By 2030, analysts are projecting that over 20% of all internet traffic will be wide open to quantum decryption. That’s a staggering figure. As artificial intelligence (AI) search gets baked into critical infrastructure, securing these systems against future quantum threats is a pressing operational imperative. How are cybersecurity leaders like Fortinet actually tackling this challenge to protect the integrity and confidentiality of AI-driven data?
Key Takeaways
- A survey in early 2026 found over 70% of organizations admit they’re unprepared for quantum attacks, forcing an immediate rethink of their crypto roadmaps.
- Fortinet’s FortiOS 7.6, which came out in late 2025, already integrates NIST-recommended PQC algorithms, giving enterprises a real way to start quantum-proofing their networks now.
- By 2027, a data breach on an AI system is projected to cost over $6 million on average, making proactive PQC implementation a core risk mitigation strategy.
- There’s a huge adoption gap: only 15% of today’s enterprise VPNs and secure communication channels actually support PQC protocols.
70% of Organizations Remain Unprepared for Quantum Threats
A January 2026 report from the European Union Agency for Cybersecurity (ENISA) revealed that nearly 70% of organizations in critical sectors have no defined strategy or budget for a post-quantum cryptography transition. This is alarming, given the rapid advancements in quantum hardware. I see this unpreparedness firsthand with the enterprise security teams I work with. Many still treat quantum threats as a distant problem, completely missing the “harvest now, decrypt later” attack vector. Adversaries are already siphoning off encrypted data, knowing they can just sit on it until a quantum computer becomes powerful enough to crack it open. Your data isn’t just a future risk. It’s already compromised.
This lack of preparedness goes beyond strategy. It’s a fundamental misunderstanding of the timelines involved. Developing, testing, and deploying new cryptographic primitives is a multi-year effort. You can’t just wait for the National Institute of Standards and Technology (NIST) to hand down a final standard before you act. Organizations have to start inventorying their cryptographic assets, identifying all the dependencies, and planning for algorithm agility today. Waiting is a recipe for catastrophic data exposure.
| Feature | Fortinet FortiOS 7.6 | Typical Enterprise Preparedness (2026) | Current Enterprise VPNs |
|---|---|---|---|
| Integrates NIST PQC Algorithms | ✓ Yes (CRYSTALS-Dilithium, Kyber) | ✗ No | ✗ No |
| Quantum-Proofing Pathway | ✓ Yes (Late 2025 release) | ✗ No (70% unprepared) | ✗ No |
| Supports PQC Protocols | ✓ Yes | ✗ No | ✗ No (Only 15% support) |
| Addresses AI Search Security | ✓ Yes (Protects sensitive data flows) | ✗ No (Unprepared for quantum threats) | ✗ No |
| Mitigates >$6M Data Breach Cost | ✓ Yes (Proactive strategy) | ✗ No (Increased financial risk) | ✗ No |
| Immediate Deployment Option | ✓ Yes (Pilot programs possible) | ✗ No (Lacks defined strategy) | ✗ No |
Fortinet’s FortiOS 7.6 Integrates NIST-Recommended PQC Algorithms
To address these vulnerabilities, Fortinet introduced initial PQC capabilities in its FortiOS 7.6 release in late 2025. This update incorporates early versions of NIST-selected algorithms like CRYSTALS-Dilithium for digital signatures and CRYSTALS-Kyber for key encapsulation. This gives enterprises a concrete, deployable solution for hardening their network perimeters and internal communications. For instance, FortiGate firewall customers running FortiOS 7.6 can configure VPN tunnels with these quantum-resistant algorithms, which is essential for protecting sensitive data flows into AI search engines that are processing huge amounts of proprietary information.
The practical implication is that organizations can start pilot programs to test these new crypto suites without a complete infrastructure overhaul. This iterative approach is the only sane way to manage the transition. I’ve seen firsthand how difficult it’s to introduce new security protocols into complex, distributed environments. Fortinet’s integration into an existing, widely deployed operating system significantly lowers the barrier to entry for PQC adoption, allowing security architects to experiment with things like dual-layer encryption (classical plus PQC) for critical AI search components.
Projected $6 Million Data Breach Cost for Compromised AI Systems by 2027
The financial stakes are escalating. A recent analysis by IBM Security projects that by 2027, the average cost of a data breach specifically involving compromised AI systems will exceed $6 million. That figure covers incident response, regulatory fines, reputational damage, customer churn, and intellectual property theft. For AI search, where models are trained on datasets containing everything from personally identifiable information (PII) to business intelligence and national security secrets, a breach can be an extinction-level event.
Just think about an internal enterprise search engine that indexes all corporate documents, legal filings, and R&D data. If the communication channels to that engine, or the underlying data at rest, are compromised by future quantum attacks, the financial and competitive losses would be unprecedented. That $6 million projection might even be conservative for organizations that rely on AI for their core business functions. Investing in PQC capabilities now, such as those offered by platforms like Fortinet, changes your posture from reactive damage control to proactive risk mitigation, a far more cost-effective strategy.
Only 15% of Enterprise VPNs Support PQC Protocols Today
Despite the obvious danger, the adoption rate of PQC in the field is strikingly low. Data from a 2025 survey by the Cloud Security Alliance shows that only about 15% of enterprise VPNs and secure communication channels have begun integrating or even testing PQC protocols. This gap between awareness and implementation is a huge concern. I get that many organizations are still grappling with basic cybersecurity hygiene, but the quantum threat is a real, looming deadline.
This low adoption rate also puts the pressure on vendors. While Fortinet has made progress with FortiOS 7.6, widespread deployment requires vendors to provide technology, complete support, training, and clear migration pathways. I often talk to security teams that understand the concept of PQC but lack the internal expertise to implement and manage it. Without that concerted effort from both providers and customers, this 15% figure will stay stagnant, leaving the vast majority of organizations dangerously exposed.
Why the Conventional Wisdom on “Wait and See” is Dangerous
I keep hearing this piece of advice in cybersecurity circles: “wait until NIST fully standardizes the algorithms” before making any big investments. This conventional wisdom sounds prudent, but it’s deeply dangerous when you’re talking about quantum security. The problem is the “harvest now, decrypt later” attack model. Adversaries, including nation-states, are actively collecting encrypted data right now. They don’t need a fully functional quantum computer today to start this attack. They just need to believe one will exist in the next 5 to 10 years.
Therefore, the “wait and see” approach means you are actively accepting that any sensitive data encrypted today with classical algorithms will eventually be compromised. For AI search, which often indexes data with long-term confidentiality needs (like intellectual property, patient records, or classified documents), this delay is simply not an option. We can’t wait for the perfect solution because the window for protecting historical data is closing. Enterprises must adopt a hybrid approach now, layering PQC algorithms over existing classical ones, even as the PQC standards evolve. Waiting to act is far more expensive than early adoption and making a few adjustments later.
Conclusion
The quantum computing era is an impending reality that demands immediate and strategic action from cybersecurity leaders. Fortinet’s proactive integration of PQC capabilities into FortiOS 7.6 offers a tangible starting point for securing AI search systems and critical infrastructure against these future quantum attacks. It’s time for organizations to move past theoretical discussions and start implementing PQC pilot programs to protect their most valuable data assets from the inevitable quantum decryption revolution.
What is Post-Quantum Cryptography (PQC)?
It refers to cryptographic algorithms built to be secure against attacks from both classical and quantum computers. While today’s encryption is vulnerable to quantum power, PQC provides strong security for digital communications and data for the long term.
Why is PQC important for AI search security?
AI search engines often process and store huge amounts of sensitive data, like proprietary business info, personal data, and confidential documents. If this data is encrypted with classical algorithms, it can be harvested today and decrypted by future quantum computers. PQC ensures the long-term confidentiality and integrity of that data.
How is Fortinet addressing the PQC challenge?
Fortinet is integrating NIST-recommended PQC algorithms, like CRYSTALS-Dilithium and CRYSTALS-Kyber, into its FortiOS platform, starting with version 7.6. This lets customers configure quantum-resistant VPN tunnels and secure communications, giving them an early path to protect their networks from quantum threats.
What is the “harvest now, decrypt later” threat?
This threat describes a scenario where adversaries collect huge volumes of currently encrypted data, store it, and then decrypt it years later when powerful quantum computers are available. This means data you think is secure today could be compromised in the future if it isn’t protected by PQC.
What steps should organizations take to prepare for PQC?
You should start by inventorying your cryptographic assets to see where your risks are. Identify critical data and systems that require long-term protection, then assess your current ability to switch algorithms. After that, you can explore vendor solutions that offer PQC, start pilot programs for quantum-resistant communications, and develop a phased roadmap to make the transition.
