle controls, inventory cryptographic dependencies, design for algorithm replacement and use hardware trust where compromise would be most damaging.
Secure AI is not a perimeter around a model. It is an evidence-backed chain that begins when data enters the organisation and remains strong even as the mathematics protecting it changes.
