Emerging threats: AI in cyber operations, IoT weaknesses and the quantum transition

Every year brings a new wave of predictions. Three trends deserve serious attention because they are already changing how attacks and defenses work: artificial intelligence on both sides, the flood of poorly secured connected devices, and the slow but certain transition to cryptography that resists quantum computers. For each, the useful question is not “how scary is it?” but “what changes for me, and when?”

AI in cyber operations: faster, cheaper, at scale

AI does not invent new categories of attack so much as make existing ones cheaper and faster. Convincing phishing emails in any language, cloned voices for phone scams, and automated reconnaissance are the most visible effects. At the same time, AI systems have become targets themselves. MITRE ATLAS catalogs attacks against machine-learning systems, such as poisoning training data, evading classifiers, or injecting instructions into the text a language model reads. AI agents that can browse and run tools add a new risk: they act, not just answer, so a manipulated agent can take real actions on someone’s behalf.

Defenders use AI too: to triage alerts, explain events, and spot unusual behavior. The balanced view, echoed in CISA’s AI guidance, is that AI is a tool that needs the same care as any other: know what data it sees, keep a human able to review and undo its decisions, and do not let it be the only line of defense.

A practical rule for the AI era: treat urgency plus an unusual channel as a warning sign. If a voice message from your manager asks for an urgent transfer, or a video call from a relative asks for money, verify through a channel you already trust, such as calling back on a number you know. A convincing voice or face is no longer proof of who is speaking. Organizations can build the same habit into their processes, for example by requiring a second person to approve payments above a threshold, whatever the request looks like.

The Internet of Things: many devices, little maintenance

Cameras, speakers, TVs, plugs, printers and routers are small computers that often ship with default passwords, rarely receive updates, and stay connected for years. Once compromised, they can be recruited into botnets or used as a quiet foothold on a home or office network. The OWASP Internet of Things project lists the recurring weaknesses, from weak or hard-coded passwords to insecure update mechanisms. The European standard ETSI EN 303 645 sets a baseline for consumer IoT security, including no universal default passwords, a way to report vulnerabilities, and keeping software updated.

• Change default passwords and update firmware; retire devices that no longer receive updates.
• Put smart-home devices on a guest or separate network when your router allows it.
• Know what is on your network. A device you do not recognize deserves a closer look.

Quantum computing and post-quantum cryptography

A large enough quantum computer could break the public-key algorithms that protect today’s key exchanges and signatures, RSA and elliptic curves, using Shor’s algorithm. No such machine exists today, but data encrypted now and recorded by an adversary could be decrypted later, a risk known as “harvest now, decrypt later”. Symmetric algorithms such as AES are much less affected; longer keys, such as AES-256, keep them strong.

NIST published its first three post-quantum standards in August 2024: FIPS 203 (ML-KEM, for establishing keys), FIPS 204 (ML-DSA, for signatures) and FIPS 205 (SLH-DSA, a hash-based signature scheme). In March 2025 it selected a further algorithm, HQC, as a backup for key establishment. NIST’s transition guidance, NIST IR 8547, proposes deprecating today’s quantum-vulnerable public-key algorithms by 2030 and disallowing them by 2035. Browsers and operating systems have already begun combining classical and post-quantum key exchange in TLS, so much of this change will reach users through ordinary updates.

For most people and small organizations, the action item is simple: keep software updated, prefer services that publish a post-quantum plan, and inventory where long-lived secrets are protected by public-key cryptography, because those are the ones worth migrating first.