Utimaco: Securing AI Systems Requires a Move to Post-Quantum Cryptography

Utimaco argues that for enterprise AI the main problem is no longer model quality but the protection of the data these models are trained on and run with. The company warns that if AI infrastructure is built only for today's threats, it will have to be rebuilt for post-quantum security in a few years.

The main barrier to adoption

The eBook AI Quantum Resilience says companies most often slow down AI adoption not because they lack use cases, but because of the risk that their own data will be leaked, tampered with or compromised. This is especially sensitive for organizations that want to train models on internal documents, financial information, intellectual property and other data that stays valuable for a long time. The more valuable the data, the costlier the mistake: a compromised training pipeline hurts both model quality and legal exposure.

The problem is that threats appear along the entire AI workflow. It is not only about the inference phase, where prompt injection and output leakage are usually discussed. Dangers also arise at data ingestion, training, key storage, model deployment and ongoing operation. If any one of these layers is left unprotected, an attacker gets an entry point into the whole system.

Three risk zones

Utimaco identifies three basic areas where AI systems are vulnerable today, even without a full-fledged era of quantum computers. These are not theoretical scenarios but practical risks for companies that collect data for years and then use it in models, assistants and internal AI services.

• Training data poisoning — an attacker can mix in or alter data so that the model starts producing distorted results, and the cause is hard to spot.
• Model theft or copying — if a model is extracted or reproduced, the company loses intellectual property and competitive advantage.
• Exposure of sensitive data — data used during training or inference can be intercepted if the environment and keys are weakly protected.

A separate risk comes from the harvest now, decrypt later principle: encrypted data can be stolen today and decrypted later, when more powerful quantum tools appear. So it is not only current operations that need protection, but also archives, datasets and any assets that must stay confidential for years.

How to build protection

According to the authors, existing public-key cryptography may begin to lose its reliability within the next decade. For that reason, migration to post-quantum algorithms cannot be postponed until the risk becomes widespread: reworking protocols, key management systems, compatibility and performance takes years. The authors state directly that such a migration will affect both interoperability between systems and infrastructure speed.

As a transition strategy, Utimaco proposes crypto-agility — the ability to change cryptographic algorithms without a full architectural overhaul, using a hybrid approach that combines classical and post-quantum cryptography, including methods proposed by NIST.

But cryptography alone is not enough. The report separately stresses the role of hardware-protected environments and enclaves, which isolate keys and sensitive operations from ordinary infrastructure. In such a setup, keys for data encryption and model signing can be generated and stored inside a trusted perimeter, model integrity can be verified before deployment, and data processed during inference can be protected. In addition, hardware modules allow remote attestation of the environment and tamper-resistant access logs, which also helps with compliance with requirements such as the EU AI Act.

What this means

For companies building AI on their own data, security stops being an "extra layer" and becomes part of the product architecture. The winners will be those who build in crypto-migration, key protection and hardware trusted perimeters now, rather than trying to fix everything after the first serious leak or after post-quantum threats arrive.