AI Agents Are Moving Faster Than Trust: Why Security Needs A New Foundation

Dr. Pravir Malik is the founder and technologist of QIQuantum and the Forbes Technology Council Community leader for Quantum Computing.

Bruce Schneier’s enduring warning that “security is a process, not a product” remains right. But the next security stack must go further. It must make trust a property of architecture: what can be known, what can be exported, who may decide and what evidence must exist before action occurs.

Three pressures make that urgent.

The first is quantum risk. NIST finalized its first post-quantum cryptography (PQC) standards in 2024 and urges organizations to begin migrating now. The concern extends beyond when a cryptographically relevant quantum computer arrives. Migration can take years to complete, while adversaries can collect encrypted data today for “harvest now, decrypt later” attacks.

The second is agentic AI. Agents can interpret goals, invoke tools and initiate transactions or configuration changes at machine speed. NIST’s 2026 AI Agent Standards Initiative reflects the need for agents to act securely on behalf of users. Yet authentication alone does not establish authority. A valid agent using a valid credential can still exceed its purpose, scope, approval boundary or time window.

The third is evidentiary. Organizations often respond to uncertainty by exporting more logs, traces and attestation data. That may improve visibility, but repeated high-resolution evidence can also become a reconstruction channel. A compromised component may even help manufacture the narrative used to certify it.

What Market Leaders Are Already Signaling

Leading companies are addressing different parts of this problem.

Cloudflare reported in October 2025 that more than half of human-initiated traffic on its network was protected against harvest now, decrypt later attacks through post-quantum encryption. That demonstrates how quantum-safe migration can move from standards into Internet-scale infrastructure.