Palo Alto Networks EVP: Securing AI Agents in the Enterprise
CXOTalk · 17 Jul 2026
Source: https://podcasters.spotify.com/pod/show/cxotalk/episodes/Palo-Alto-Networks-EVP-Securing-AI-Agents-in-the-Enterprise-e3m7jqk
Transcript: https://podcasts.opennash.com/shows/cxotalk/palo-alto-networks-evp-securing-ai-agents-in-the-enterprise-47e21c/ (via OpenNash Podcasts, machine-generated)

Quantum computing threatens cybersecurity, including the foundations of encryption. With government mandates on the way, the question for business leaders is not whether quantum will happen, but how to prepare. I'm Michael Krigsman, and I've asked Anand Oswal, Executive Vice President of Network Security at Palo Alto Networks, to walk us through the practical steps organizations can take now to become quantum ready.

A quantum computer uses the principles of quantum mechanics to perform calculations faster than today's computers. Instead of using traditional ones and zeros, these new computers use quantum bits, sometimes called qubits. Because of a property known as superposition, qubits can be both one and zero at the same time. This allows quantum systems to efficiently solve complex, time consuming problems that are currently impossible for classic computers. What business leaders really need to understand is what quantum computing means for cyber security.

What's the core security threat that arises from quantum computing?

For the last fifty years, our digital world has relied on a foundation of trust built on public key cryptography. This invisible shield protects everything from our financial transactions to national secrets and critical infrastructure. Digital security today relies on a complex math, specifically calculations like factoring the product of two large prime numbers. These calculations forms the basis of widely used public key cryptographic algorithms, and it's incredibly resource intensive for classical computers. In the future, a quantum computer will be able to solve this calculation instantly, meaning that traditional encryption and digital signature methods we all have relied on for decades to protect our data will be obsolete.

For many years, the quantum threat had been considered a distant theoretical risks. However, the convergence of A I and quantum research is dramatically accelerating this timeline.

Anan, as you talk with customers, what is the general level of awareness of this quantum threat right now?

It's a mixed bag, Michael. You have some customers who understand these threats really well, some customers who heard about it and some customers who have not much awareness. So it's across the whole spectrum. We wanna make sure that everybody is aware of what's coming with quantum security. And what steps do they need to take to get them to quantum safe in their journey?

When will quantum computing arrive in a meaningful way? Are we talking months, years, decades? How real is this?

We're no longer talking about decades. We're just a few years away. With major advancements just in the last year, experts like Gartner, McKenzie and others estimate that by end of this decade, a cryptographically relevant quantum computer will be capable of breaking the encryption that underpins our global economy. Governments around the world have already started taking decisive action. The EU Commission has announced plans to launch a quantum safe communication network by twenty thirty. Some like C N S 2.0 mandates started to take effect in 2025.

Now, these milestones mark the beginning of a global shift towards quantum resistant security.

What are the implications for security leaders?

Let me give you a few examples of what these actions mean. By twenty thirty, algorithms like RSA and ECC will be officially deprecated. Their use will be discouraged and potentially flagged by many compliance tools. By twenty thirty five, these vulnerable cryptographic algorithms will be officially disallowed for most applications. Now, that's a hard stop. After this date, any system relying on them will be considered non compliant and fundamentally insecure by the world's largest security standards. The biggest misconception is that this is only a problem in the future.

In reality, companies might already be behind schedule when we consider the reality of migration timelines. Now, as you know, large scale cryptographic migrations are notoriously difficult and very time consuming. Historical data from past transitions show that these can take between five to ten years for a large, complex enterprise to complete. And for legacy applications, and think about IoT and OT devices which have embedded firmware and upgrade might not be feasible at all. Additionally, adversaries are not waiting for quantum computers to arrive.

Many are already stealing encrypted data today. This means that sensitive information could already be at risk. In the United States, NIST has finalized new post quantum cryptographic algorithms to defend against the quantum enabled threats.

What is the timeline for organizations to comply?

Organizations need to start now and cannot emphasize this enough they need to start now. A full cryptographic inventory alone can take them over a year. The window is closing. And as I just mentioned, RSA will be officially deprecated by twenty thirty. It will be out of compliance by twenty thirty five according to NIST. Now it takes years to test, to pilot, to deploy new algorithms across a complex I T estate. As you can see, the timelines are on a collision course.

A company starting today would barely have enough time to meet these deadlines. Any delay would put business continuity and the brand's reputation at risk.

Explain the business risk.

A failure to meet these deadlines leads to two critical impacts. First, there's an erosion of trust and damage to a company's brand. If a customer or partner discovers that they are not quantum safe, or worse, if a breach occurs and it's revealed that it was enabled by a known deprecated vulnerability, the damage would be irreparable. The brand would be seen as negligent, their security is outdated, and promises to protect data as empty. This would lead to a loss of customer confidence, a loss of market share and a significant decrease in shareholder value.

But this isn't just about data breaches. A cryptographic failure can halt business operations entirely. There's also a risk of inoperable systems. Critical business functions, supply chain management, financial transactions and remote access all rely on cryptography. Without secure algorithms, these systems would grind to a halt. Now there are also regulatory penalties to consider. Governments and industry bodies will likely enforce severe penalties for non compliance with the NIST standards, including fines and legal action. Finally, there's a risk of compromised intellectual property.

Anon, to help us understand the implications of quantum, which are so profound, can you explain the systems that keep information safe today?

Today, our most sensitive information, such as personal messages, banking information, and trade secrets are generally encrypted. Encrypted text messages are a good example. For the past fifty years, public key cryptography has been the foundational bedrock, underpinning protocols, V P N, T L S, and S S H, as well as e-commerce and confidential corporate communication. This relies on a system that uses one key to encrypt the data and a second key to decrypt it. Without this encryption, all internet traffic would effectively be an open book for bad actors.

What are the consequences if this foundational system of encryption is broken?

The consequences are profound. If a quantum computer can easily decrypt these messages, the cryptographic lock boxes protecting sensitive data are broken wide open. This could lead to data loss at a scale that we have never seen before. It could compromise financial systems, leak intellectual properties or expose national security secrets. Additionally, there's a threat of harvest now and decrypt later that companies must also protect against.

Explain harvest now, decrypt later.

The harvest now, decrypt later threat is a profoundly dangerous attack that is already in motion. Nation states and other adversaries are quietly and systematically harvesting large amounts of encrypted data. Unfortunately, it doesn't take much skill to harvest encrypted data. This is an immediate risk for any organization that handles long term sensitive information financial records, health data, or intellectual property.

Anand, how is the cybersecurity industry preparing for this massive quantum threat? And what is Palo Alto Networks doing about it?

In my conversations with customers and other leaders, quantum is increasingly becoming a top priority. The companies that are best positioned to get ahead of quantum risks are those that have embraced a platform mindset. It's helpful to take a step to understand how cyber security has evolved over the years. Look, in the past, every change in the attack landscape resulted in a massive new project that required more funding, more products, and more expertise to manage it all.

This led to a world where we had more point products. You have customers with ten, twenty, fifty, hundred, 200 different tools that they're trying to deploy, to configure, to optimize, to operate and to utilize. It's just not possible. It's too complicated and you're not going to have enough people who can be experts across all of these tools. For the past few years, we've been saying that this complexity has brought network security to a breaking point.

Too many point products created a tactical challenge. Gaps in security, increased expenses, and stressed out teams that made more errors. But more importantly, the complexity created a strategic challenge. It became too hard to react to new opportunities and threats, says Compton Computing. At Palo Alto Network, we've designed the network security platform with flexibility that enables companies to remain in lockstep with the pace of business and to stay ahead of the attackers, to reduce their operational costs and give a better security outcome to the customers.

This gets to the heart of why the network security teams that we have at Palo Alto Networks, what we do. We're working to turn a complex future threat into a concrete, manageable plan for our customers. Our approach is not yet another single point solution for quantum. It's a comprehensive platform based strategy built upon three key pillars, discover, protect, and accelerate. These innovations are strategically phased to guide customers through their quantum readiness journey, from initial discovery to full scale and automated defense.

Explain that first pillar discovery and I've heard you use the phrase visibility as well in the past.

You can only protect something if you know what it is, if you have visibility into it. So we start with a quantum readiness dashboard to give leaders real time visibility into the organization's cryptographic risk posture. Automatically identifying where legacy encryption is used on cloud workloads, A P Is, and network connections, helping to highlight vulnerabilities in cloud native and A I driven applications. The dashboard solves the where do I start problem and directly tackles the most daunting challenge for security teams, the lack of a comprehensive and complete cryptographic inventory.

Instead of relying on manual audits or expensive professional services for an initial inventory, customers get this capability built right into their existing platforms, allowing for a continuous, real time assessment of their cryptographic posture. Additionally, visibility lays the groundwork for remediation. Agentic discovery and automation is key to ensure that your inventory remains up to date always.

So discovery visibility are deeply important.

Absolutely, Michael. They're very important. You must have a clear understanding of your cryptographic inventory before you can prioritize your risks. Visibility allows security teams to move from a point where cryptography is a total blind spot to being able to make a clear and actionable plan. They can see which assets are most vulnerable and, more importantly, prioritize those that protect the most sensitive long lived data. This data driven approach helps teams thoughtfully allocate the limited resources they have.

Anand, we've just discussed visibility. What about protect your second pillar?

Post quantum computing algorithms will have larger keys and more complex computations that can be more resource intensive. We recently introduced fourteen new models of our next generation firewall that are specifically engineered to handle the high performance processing demands of post quantum cryptography. This new hardware is built to handle the increased load without compromising network throughput or adding significant latency. It directly addresses a major operational concern for network teams. Such quantum ready hardware will help future proof security investments and promote broader adoption.

By investing in hardware that is already optimized for post quantum cryptography, customers are ensuring that their security infrastructure will be ready to adopt new government standards. And this avoids the need for a costly hardware refresh down the line when post quantum cryptography transition reaches its peak. The assurance of high performance and native post quantum cryptography support makes a stronger business case for the investment, knowing the change will not negatively impact end user experience or application performance.

Now we are working with NIST, with CISA, and other global standard bodies to make sure the solutions the companies deploy today are built for tomorrow. These product innovations are designed to work in concert with our Panos platform to provide a clear, a practical, and a comprehensive path forward. They demystify a complex problem and offer concrete solutions that help teams take control of their quantum readiness journey.

You said that the third pillar consists of accelerate. Can you explain that?

Legacy or custom built applications, especially those running in a multi cloud environment, are a major major pain point for organizations. Previously, securing these applications would require a costly and time consuming rearchitecture. We have developed cipher translation, an industry first technology that allows an organization to secure the communication to and from legacy applications without a full upgrade, instantly making them quantum ready. Now, by acting as an intermediary, it allows for a phase control transition. A company can secure all of its applications with post quantum cryptography at the network layer first and then over time work on updating these individual applications themselves.

This prevents the entire quantum journey from being a single, massive and disruptive big bang project. Additionally, it protects and extends the life of existing hardware and software investments, making the quantum transition more financially viable and less disruptive to business operations.

Can you overlay A I on top of all of this?

A I is an accelerant to everything we do. If you think of discovery and visibility, we'll use A I internally to ensure that we are able to discover and figure out everything uh faster and more accurately. If you wanna apply policies for decryption for quantum etcetera, you can have A I be an assistant to you to get it done. And if you wanna accelerate, then what should you accelerate? Which applications? You're definitely having pieces of A I gonna be used across every facet of this journey.

What about talent? How can security teams attract the talent needed to maintain leadership in the face of emerging technology such as quantum computing and of course A I?

Talent is the ultimate differentiator. Of course, that starts with recruiting. We're actively recruiting for top quantum computing and cryptography programs at universities and research institutions globally. When we can show our commitment to solving the biggest problems in cybersecurity, problems like quantum, it's a powerful draw for top talent. Next is training and development. Continuous learning is a priority for our existing engineers and product managers. We offer specialized training and certification in post quantum cryptography to upskill our internal teams.

This ensures that the expertise isn't siloed but is distributed across the wider organization. And finally, we foster a culture of innovation that encourages curiosity and deep deep research. We provide our teams with resources and autonomy to work on cutting edge problems, our open collaborations with organizations like Continuum and others on Q R N G A P Is. Also provide the engineers with unique opportunities to work with leaders in the quantum space.

How can companies protect themselves and meet these new government mandates?

The first step is discovery. Business and security leaders need cryptographic visibility and inventory across their environment to understand which of the applications, endpoints, infrastructure, and even their partner ecosystem are post quantum compliant and which are not. We take it one step further and help our customers through guided remediations. Next, protect. Companies need to adopt quantum ready hardware that can deliver post quantum decryption at scale. With crypto agility built right into next generation firewalls, this enables security as standards evolve.

And finally, accelerate. Most companies have legacy systems that can't just rip and replace. We offer a cipher translation technology that accelerates the path to post quantum readiness by instantly upgrading any device or application to quantum safe by simply steering traffic through a Palo Alto Networks firewall.

Anand, what should business and technology leaders do now to prepare for quantum security?

The quantum threat to our cryptography has a name, a date, and a measurable business impact. It is no longer a theoretical risk. It's a clear and present danger to brands, business continuity, and customer trust. Quantum computing will fundamentally transform the way we secure information. The organizations that start preparing now will be the ones that remain trusted and resilient in the years ahead. This is not about fear. It's about recognizing the challenge, understanding the timeline, and taking the right decisive action.

The bottom line is you don't have to wait. Quantum ready hardware and software are available now. Preparing today keeps you compliant, protects your most valuable data, and puts you on a path to staying secure in the post quantum world.

Anand, thank you for educating us on this extremely important set of issues.

Thank you, Michael. Thank you for having me.