Ensuring Financial Data Security In The Quantum Era

Forbes

22-05-2025

Financial market organizations are used to the idea of speculation. Buying undervalued assets to realize value from them at a later point is a well-established strategy. But – on the other side of a very dark mirror – another kind of speculation is stalking even well-established financial players.
Bad actors are already exploring the next horizon of cyber-attacks with the goal of harvesting encrypted data. Today, the encryption is safe and the data is useless to the thieves. But they speculate that, armed at some point in the future with a 'cryptographically-relevant quantum computer (CRQC) – a quantum computer equipped with the right software – they will be able to break the encryption and gain access to the data, with devastating consequences. This point in time is often referred to as Q-Day.
While quantum threats will target industries ranging from power utilities to transportation providers, we believe the financial sector will be near the top of the list of targets for threat actors. The potential gains from stealing money or creating mayhem in the markets will be too appealing to pass up.
The good news is that Q-Day is not yet upon us, and there are actions that banking, financial services and insurance (BFSI) companies can take now to prepare for the quantum security threats of the future. It is possible that the quantum era could simply look like business as we know it, with full continuity of operations and management of risks.
For BFSI companies, data security is a significant challenge that gets more difficult with every passing day, even without the looming threat of a CRQC. Today's financial institutions are using more connected devices than ever. More devices means more potential backdoors or other vulnerabilities that can be exploited. Additionally, a recent report by the US Department of the Treasury found financial institutions are seeing an increase in more sophisticated, AI-powered phishing and social engineering attacks.
Where sensitive financial data is stored and managed, and how it is transported for transactions, is also cause for concern. Years ago, financial institutions would have hosted their data workloads in their own on-premises data centers. Now, in a highly digitalized financial world, workloads are often distributed across multiple public and private cloud networks, meaning financial institutions have less visibility and control over the security of their data once it leaves their premises. While financial institutions can (and do) encrypt data to protect it as it travels between clouds, they must trust that their service agreements will hold true and cloud-based data repositories are fully secured to their specifications.
Adding to this challenge are the increasingly stringent (but fragmented) regulatory requirements around data sovereignty and privacy, especially for enterprises with operations in multiple countries. It's not easy to determine the best way to comply with DORA, NIS2, OSFI B-13, CPS 230, NIST CSF 2.0 and the many other standards that are all very similar but different in their own ways. Even if an enterprise's headquarters isn't subject to a specific standard, that doesn't necessarily mean its satellite operations, or its globally distributed customer base aren't affected.
That said, in today's rapidly evolving geopolitical climate, many BFSI companies want to avoid having their data travel through certain countries, preferring to keep everything — including the people and systems managing their data and devices — within their own jurisdictions. That's not always easy to do, especially with the industry's high levels of AI usage.
The financial services sector is among the most mature when it comes to AI adoption, using the technology for a broad range of applications. For example, AI is being used for fraud detection to identify anomalies and suspicious activities in financial transactions. According to Mastercard, AI software can boost a bank's fraud detection rates by an average of 20% — and in some instances, by up to 300%. Additionally, AI-powered transaction monitoring can help cut down 'false positives' (i.e., when a legitimate transaction is mistakenly flagged as a fraudulent one) by more than 85%. But given that most banks don't have the infrastructure in place to build and train their own AI models, where is that AI analysis actually happening? How much sensitive customer data is now being stored and processed off-premises in an AI cloud? How secure are the AI models themselves?
Questions like these are enough to keep CTOs, CISOs and risk management teams up at night right now. When AI and quantum computing eventually converge, we can assume BFSI companies will need to adapt even faster to an ever-evolving threat landscape.
To protect their data in the AI and quantum era, BFSI companies can take the following actions, starting today:
With Q-Day looming, the worst thing banks and other financial institutions can do is nothing. Companies can and must take action now to protect their financial applications, systems and digitalization investments.
Of course, conducting infrastructure assessments and upgrading networks takes time as well as the right expertise and skills. But even though the word 'quantum' on its own can feel like a major technology leap, companies don't need to have quantum engineers on staff to set up the systems required to defend against future quantum cybersecurity threats. They also don't need to do this alone. Experienced IT network partners who have successfully deployed quantum-safe networks for financial institutions have the expertise to guide them through the process of architecting their networking and security technology evolution, every step of the way. The result? A solid, secure foundation to protect BFSI companies from today's threats and mitigate the risk of the threats still to come, so these institutions can thrive in the era of quantum computing and AI.