# Palo Alto Networks EVP: Securing AI Agents in the Enterprise

- **Show:** CXOTalk
- **Published:** 17 Jul 2026
- **Source:** https://podcasters.spotify.com/pod/show/cxotalk/episodes/Palo-Alto-Networks-EVP-Securing-AI-Agents-in-the-Enterprise-e3m7jqk
- **Transcript:** https://podcasts.opennash.com/shows/cxotalk/palo-alto-networks-evp-securing-ai-agents-in-the-enterprise-47e21c/
- **Provider:** OpenNash Podcasts (machine-generated)

## In brief

Quantum computers will eventually break the public key encryption that protects most digital life, and Anand Oswal argues that business leaders must act now rather than wait. Governments are setting deadlines, attackers are already collecting encrypted data to unlock later, and large migrations take years. His message is that quantum readiness is a present business-continuity and trust problem, not a distant research topic.

The central tension is time. Oswal says the threat is only a few years away, official deadlines arrive in 2030 and 2035, and a single cryptographic inventory can take over a year, so timelines are 'on a collision course'. He then presents Palo Alto Networks' answer: a platform approach built on discovering, protecting and accelerating, instead of adding yet another point product.

## Key insights

1. **Encrypted data is already being stolen** Oswal says nation states are harvesting encrypted data now to decrypt once quantum computers exist. Any organization holding long-lived sensitive records, such as financial, health or intellectual property data, is exposed today.
2. **Migration timelines may already be too tight** Large cryptographic migrations can take five to ten years, and a full inventory alone can take over a year. With RSA deprecated by 2030 and disallowed by 2035, he says a company starting today barely has enough time.
3. **You cannot fix cryptography you cannot see** Most organizations lack a complete inventory of where legacy encryption is used across cloud workloads, APIs and network connections. Oswal says visibility comes first because it lets teams prioritize the systems protecting the most sensitive, long-lived data.
4. **Post-quantum encryption demands heavier hardware** New algorithms use larger keys and more complex computations, which can slow networks. Palo Alto Networks says it built fourteen firewall models to handle this load, so customers avoid a costly hardware refresh later.
5. **Legacy systems can be protected without rebuilding** Cipher translation sits between users and old applications and applies post-quantum protection at the network layer. This lets companies upgrade traffic security first and modernize individual applications over time, rather than in one disruptive project.

## Questions this episode answers

### Why is quantum computing a threat to security?

Today's public key encryption relies on math problems, like factoring the product of two huge prime numbers, that are very hard for ordinary computers. Oswal says a future quantum computer could solve them almost instantly, making current encryption and digital signatures obsolete.

### How soon do I need to worry about this?

Oswal says it is no longer decades away but 'a few years', with a cryptographically relevant quantum computer expected by the end of this decade. He adds that RSA and ECC are due to be deprecated by 2030 and disallowed by 2035.

### What does 'harvest now, decrypt later' mean?

It means attackers are collecting encrypted data today, even though they cannot read it yet, planning to decrypt it once quantum computers are powerful enough. Oswal says this is already happening and is a risk for any long-lived sensitive data.

### What is the business risk if a company is not ready?

Oswal names damaged trust and brand, systems that stop working, regulatory fines and legal action, and stolen intellectual property. He says a breach traced to a known outdated algorithm would make a company look negligent.

### What is Palo Alto Networks recommending companies do?

Oswal outlines three steps: discover (build a cryptographic inventory with a readiness dashboard), protect (use firewalls built for post-quantum encryption) and accelerate (use cipher translation to cover legacy systems). He also argues for a single platform instead of many separate tools.

## Facts

- **Anand Oswal** [0:00:28]: "Because of a property known as superposition, qubits can be both one and zero at the same time."
- **Anand Oswal** [0:01:15]: "For the last fifty years, our digital world has relied on a foundation of trust built on public key cryptography."
- **Anand Oswal** [0:02:58]: "experts like Gartner, McKenzie and others estimate that by end of this decade, a cryptographically relevant quantum computer will be capable of breaking the encryption that underpins our global economy."
- **Anand Oswal** [0:02:58]: "The EU Commission has announced plans to launch a quantum safe communication network by twenty thirty."
- **Anand Oswal** [0:02:58]: "Some like C N S 2.0 mandates started to take effect in 2025."
- **Anand Oswal** [0:03:48]: "By twenty thirty, algorithms like RSA and ECC will be officially deprecated."
- **Anand Oswal** [0:03:48]: "By twenty thirty five, these vulnerable cryptographic algorithms will be officially disallowed for most applications."
- **Anand Oswal** [0:04:30]: "Historical data from past transitions show that these can take between five to ten years for a large, complex enterprise to complete."
- **Anand Oswal** [0:05:10]: "In the United States, NIST has finalized new post quantum cryptographic algorithms to defend against the quantum enabled threats."
- **Anand Oswal** [0:05:32]: "A full cryptographic inventory alone can take them over a year."
- **Anand Oswal** [0:09:18]: "Nation states and other adversaries are quietly and systematically harvesting large amounts of encrypted data."
- **Anand Oswal** [0:10:32]: "You have customers with ten, twenty, fifty, hundred, 200 different tools that they're trying to deploy, to configure, to optimize, to operate and to utilize."
- **Anand Oswal** [0:11:43]: "It's a comprehensive platform based strategy built upon three key pillars, discover, protect, and accelerate."
- **Anand Oswal** [0:12:29]: "So we start with a quantum readiness dashboard to give leaders real time visibility into the organization's cryptographic risk posture."
- **Anand Oswal** [0:14:27]: "We recently introduced fourteen new models of our next generation firewall that are specifically engineered to handle the high performance processing demands of post quantum cryptography."
- **Anand Oswal** [0:16:24]: "We have developed cipher translation, an industry first technology that allows an organization to secure the communication to and from legacy applications without a full upgrade, instantly making them quantum ready."

## Transcript

**[0:00:00] Michael Krigsman:** Quantum computing threatens cybersecurity, including the foundations of encryption. With government mandates on the way, the question for business leaders is not whether quantum will happen, but how to prepare. I'm Michael Krigsman, and I've asked Anand Oswal, Executive Vice President of Network Security at Palo Alto Networks, to walk us through the practical steps organizations can take now to become quantum ready.

**[0:00:28] Anand Oswal:** A quantum computer uses the principles of quantum mechanics to perform calculations faster than today's computers. Instead of using traditional ones and zeros, these new computers use quantum bits, sometimes called qubits. Because of a property known as superposition, qubits can be both one and zero at the same time. This allows quantum systems to efficiently solve complex, time consuming problems that are currently impossible for classic computers. What business leaders really need to understand is what quantum computing means for cyber security.

**[0:01:09] Michael Krigsman:** What's the core security threat that arises from quantum computing?

**[0:01:15] Anand Oswal:** For the last fifty years, our digital world has relied on a foundation of trust built on public key cryptography. This invisible shield protects everything from our financial transactions to national secrets and critical infrastructure. Digital security today relies on a complex math, specifically calculations like factoring the product of two large prime numbers. These calculations forms the basis of widely used public key cryptographic algorithms, and it's incredibly resource intensive for classical computers. In the future, a quantum computer will be able to solve this calculation instantly, meaning that traditional encryption and digital signature methods we all have relied on for decades to protect our data will be obsolete.

**[0:02:08] Anand Oswal:** For many years, the quantum threat had been considered a distant theoretical risks. However, the convergence of A I and quantum research is dramatically accelerating this timeline.

**[0:02:21] Michael Krigsman:** Anan, as you talk with customers, what is the general level of awareness of this quantum threat right now?

**[0:02:29] Anand Oswal:** It's a mixed bag, Michael. You have some customers who understand these threats really well, some customers who heard about it and some customers who have not much awareness. So it's across the whole spectrum. We wanna make sure that everybody is aware of what's coming with quantum security. And what steps do they need to take to get them to quantum safe in their journey?

**[0:02:49] Michael Krigsman:** When will quantum computing arrive in a meaningful way? Are we talking months, years, decades? How real is this?

**[0:02:58] Anand Oswal:** We're no longer talking about decades. We're just a few years away. With major advancements just in the last year, experts like Gartner, McKenzie and others estimate that by end of this decade, a cryptographically relevant quantum computer will be capable of breaking the encryption that underpins our global economy. Governments around the world have already started taking decisive action. The EU Commission has announced plans to launch a quantum safe communication network by twenty thirty. Some like C N S 2.0 mandates started to take effect in 2025.

**[0:03:38] Anand Oswal:** Now, these milestones mark the beginning of a global shift towards quantum resistant security.

**[0:03:45] Michael Krigsman:** What are the implications for security leaders?

**[0:03:48] Anand Oswal:** Let me give you a few examples of what these actions mean. By twenty thirty, algorithms like RSA and ECC will be officially deprecated. Their use will be discouraged and potentially flagged by many compliance tools. By twenty thirty five, these vulnerable cryptographic algorithms will be officially disallowed for most applications. Now, that's a hard stop. After this date, any system relying on them will be considered non compliant and fundamentally insecure by the world's largest security standards. The biggest misconception is that this is only a problem in the future.

**[0:04:30] Anand Oswal:** In reality, companies might already be behind schedule when we consider the reality of migration timelines. Now, as you know, large scale cryptographic migrations are notoriously difficult and very time consuming. Historical data from past transitions show that these can take between five to ten years for a large, complex enterprise to complete. And for legacy applications, and think about IoT and OT devices which have embedded firmware and upgrade might not be feasible at all. Additionally, adversaries are not waiting for quantum computers to arrive.

**[0:05:10] Anand Oswal:** Many are already stealing encrypted data today. This means that sensitive information could already be at risk. In the United States, NIST has finalized new post quantum cryptographic algorithms to defend against the quantum enabled threats.

**[0:05:28] Michael Krigsman:** What is the timeline for organizations to comply?

**[0:05:32] Anand Oswal:** Organizations need to start now and cannot emphasize this enough they need to start now. A full cryptographic inventory alone can take them over a year. The window is closing. And as I just mentioned, RSA will be officially deprecated by twenty thirty. It will be out of compliance by twenty thirty five according to NIST. Now it takes years to test, to pilot, to deploy new algorithms across a complex I T estate. As you can see, the timelines are on a collision course.

**[0:06:06] Anand Oswal:** A company starting today would barely have enough time to meet these deadlines. Any delay would put business continuity and the brand's reputation at risk.

**[0:06:16] Michael Krigsman:** Explain the business risk.

**[0:06:19] Anand Oswal:** A failure to meet these deadlines leads to two critical impacts. First, there's an erosion of trust and damage to a company's brand. If a customer or partner discovers that they are not quantum safe, or worse, if a breach occurs and it's revealed that it was enabled by a known deprecated vulnerability, the damage would be irreparable. The brand would be seen as negligent, their security is outdated, and promises to protect data as empty. This would lead to a loss of customer confidence, a loss of market share and a significant decrease in shareholder value.

**[0:07:01] Anand Oswal:** But this isn't just about data breaches. A cryptographic failure can halt business operations entirely. There's also a risk of inoperable systems. Critical business functions, supply chain management, financial transactions and remote access all rely on cryptography. Without secure algorithms, these systems would grind to a halt. Now there are also regulatory penalties to consider. Governments and industry bodies will likely enforce severe penalties for non compliance with the NIST standards, including fines and legal action. Finally, there's a risk of compromised intellectual property.

**[0:07:44] Michael Krigsman:** Anon, to help us understand the implications of quantum, which are so profound, can you explain the systems that keep information safe today?

**[0:07:56] Anand Oswal:** Today, our most sensitive information, such as personal messages, banking information, and trade secrets are generally encrypted. Encrypted text messages are a good example. For the past fifty years, public key cryptography has been the foundational bedrock, underpinning protocols, V P N, T L S, and S S H, as well as e-commerce and confidential corporate communication. This relies on a system that uses one key to encrypt the data and a second key to decrypt it. Without this encryption, all internet traffic would effectively be an open book for bad actors.

**[0:08:38] Michael Krigsman:** What are the consequences if this foundational system of encryption is broken?

**[0:08:44] Anand Oswal:** The consequences are profound. If a quantum computer can easily decrypt these messages, the cryptographic lock boxes protecting sensitive data are broken wide open. This could lead to data loss at a scale that we have never seen before. It could compromise financial systems, leak intellectual properties or expose national security secrets. Additionally, there's a threat of harvest now and decrypt later that companies must also protect against.

**[0:09:15] Michael Krigsman:** Explain harvest now, decrypt later.

**[0:09:18] Anand Oswal:** The harvest now, decrypt later threat is a profoundly dangerous attack that is already in motion. Nation states and other adversaries are quietly and systematically harvesting large amounts of encrypted data. Unfortunately, it doesn't take much skill to harvest encrypted data. This is an immediate risk for any organization that handles long term sensitive information financial records, health data, or intellectual property.

**[0:09:50] Michael Krigsman:** Anand, how is the cybersecurity industry preparing for this massive quantum threat? And what is Palo Alto Networks doing about it?

**[0:09:59] Anand Oswal:** In my conversations with customers and other leaders, quantum is increasingly becoming a top priority. The companies that are best positioned to get ahead of quantum risks are those that have embraced a platform mindset. It's helpful to take a step to understand how cyber security has evolved over the years. Look, in the past, every change in the attack landscape resulted in a massive new project that required more funding, more products, and more expertise to manage it all.

**[0:10:32] Anand Oswal:** This led to a world where we had more point products. You have customers with ten, twenty, fifty, hundred, 200 different tools that they're trying to deploy, to configure, to optimize, to operate and to utilize. It's just not possible. It's too complicated and you're not going to have enough people who can be experts across all of these tools. For the past few years, we've been saying that this complexity has brought network security to a breaking point.

**[0:11:05] Anand Oswal:** Too many point products created a tactical challenge. Gaps in security, increased expenses, and stressed out teams that made more errors. But more importantly, the complexity created a strategic challenge. It became too hard to react to new opportunities and threats, says Compton Computing. At Palo Alto Network, we've designed the network security platform with flexibility that enables companies to remain in lockstep with the pace of business and to stay ahead of the attackers, to reduce their operational costs and give a better security outcome to the customers.

**[0:11:43] Anand Oswal:** This gets to the heart of why the network security teams that we have at Palo Alto Networks, what we do. We're working to turn a complex future threat into a concrete, manageable plan for our customers. Our approach is not yet another single point solution for quantum. It's a comprehensive platform based strategy built upon three key pillars, discover, protect, and accelerate. These innovations are strategically phased to guide customers through their quantum readiness journey, from initial discovery to full scale and automated defense.

**[0:12:22] Michael Krigsman:** Explain that first pillar discovery and I've heard you use the phrase visibility as well in the past.

**[0:12:29] Anand Oswal:** You can only protect something if you know what it is, if you have visibility into it. So we start with a quantum readiness dashboard to give leaders real time visibility into the organization's cryptographic risk posture. Automatically identifying where legacy encryption is used on cloud workloads, A P Is, and network connections, helping to highlight vulnerabilities in cloud native and A I driven applications. The dashboard solves the where do I start problem and directly tackles the most daunting challenge for security teams, the lack of a comprehensive and complete cryptographic inventory.

**[0:13:12] Anand Oswal:** Instead of relying on manual audits or expensive professional services for an initial inventory, customers get this capability built right into their existing platforms, allowing for a continuous, real time assessment of their cryptographic posture. Additionally, visibility lays the groundwork for remediation. Agentic discovery and automation is key to ensure that your inventory remains up to date always.

**[0:13:42] Michael Krigsman:** So discovery visibility are deeply important.

**[0:13:47] Anand Oswal:** Absolutely, Michael. They're very important. You must have a clear understanding of your cryptographic inventory before you can prioritize your risks. Visibility allows security teams to move from a point where cryptography is a total blind spot to being able to make a clear and actionable plan. They can see which assets are most vulnerable and, more importantly, prioritize those that protect the most sensitive long lived data. This data driven approach helps teams thoughtfully allocate the limited resources they have.

**[0:14:20] Michael Krigsman:** Anand, we've just discussed visibility. What about protect your second pillar?

**[0:14:27] Anand Oswal:** Post quantum computing algorithms will have larger keys and more complex computations that can be more resource intensive. We recently introduced fourteen new models of our next generation firewall that are specifically engineered to handle the high performance processing demands of post quantum cryptography. This new hardware is built to handle the increased load without compromising network throughput or adding significant latency. It directly addresses a major operational concern for network teams. Such quantum ready hardware will help future proof security investments and promote broader adoption.

**[0:15:11] Anand Oswal:** By investing in hardware that is already optimized for post quantum cryptography, customers are ensuring that their security infrastructure will be ready to adopt new government standards. And this avoids the need for a costly hardware refresh down the line when post quantum cryptography transition reaches its peak. The assurance of high performance and native post quantum cryptography support makes a stronger business case for the investment, knowing the change will not negatively impact end user experience or application performance.

**[0:15:49] Anand Oswal:** Now we are working with NIST, with CISA, and other global standard bodies to make sure the solutions the companies deploy today are built for tomorrow. These product innovations are designed to work in concert with our Panos platform to provide a clear, a practical, and a comprehensive path forward. They demystify a complex problem and offer concrete solutions that help teams take control of their quantum readiness journey.

**[0:16:19] Michael Krigsman:** You said that the third pillar consists of accelerate. Can you explain that?

**[0:16:24] Anand Oswal:** Legacy or custom built applications, especially those running in a multi cloud environment, are a major major pain point for organizations. Previously, securing these applications would require a costly and time consuming rearchitecture. We have developed cipher translation, an industry first technology that allows an organization to secure the communication to and from legacy applications without a full upgrade, instantly making them quantum ready. Now, by acting as an intermediary, it allows for a phase control transition. A company can secure all of its applications with post quantum cryptography at the network layer first and then over time work on updating these individual applications themselves.

**[0:17:14] Anand Oswal:** This prevents the entire quantum journey from being a single, massive and disruptive big bang project. Additionally, it protects and extends the life of existing hardware and software investments, making the quantum transition more financially viable and less disruptive to business operations.

**[0:17:35] Michael Krigsman:** Can you overlay A I on top of all of this?

**[0:17:39] Anand Oswal:** A I is an accelerant to everything we do. If you think of discovery and visibility, we'll use A I internally to ensure that we are able to discover and figure out everything uh faster and more accurately. If you wanna apply policies for decryption for quantum etcetera, you can have A I be an assistant to you to get it done. And if you wanna accelerate, then what should you accelerate? Which applications? You're definitely having pieces of A I gonna be used across every facet of this journey.

**[0:18:05] Michael Krigsman:** What about talent? How can security teams attract the talent needed to maintain leadership in the face of emerging technology such as quantum computing and of course A I?

**[0:18:17] Anand Oswal:** Talent is the ultimate differentiator. Of course, that starts with recruiting. We're actively recruiting for top quantum computing and cryptography programs at universities and research institutions globally. When we can show our commitment to solving the biggest problems in cybersecurity, problems like quantum, it's a powerful draw for top talent. Next is training and development. Continuous learning is a priority for our existing engineers and product managers. We offer specialized training and certification in post quantum cryptography to upskill our internal teams.

**[0:18:54] Anand Oswal:** This ensures that the expertise isn't siloed but is distributed across the wider organization. And finally, we foster a culture of innovation that encourages curiosity and deep deep research. We provide our teams with resources and autonomy to work on cutting edge problems, our open collaborations with organizations like Continuum and others on Q R N G A P Is. Also provide the engineers with unique opportunities to work with leaders in the quantum space.

**[0:19:26] Michael Krigsman:** How can companies protect themselves and meet these new government mandates?

**[0:19:32] Anand Oswal:** The first step is discovery. Business and security leaders need cryptographic visibility and inventory across their environment to understand which of the applications, endpoints, infrastructure, and even their partner ecosystem are post quantum compliant and which are not. We take it one step further and help our customers through guided remediations. Next, protect. Companies need to adopt quantum ready hardware that can deliver post quantum decryption at scale. With crypto agility built right into next generation firewalls, this enables security as standards evolve.

**[0:20:16] Anand Oswal:** And finally, accelerate. Most companies have legacy systems that can't just rip and replace. We offer a cipher translation technology that accelerates the path to post quantum readiness by instantly upgrading any device or application to quantum safe by simply steering traffic through a Palo Alto Networks firewall.

**[0:20:39] Michael Krigsman:** Anand, what should business and technology leaders do now to prepare for quantum security?

**[0:20:47] Anand Oswal:** The quantum threat to our cryptography has a name, a date, and a measurable business impact. It is no longer a theoretical risk. It's a clear and present danger to brands, business continuity, and customer trust. Quantum computing will fundamentally transform the way we secure information. The organizations that start preparing now will be the ones that remain trusted and resilient in the years ahead. This is not about fear. It's about recognizing the challenge, understanding the timeline, and taking the right decisive action.

**[0:21:29] Anand Oswal:** The bottom line is you don't have to wait. Quantum ready hardware and software are available now. Preparing today keeps you compliant, protects your most valuable data, and puts you on a path to staying secure in the post quantum world.

**[0:21:49] Michael Krigsman:** Anand, thank you for educating us on this extremely important set of issues.

**[0:21:57] Anand Oswal:** Thank you, Michael. Thank you for having me.