On 28 July of this year, it took an AI about sixty hours to find a cryptographic flaw that two years of expert review had not uncovered.
In the following 24 hours, the findings were confirmed and the digital signature submission intended to be secure against both classical and quantum computers, HAWK – a lattice‑based post‑quantum signature scheme under evaluation – was withdrawn from consideration. It will never be standardised.
A static security system
For fifty years, cryptography has been the one part of technology you could pretty much set and forget. RSA, a foundational public-key cryptography algorithm used for secure data transmission, arrived in 1977, became mainstream in web traffic security by 1994, and is still useful today.
Minor attacks on it have accumulated slowly, parameters have increased, and it has taken decades for meaningful advances.
That slowness has been baked into everything we have built with cryptography: standards bodies deliberate for years, migration programmes are planned in five-year blocks, and procurement assumes that what you buy today will still be adequate in 2033.
Even the US government’s Executive Order 14412 that moved post-quantum deadlines to 2030 and 2031 is considered aggressive. They pulled the timeline forward by half a decade and the industry called it a shock. However –
Sixty hours.
AI broke one candidate algorithm in no time at all, changing the price of the discovery cycle. When the time required to find a cryptographic weakness collapses from years to days, and the time required to fix a weakness across a large organisation stays at years, you are left with a gap. Bad things live in that gap.
The uncomfortable arithmetic is that the half-life of a cryptographic assumption may now be plausibly shorter than the duration of a cryptographic migration project. If that is even a possible truth, then every organisation whose plan is “arrive at post-quantum by 2030” has been designed for the wrong world.
The nearing threat
The realistic AI threat to encryption over the next three years actually has almost nothing to do with breaking an algorithm, but in implementation.
Every large organisation is carrying cryptography throughout: expired certificates later renewed with a weak key, a service still negotiating a deprecated cipher suite, a hardcoded credential in a repository that arrived with an acquisition in 2019, a random number generator that perhaps isn’t very random.
A new economics in finding the flaw has developed. Discovering a flaw took highly skilled humans to go looking, and the obscure corners of the enterprise were protected only due to the fact auditing them wasn’t worth anyone’s time.
AI has just changed that. Attackers can easily and continuously read all code, certificates and network configurations at next to zero cost. Every weakness should now be assumed to be found.
Nothing I have described requires a quantum computer to exist, only what already happened in July: finding cryptographic weakness became dramatically cheaper, and fixing it has become no faster.
Even if Q-Day, the hypothetical moment when quantum computers become powerful enough to break standard public-key encryption, never comes, every word of this still holds because you will be exposed to AI-assisted attackers exploiting classical flaws.
Cryptographic agility is the unusual security investment that pays out under every scenario.
A surprisingly humdrum solution
Earlier this year, I asked the security lead at a large European financial institution: “If a widely used algorithm were broken on a Friday, when would you know where you use it?” His response? “Two weeks. Maybe four. And, frankly, I’m not sure I’d trust the answer.”
His four core banking platforms: two of them inherited through acquisitions; several thousand certificates across three cloud providers; payments integration whose cryptography is contractually the supplier’s responsibility.
This is a capable person, well-funded, running an expert team at a serious institution describing the reality of the industry.
You cannot fix what you cannot find, which is why a cryptographic inventory matters, and why the June executive order directs CISA, working with NIST, to publish guidance on the minimum elements of a “cryptographic bill of materials” by March 2027.
Inventory tells you where you stand. Agility is the ability to move. In practice, that means four things: knowing what cryptography you run and where it lives; being able to replace an algorithm without rewriting the application; requiring your suppliers to demonstrate they can do the same; and having actually exercised all of it, at least once.
That last one is what everybody skips. A migration capability you have never used is a disaster recovery plan you have never tested.
What next?
I would encourage all companies not to wait until March 2027 for CISA to define what a cryptographic bill of materials ought to contain. This quarter, ask your security to lead the question I asked that CISO in the spring. If the answer is longer than a week, you have found your project.
Q-Day may well be a decade away. What’s for certain is that the sixty hours have already happened, and that nothing about most organisations’ ability to respond changed that week, and losing that gap is entirely within your control.