Fortinet warns on risks of quantum decryption, shift to autonomous AI

MALAY, Aklan — A cybersecurity firm urged organizations to begin preparing for Q-Day, or the moment that quantum computers break public-key cryptography used to keep data private.

Fortinet also noted that while AI has been used inside cybersecurity tools for years, the primary emerging challenge is protecting AI systems themselves from exploitation.

Andrew Moey, Security Operations Strategist at Fortinet Southeast Asia, said that while Q-Day remains a few years away, organizations must begin building defenses immediately.

“If quantum is not in your agenda today, start,” Moey warned industry executives gathered at the VST ECS CXO Tech Summit at a hotel in Boracay. Moey said the IT experts need to prepare for Q-Day, in the same way that they prepared for the possible impact of Y2K, or the Millennium bug, decades ago.

Fortinet has said that quantum computers capable of breaking today’s encryption are coming, and when they do, public-key cryptography will no longer be able to protect our data.

Moey urged companies to implement a Cryptographic Bill of Materials (CBOM) to track outdated software libraries and secure vulnerable infrastructure.

Beyond quantum computing, Moey also cautioned against deploying artificial intelligence as a superficial overlay, citing industry terms like “AI lipstick” to describe tools that merely perform basic summarization without transforming business operations.

As enterprise adoption shifts toward autonomous “agentic AI” capable of executing tasks directly, he warned that unmonitored deployment poses severe operational and security risks.

“They will not feel bad. It doesn’t have the consciousness to feel bad,” Nguyen said, warning that autonomous agents execute commands blindly inside a “black box.”

Without rigorous oversight, malicious actors can exploit these agents using prompt injection—hiding instructions inside routine emails or files to hijack system controls.

Compromised agents can then be tricked into exfiltrating sensitive corporate databases or launching “Denial of Wallet” attacks, which manipulate systems into making infinite, costly API calls that rapidly deplete compute budgets.

To manage these risks, Moey called for strict prompt-level permission structures to constrain agent access, mirroring how human department privileges are partitioned. He also cautioned against relying on disconnected security products.

“Spending money on tools alone is not a strategy,” Moey said, urging leaders to deploy integrated platforms that harmonize security policies and gather internal telemetry to eliminate the blind spots exploited by rogue agents and cybercriminals.