Perspectives
Perspectives on risk, trust and investment in technology: AI agents, post-quantum cryptography, pentesting and security governance for decision-makers.
- Only 37% of companies can take back an AI agent’s key. The risk isn’t in the model. — If your company is putting AI agents to work, the question isn’t whether they’ll fail. It’s what they can open when they do — or when someone tricks them.
- The world will spend $2.67 trillion on AI in 2026. To protect that AI: about 0.1% of it. — If you approve AI budgets, you need to know which spreadsheet line covers project protection. The studies below show that, in most companies, that line doesn’t exist in week one — and shows up later as incident cost.
- An AI sent 1,060 vulnerability reports in 90 days and topped HackerOne. Is pentesting over? — If your company buys one pentest a year to close the audit, you need to understand what changed. Contests, benchmarks and a real attack point to the same place: finding flaws got cheap. Deciding what they mean did not.
- An AI ran up to 90% of an attack on its own. Who owns that in your company? — If you sit on the board or own security, the question is no longer whether the CISO role survives. The cases below show a role that gathers more blame and less decision power — just as machines began acting on their own.
- In Brazil, a medical record must be kept for 20 years. Will the encryption protecting it last that long? — If your company keeps secrets that must stay secret for a decade or more, the question isn’t when the quantum computer arrives. It’s how long each secret must survive technologies that don’t exist yet.
- Europe, the UK and the US set 2035 to abandon today’s cryptography. For those deciding in 2026, that isn’t the future. — If you approve the company’s risk matrix, it’s missing a variable post-quantum makes obvious: how long it takes us to react. When preparation takes a decade, a distant event stops being low risk.
- Only 23% of companies say they can swap their own cryptography quickly. What’s missing from the spreadsheet is the right to change. — If you approve technology contracts, add a criterion that almost never shows up in evaluations: what it costs to walk away from that choice. The post-quantum migration is showing the price for those who didn’t think about it.
- By 2029, a digital certificate will be valid for at most 47 days. Does your board know how many the company has? — “How many does the company have?” Far more than anyone can remember. The problem isn’t the number — it’s that no one tracks when each one expires.