The history of cyberattacks has evolved from 19th-century telegraph attacks to modern AI-driven geopolitical cyberwarfare attacks. Key milestones include the 1971 Creeper and 1988 Morris Worm (one of the first major ARPANET attacks), the 1994 Citibank attack (the first telecommunication intercept attack), the 2010 Stuxnet worm (first cyber weapon to cause physical damage), and the 2017 WannaCry ransomware attack on DLT-based assets, marking a shift toward widespread, disruptive, and financially motivated technology-drivenattacks.
Currently, AI technologies pose significant, multi-faceted threats to the global financial industry, acting as an accelerant for cyberattacks, algorithmic bias, and complex systemic instability. As AI technologies evolve and adoption enthusiastically mounts, financial institutions are increasingly targeted by highly sophisticated threats that jeopardize data privacy, operational resilience, and consumer trust. And the threats to financial security are expanding.
The Risk Posed by Cryptographically Relevant Quantum Computer (CRQC)
A looming technology risk beyond AI lies in the arrival of a cryptographically relevant quantum computer (CRQC), often called “Q-Day,” which poses an existential threat to the global financial system. The future of a fault-tolerant quantum computer powerful enough to execute cryptanalysis on classical public-key digital signature algorithms (DSA),cryptographic systems (such as RSA and ECC), is closer than ever and coming much sooner than has been communicated over the past few years in what is referred to as Years to Quantum (Y2Q). Unlike currently deployed Noisy Intermediate-Scale Quantum (NISQ) devices, a CRQC will have sufficient stable logical qubits and error correction to execute cryptanalysis algorithms at scale, threatening global data security.
Because modern banking, trading, and DLT networks rely entirely on mathematical encryption to protect data and verify identities, a sufficiently powerful quantum computer could break the DSA protections, resulting in a probabilistic systemic threat to the financial and government networks and substructures. Governments and financial institutions have elevated interests from an IT issue to a boardroom risk priority.
What are the Core Vulnerabilities and Risks? Quantum computers leverage Shor’s Algorithm and Grover’s Algorithm to process cryptanalysis calculations exponentially faster than binary systems. This capability targets the two pillars of financial cybersecurity – Asymmetric Encryption (RSA & ECC). Foundational etiquettes built around classical cryptography DSA,like RSA and Elliptic Curve Cryptography (ECC), protect public key infrastructures, digital certificates, and secure connections (e.g., web TLS, VPNs).
Quantum machines are anticipated to easily factor the large prime numbers that are relied upon for making systems secure, which will strip financial institutions and governments (federal, state, and municipalities) of their data protection. Beyond data theft, quantum computing undermines the digital signatures used to authorize multi-billion-dollar wire transfers, secure emails, and trade executions. An attacker could falsify identities, forge financial transactions, or alter historical account ledgers undetected. Digital assets on DLT networks like Bitcoin rely heavily on asymmetric key/public-key DSA cryptography to secure private keys. A quantum attack could allow bad actors to crack and forge transaction histories, which is a much greater threat than core wallet attacks.
The “Harvest Now, Decrypt Later” (HNDL) Threat
The immediate threat involves a “Harvest Now, Decrypt Later” (HNDL) strategy being employed by cyberattackers. This is a quantum computing threat that is a current-day threat, not a future problem, impacting financial operations today. Through HNDL attacks, nation-states and cybercriminal syndicates are actively intercepting and storing massive volumes of encrypted financial communications and customer data, waiting for quantum computing to mature so archived data can be decrypted, exposing historical trade secrets, personal records, and long-lived corporate liabilities.
The Financial Stability Board emphasizes that while AI creates operational efficiencies, these vulnerabilities require continuous monitoring to ensure regulatory frameworks keep pace with rapid innovation. To mitigate exposure, institutions are focusing on robust AI governance, data security protocols, and adversarial testing to secure their AI infrastructure.
The Combined Threat of Quantum Computing and AI
The convergence of quantum computing and AI model technologies is elevating financial risk from localized data breaches to systemic instability by creating supercharged cyberattacks, accelerating correlated market feedback loops, and instigating a two-tier cryptographic divide. In the Quantum/AI convergence threat, AI technologies act as a force multiplier in progressing the development of revolutionary silicon-based qubits and assisting in quantum error correction.
The Transition Toward Post-Quantum Cryptography (PQC)
What government and financial institutions should be doing now is to mitigate and manage future risk by transitioning to Post-Quantum Cryptography (PQC), also known as Quantum Resistant Cryptography (QRC), and developing their PQC/QRC and AI Technology governance frameworks. But this is where we are seeing a Quantum Divide – a growing gap in funding and expertise. Transitioning the global financial sector’s legacy IT infrastructure to quantum-resistant encryption requires intense, coordinated effort and capital investment.And not all financial institutions, central banks, or emerging markets possess the resources to migrate to PQC/QRC at the same pace.
This creates a two-tier financial ecosystem. If a single, interconnected node fails to secure its systems against quantum/AI threats, then entire financial networks are subject to being vulnerable to an attack. Simply, the failure or compromise of one institution can cascade into a chain reaction of bank defaults that threaten national and global financial stability.
To survive the convergence of quantum computing and AI-enabled threats involving cryptographic vulnerabilities, financial institutions must urgently build cryptographically nimble architectures. This requires:
• Launching comprehensive inventories of cryptographic data sets, prioritizing data by most vulnerable and important data, and integrating PQC/QRC into internal systems, setting third-party vendor procurement standards, and deploying continuous behavioral cybersecurity AI model monitoring to thwart attacks.
• Establish governance frameworks for quantum and AI, establish PQC/QRC steering committees by forming cross-functional task forces that include cybersecurity, legal, and business units to steer migration policies and conduct assessments on how well an organization is equipped to handle quantum threats through structured evaluation methods.
• Implementing scenario analysis techniques to prepare by evaluating possible future quantum threat situations and responses.
• Include/Update vendor and procurement standards by integrating strict PQC/QRCrequirements with agility clauses involving all new software and hardware contracts.
• Expanding risk models to order quantum and AI risks into the organization’s enterprise risk management (ERM), treating the protection of digital assets and investor data as systemic priorities. NIST IR 8547 “Transition to Post-Quantum Cryptography Standards” describes NIST’s expected approach to transitioning from quantum-vulnerable cryptographic algorithms to PQC DSAs.
• Deploy AI-driven threat detection to mitigate AI-enabled fraud and privileged insider threats by using real-time behavioral analytics and anomaly detection.
• Utilize PQC/QRC hybrid schemes by implementing transitional, hybrid encryption schemes that combine classical and PQC/QRC to maintain regulatory compliance while testing the future-state systems.
• Adopt Zero-Trust Architecture (ZTA) and Secure Access Service Edge (SASE) models to limit the impact of an encrypted session or legacy key compromise. NIST’s flagship framework regarding “zero” concepts is outlined in NIST Special Publication 800-207. ZTA operates on the principle of “never trust, always verify,” focusing on identity, asset protection, and continuous authentication rather than attempting to completely eliminate software/hardware vulnerabilities.
Emerging Alternatives and the Future of Cryptographic Resilience
It is notable that alternatives to PQC/QRC have been developed. A relatively new encryption-agnostic cybersecurity paradigm of Zero Vulnerability Computing (ZVC) was proposed. The ZVC computing devices essentially merged all the conventional layers of firmware, drivers, operating system (OS), and the application layer to deliver a compactSolid-State Software on a Chip (3SoC) system. ZVC was explored as an alternative to PQC/QRC, as most of the 82 candidate PQC algorithms failed and seriously jeopardizedNIST’s PQC standardization initiative in 2022.
NIST does not have an official position, framework, or standard dedicated to ZVC because itis a proprietary architectural concept and protected by private patents. The primary difference is that PQC is a software-based defense system to secure general data transit and signatures against future quantum attacks, whereas ZVC is a privacy and scaling tool used to prove that a specific calculation was performed correctly without revealing the sensitive underlying data, similar to the concept in the use of Zero-knowledge Proofs (ZKP).
In summary, the convergence of advanced AI and quantum computing presents an unprecedented threat to global stability by potentially dismantling the cryptographic foundations of both modern finance and national security. Safeguarding these critical infrastructures requires an immediate, coordinated transition to post-quantum cryptography and resilient AI defense systems before theoretical vulnerabilities become catastrophic realities.
