Seattle CISO Sets 2029 Quantum Deadline Over AI Signature Forgery Risk

AI Trust on Borrowed Cryptography: A Post-Quantum Operating Model for Technology Executives — Ai4

Ai4

Adversaries exploiting classical public-key cryptography will forge AI model signatures and retroactively invalidate historical audit trails, forcing enterprises to deploy hybrid post-quantum architectures before 2029.

AI-assisted summary of AI Trust on Borrowed Cryptography: A Post-Quantum Operating Model for Technology Executives — original source. Check the original for full context.

Source published: 2026-08-17

Detailed notes

## Background Published by Ai4 on YouTube on August 17, 2026, this presentation features Jake Hammock, Chief Information Security Officer and Assistant CTO for the City of Seattle. The session outlines a post-quantum operating model for enterprise AI, detailing how to address cryptographic expiration across model signing, identity architecture, supply chain procurement, and migration sequencing.

## TL;DR Enterprise AI systems depend heavily on cryptographic trust anchors—such as RSA and elliptic curve cryptography—that are rapidly approaching quantum obsolescence. While traditional discussions focus on data harvesting, the most acute threat facing AI is signature forgery, which retroactively invalidates model provenance, agent identities, and historical audit logs. Rather than relying on unmanageable raw CBOM scans or disruptive rip-and-replace overhauls, organizations must implement the Trust Half-Life Model to prioritize root trust anchors and non-human identity explosion. Technology leaders are urged to adopt a 36-month hybrid dual-pillar roadmap, enforce strict vendor procurement deadlines aligned to NIST FIPS standards by January 1, 2029, and communicate risk to boards through Annual Loss Expectancy modeling.

## Atmosphere & style The presentation carries the crisp, authoritative urgency of an executive security briefing, grounding high-stakes post-quantum theory in concrete public-sector and enterprise governance. Jake Hammock speaks with pragmatic clarity, cutting through academic doom-mongering to offer methodical engineering frameworks and realistic risk metrics. The delivery feels direct, structured, and strategic, transforming an overwhelming cryptographic cliff into an actionable balance-sheet and architecture mandate.

## Key takeaways - [00:04](https://www.youtube.com/watch?v=sAClh2MQPYM&t=4s) Enterprise AI trust rests on a traditional public key cryptography foundation (RSA and ECC) that has an impending expiration horizon due to quantum advancements. - [03:14](https://www.youtube.com/watch?v=sAClh2MQPYM&t=194s) While PQC debates often focus on data confidentiality and 'Harvest Now, Decrypt Later', the most immediate catastrophic threat to AI is signature forgery. - [03:14](https://www.youtube.com/watch?v=sAClh2MQPYM&t=194s) Compromised signing keys create a bi-directional crisis of trust, retroactively invalidating historical model weights, attestations, and future agent decisions. - [03:29](https://www.youtube.com/watch?v=sAClh2MQPYM&t=209s) Automated CBOM scans often generate overwhelming noise (e.g., 18,000+ findings) without offering actionable prioritization for enterprise risk. - [07:29](https://www.youtube.com/watch?v=sAClh2MQPYM&t=449s) The Trust Half-Life Model prioritizes remediation across three tiers: Threat Vector Identification, Root Trust Anchor Prioritization, and Governance Blast-Radius Velocity. - [10:39](https://www.youtube.com/watch?v=sAClh2MQPYM&t=639s) Non-human to human identity ratios have accelerated past 130:1, with over 80% operating in fully agentic environments relying on fragile RSA and ECC keys. - [10:39](https://www.youtube.com/watch?v=sAClh2MQPYM&t=639s) Even symmetric standards like AES-256 face accelerated risk from Grover's algorithm quantum search capabilities. - [13:00](https://www.youtube.com/watch?v=sAClh2MQPYM&t=780s) The operational timeline for post-quantum resilience has shifted left from 2035 to an aggressive benchmark of January 1, 2029. - [13:00](https://www.youtube.com/watch?v=sAClh2MQPYM&t=780s) Rather than a disruptive rip-and-replace, organizations must pursue a 36-month pragmatic roadmap emphasizing cryptographic inventory visibility and hybrid dual-protocol rollouts. - [15:00](https://www.youtube.com/watch?v=sAClh2MQPYM&t=900s) Supply chain procurement is a primary leverage point; enterprises should enforce strict vendor PQC tolerance clauses aligned with NIST FIPS standards (FIPS 203, 204, 205). - [15:00](https://www.youtube.com/watch?v=sAClh2MQPYM&t=900s) Security leaders should translate technical cryptographic debt into business terms for boardrooms using Annual Loss Expectancy (ALE) risk modeling. - [17:03](https://www.youtube.com/watch?v=sAClh2MQPYM&t=1023s) Achieving resilient AI trust requires constructing a dual-pillar architecture utilizing standardized algorithms like ML-KEM and ML-DSA before legacy infrastructure collapses.

## Detailed walkthrough ### [00:04](https://www.youtube.com/watch?v=sAClh2MQPYM&t=4s) The Fracturing Trust Layer Beneath Enterprise AI

The enterprise AI boom rests on an unspoken currency: trust. Whether organizations are looking at direct large language model outputs, agent-to-agent signatures, certificate authority attestation, or multi-tiered QA inspection models auditing downstream agent behavior, operations run entirely on the presumption that these interactions are authentic and untampered. Beneath this soaring architecture, however, sits a foundation that is actively fracturing. The foundational trust layer of modern enterprise AI is built on traditional public key cryptography—predominantly RSA and elliptic-curve cryptography (ECC)—which possesses a finite expiration horizon in the face of quantum computing advances.

```mermaid flowchart TD accTitle: Enterprise AI Trust Stack Vulnerability accDescription: A diagram illustrating how high-level AI capabilities rest on an increasingly brittle cryptographic foundation.

subgraph AI_Layer ["AI Capability & Trust Layer"] A["Agent-to-Agent Identity & MCP Calls"] B["Model Outputs & Deep QA Inspect Models"] C["Attestations & Signature Registrations"] end

subgraph Crypto_Base ["Vulnerable Cryptographic Foundation"] D["Public Key Cryptography\n(RSA & Elliptic Curve / ECC)"] E["Legacy Data Centers & Un-upgraded HSMs"] end

AI_Layer --> Crypto_Base Crypto_Base -.->|"Fracturing Horizon\n(Post-Quantum Risk)"| F["System-wide Trust Collapse"] ```

Modern systems are engineered like a delicate house of cards. Enterprise engineering teams continually stack ambitious layers on top—beefing up product inventory lines with agent identities, machine-to-machine attestations, dynamic API pipelines, and Model Context Protocol (MCP) or adversarial generation testing frameworks. Yet, while engineering stacks might boast modern TLS 1.3 connections on the client-facing application tier, the back-end data centers, legacy Hardware Security Modules (HSMs), and root key exchanges are frequently ignored with an attitude of kicking the can a decade down the road.

- AI architectures rely intrinsically on cryptographic trust anchors for model signing, agent identity verification, audit registries, and machine-to-machine integrations. - Organizations often upgrade the visible edge (e.g., app-level TLS 1.3) while leaving core data centers and on-prem HSM infrastructure unaddressed. - A standard Cryptographic Bill of Materials (CBOM) scan alone is insufficient to safeguard these systems without a structural operating model.

---

[03:14](https://www.youtube.com/watch?v=sAClh2MQPYM&t=194s) Shifting Threat Vectors: From Data Confidentiality to AI Signature Forgery

In post-quantum cryptography (PQC) discussions, security leaders typically default to the classic "Harvest Now, Decrypt Later" (HNDL) narrative. CISOs historically lean on this doomsday premise to secure capital budgets, warning leadership that adversaries are intercepting encrypted data over the wire today to crack its confidentiality once cryptanalytically relevant quantum computers arrive. While data confidentiality remains a genuine concern, the most immediate and catastrophic danger facing AI systems is signature forgery.

```mermaid flowchart LR accTitle: Threat Evolution from Confidentiality to Signature Forgery accDescription: Flow showing how the attack paradigm shifts from passive harvesting to active historical and runtime signature forgery.

subgraph Legacy_Vector ["Traditional PQC Framing"] H1["Adversary captures wire traffic"] --> H2["Harvest Now, Decrypt Later"] H2 --> H3["Confidentiality Compromise"] end

subgraph AI_Vector ["AI-Centric Trust Framing"] F1["Adversary exploits weak signature/ECC root"] --> F2["Runtime & Historical Forgery"] F2 --> F3["Precursor & Postcursor Invalidation\n(All outputs & audit logs compromised)"] end ```

AI systems are fundamentally anchored in the integrity corner of the CIA triad, rather than confidentiality alone. "AI systems were not built on secrecy. They never were. AI systems were generally built on signatures, attestation signatures: who is doing what at what time." If an adversary compromises or calculates the private signing keys underpinning an AI ecosystem, they do not need to wait years for quantum hardware: - The adversary can forge model weights, corrupt training and execution attestations, and spoof agent authorization payloads. - Breaking the signature layer creates a bi-directional crisis of trust: it invalidates both historical records (precursors) and future decisions (postcursors), rendering every output, audit trail, and embedded workflow historically suspect and fundamentally untrustworthy.

---

[03:29](https://www.youtube.com/watch?v=sAClh2MQPYM&t=209s) The CBOM Reality Check and the Boardroom Mandate

Addressing post-quantum cryptographic risk cannot simply be delegated downward to platform security or cryptography teams as a routine technical chore. With enterprise estates spanning sprawling hybrid networks—such as the City of Seattle managing over 2,700 distinct applications across multiple data centers and cloud environments—cryptographic migration is a board-level governance and balance-sheet risk.

Many security programs attempt to gain visibility by running automated Cryptographic Bill of Materials (CBOM) or Software Bill of Materials (SBOM) discovery tools using standards like CycloneDX. However, raw discovery creates an operational paralysis. Running an enterprise-wide dynamic scan can easily return 18,000 or more cryptographic findings. Dumping an 18,000-row spreadsheet onto an engineering team provides zero actionable signal on where actual enterprise risk resides, especially when dealing with deeply embedded AI wrappers, proprietary intellectual property, and third-party SaaS dependencies.

---

[07:29](https://www.youtube.com/watch?v=sAClh2MQPYM&t=449s) The Trust Half-Life Model and Post-Quantum Prioritization

To resolve the gap between thousands of raw CBOM scan findings and limited engineering bandwidth, organizations need an actionable framework: the **Trust Half-Life Model**. This approach structures post-quantum resilience around identifying an asset's core cryptographic trust anchors and calculating their blast radius before remediation efforts go "underwater."

```mermaid flowchart TD accTitle: The Three-Tier Trust Half-Life Architecture accDescription: Diagram showing the three structural tiers of the Trust Half-Life Model: Threat Vector, Prioritization, and Governance.

subgraph Tier1 ["Tier 1: Threat Vector Identification"] T1["Target Vector Analysis\n(e.g., Active Signature Forgery vs. HNDL)"] end

subgraph Tier2 ["Tier 2: Root Trust Anchor Prioritization"] T2A["Key Management Systems (KMS)"] T2B["Model Signing Roots & CAs"] T2C["Agentic Identity & MCP Wrappers"] end

subgraph Tier3 ["Tier 3: Governance & Blast Radius"] T3A["Remediation Burndown Tracking"] T3B["Underwater Risk Thresholds\n(Blast radius exceeds containment capacity)"] T3C["Board-Level Attestation Reporting"] end

Tier1 --> Tier2 Tier2 --> Tier3 ```

The Trust Half-Life Model functions across three distinct tiers:

1. **Threat Vector Categorization**: Moving beyond generic post-quantum warnings to evaluate explicit threat behaviors, such as runtime signature forgery versus passive data exfiltration. 2. **Root Trust Anchor Prioritization**: Pinpointing the centralized mechanisms that propagate trust downstream, including Key Management Systems (KMS), Model Signing Root Authorities, and autonomous agent identities. If a model root authority or MCP interface is compromised, the containment boundary completely collapses. 3. **Governance and Blast-Radius Velocity**: Quantifying the organization's burndown path against risk exposure for executive leadership. When remediation lag exceeds the lifespan of cryptographic trust anchors, the system is deemed "underwater," signaling where migrations must be sequenced immediately.

- The National Institute of Standards and Technology (NIST) has finalized approvals for approximately six post-quantum cryptographic algorithms, with another nine undergoing active standardization review. - Cryptographic ledgers must explicitly map which internal business unit owns each trust anchor and determine the precise "trust half-life" of each algorithm across the software lifecycle.

[10:39](https://www.youtube.com/watch?v=sAClh2MQPYM&t=639s) Non-Human Identity Explosion and the Fragility of Current Trust Stacks

Implementing post-quantum cryptography is not as straightforward as immediately dropping advanced lattice-based schemes like ML-DSA (Dilithium), stateless hash-based signatures, or ML-KEM (CRYSTALS-Kyber) directly into an existing enterprise tech stack. To prevent operational disruption, organizations must rely on hybrid rollover schemes. However, the operational attack surface has exploded due to an unprecedented surge in machine credentials. Industry telemetry from Palo Alto Networks and CyberArk revealed an alarming ratio of 109 non-human identities for every single human identity in the enterprise, a metric that has already accelerated past 130 to 1. In modern environments, over 80% of these identities are fully agentic systems.

```mermaid flowchart TD accTitle: Post-Quantum Hybrid Migration Operating Model

subgraph S1["Phase 1: Cryptographic Visibility"] A["Catalog Cryptographic Assets"] --> B["Identify Legacy Protocols & RSA/ECC Keys"] end

subgraph S2["Phase 2: Hybrid Rollout & Governance"] B --> C["Deploy Hybrid Protocols (e.g., X.509 / X25519)"] C --> D["Mandate PQC Clauses in Vendor Procurement"] end

subgraph S3["Phase 3: Executive Risk & Dual-Pillar State"] D --> E["Model Financial Exposure (ALE Risk Analysis)"] E --> F["Dual-Pillar Architecture (ML-KEM / ML-DSA / FIPS Standards)"] end ```

This structural shift radically alters where security leaders must allocate PQC migration investments. Enterprises now operate model-signing roots, attestation pipelines, and agentic workflows where certificate authorities are managed directly by autonomous AI systems. The critical vulnerability is that the vast majority of these systems still rely on classical asymmetric algorithms like RSA-2048 and Elliptic Curve Cryptography (ECC), which are fundamentally vulnerable to Shor’s algorithm. Even symmetric baselines like AES-256—often regarded as a safe haven under FedRAMP High standards—are under active theoretical and practical pressure from Grover’s algorithm running on quantum processors leveraging quantum superposition states.

- Non-human to human identity ratios have escalated rapidly from 109:1 to confirmed figures exceeding 130:1. - Over 80% of automated non-human identities operate in fully agentic environments. - Core public key infrastructure (PKI), model-signing authorities, and AI agent certificate authorities remain overwhelmingly anchored to breakable RSA-2048 and ECC key exchanges. - Symmetric encryption standards like AES-256 face accelerated risk from Grover's algorithm quantum search speedups.

---

[13:00](https://www.youtube.com/watch?v=sAClh2MQPYM&t=780s) The 36-Month Pragmatic Roadmap: Visibility Over Rip-and-Replace

The timeline to achieve post-quantum resilience is compressing rapidly. Historically, industry consensus projected a quantum transition horizon around 2035, but target dates have continually shifted left to 2031, 2030, and now a firm benchmark of January 1, 2029. Tackling this migration is a daunting engineering challenge; organizations cannot simply deploy an automated agent to sweep and inspect every cryptographic exchange across legacy, multi-tenant, and tightly interdependent customer architectures. The response must be governed by a structured trust half-life model rather than an abrupt rip-and-replace approach.

The first imperative is gaining comprehensive cryptographic inventory visibility across the entire enterprise stack. Organizations must uncover where unencrypted data flows, pinpoint active versions of RSA, and locate deprecated legacy protocols such as TLS 1.1 lingering across application layers 6 and 7. The second phase establishes a hybrid deployment posture using dual protocols (such as modernized X.509 extensions and hybrid key exchange mechanisms) that allow cryptographic workloads to fail over seamlessly without breaking downstream AI dependencies.

- The target operational horizon for post-quantum cryptographic resilience has shifted left from 2035 to January 1, 2029. - Phase 1 requires total cryptographic inventory visibility across legacy networks, multi-tenant environments, and application layers 6 and 7. - Phase 2 focuses on hybrid dual-stack rollover schemes rather than disruptive rip-and-replace infrastructure overhauls.

---

[15:00](https://www.youtube.com/watch?v=sAClh2MQPYM&t=900s) Supply Chain Procurement Mandates and Financial Risk Prioritization

Because public sector entities and enterprises consume far more technology than they build internally, third-party risk management (TPRM) and procurement language form the cornerstone of defense. The City of Seattle—the 17th largest municipality in the United States—has instituted binding procurement rules mandating that before any new critical technology or service is acquired, the vendor must prove compatibility with post-quantum standards by January 1, 2029. Organizations must work immediately with legal, governance, risk, and compliance (GRC), and procurement teams to insert strict PQC tolerance mandates aligned with the NIST FIPS post-quantum standards registry (including FIPS 203 for ML-KEM, FIPS 204 for ML-DSA, and FIPS 205 for SLH-DSA).

``` +-------------------------------------------------------------------------------+ | PQC MIGRATION GOVERNANCE TIMELINE | +-------------------+-----------------------------------------------------------+ | Milestone | Operational Objective | +-------------------+-----------------------------------------------------------+ | Immediate Action | Insert PQC-readiness clauses into all supplier contracts. | | Months 1 - 36 | Deploy hybrid dual-stack architecture and scan inventory. | | Year 3 Benchmark | Present ALE risk analysis and burndown roadmaps to board. | | Target Deadline | Full critical service tolerance by January 1, 2029. | +-------------------+-----------------------------------------------------------+ ```

A 36-month timeline should not be treated as a sprint toward a complete stack rewrite, but as a window to establish a hybrid dual-architecture foundation. By year three, security executives must be prepared to present an actionable burndown prioritization strategy to their boards of directors and city councils. This strategy translates technical cryptographic debt into clear business risk by calculating the financial exposure of underlying application data through Annual Loss Expectancy (ALE) risk modeling.

- Municipalities and enterprises must enforce vendor compliance with NIST FIPS post-quantum standards for all critical service acquisitions. - Procurement and legal frameworks should establish a compliance cut-off of January 1, 2029 for vendor PQC tolerance. - Executive communication hinges on Annual Loss Expectancy (ALE) risk modeling to justify capital allocation and map out burndown prioritizations.

---

[17:03](https://www.youtube.com/watch?v=sAClh2MQPYM&t=1023s) Dual-Pillar Resilience and the Inevitability of Cryptographic Trust

The target architecture is conceptualized as building a new, resilient pillar directly adjacent to the existing fractured cryptographic foundation. This secondary pillar implements standardized algorithms like ML-KEM and ML-DSA while monitoring ongoing standards evaluations, where NIST is currently reviewing additional round algorithms to expand available cryptographic toolsets.

The most acute operational danger facing native AI systems is the signature forgery threat vector. If classical signature delivery mechanisms are broken, the entire security chain collapses: model signing, provenance attestations, and historical compliance audit trails become retroactively untrustworthy. Security teams cannot wait for universal quantum availability to react, because the integrity and confidentiality of historical AI systems must be guaranteed today. Technology leaders must realize that every AI initiative ultimately rests on the underlying math protecting it: "AI trust truly is a cryptographic decision."

- NIST continues to expand its post-quantum registry, actively evaluating additional candidates to broaden enterprise algorithm choices. - Compromised signature mechanisms invalidate model attestations, software provenance, and automated audit logs retroactively. - Long-term integrity and confidentiality in AI systems require dual-pillar architectural adoption before legacy foundations fail.

## Notable quotes > [00:04](https://www.youtube.com/watch?v=sAClh2MQPYM&t=4s) Enterprise AI is being built on a trust layer already marked for replacement. — Jake Hammock

> [00:04](https://www.youtube.com/watch?v=sAClh2MQPYM&t=4s) The foundational trust layer of modern enterprise AI is built on traditional public key cryptography—predominantly RSA and elliptic-curve cryptography (ECC)—which possesses a finite expiration horizon in the face of quantum computing advances. — Jake Hammock

> [03:14](https://www.youtube.com/watch?v=sAClh2MQPYM&t=194s) AI systems were not built on secrecy. They never were. AI systems were generally built on signatures, attestation signatures: who is doing what at what time. — Jake Hammock

> [03:14](https://www.youtube.com/watch?v=sAClh2MQPYM&t=194s) Breaking the signature layer creates a bi-directional crisis of trust: it invalidates both historical records (precursors) and future decisions (postcursors), rendering every output, audit trail, and embedded workflow historically suspect and fundamentally untrustworthy. — Jake Hammock

> [03:29](https://www.youtube.com/watch?v=sAClh2MQPYM&t=209s) Dumping an 18,000-row spreadsheet onto an engineering team provides zero actionable signal on where actual enterprise risk resides, especially when dealing with deeply embedded AI wrappers, proprietary intellectual property, and third-party SaaS dependencies. — Jake Hammock

> [07:29](https://www.youtube.com/watch?v=sAClh2MQPYM&t=449s) When remediation lag exceeds the lifespan of cryptographic trust anchors, the system is deemed 'underwater,' signaling where migrations must be sequenced immediately. — Jake Hammock

> [10:39](https://www.youtube.com/watch?v=sAClh2MQPYM&t=639s) The operational attack surface has exploded due to an unprecedented surge in machine credentials. Industry telemetry from Palo Alto Networks and CyberArk revealed an alarming ratio of 109 non-human identities for every single human identity in the enterprise, a metric that has already accelerated past 130 to 1. — Jake Hammock

> [13:00](https://www.youtube.com/watch?v=sAClh2MQPYM&t=780s) Historically, industry consensus projected a quantum transition horizon around 2035, but target dates have continually shifted left to 2031, 2030, and now a firm benchmark of January 1, 2029. — Jake Hammock

> [13:00](https://www.youtube.com/watch?v=sAClh2MQPYM&t=780s) The response must be governed by a structured trust half-life model rather than an abrupt rip-and-replace approach. — Jake Hammock

> [15:00](https://www.youtube.com/watch?v=sAClh2MQPYM&t=900s) A 36-month timeline should not be treated as a sprint toward a complete stack rewrite, but as a window to establish a hybrid dual-architecture foundation. — Jake Hammock

> [17:03](https://www.youtube.com/watch?v=sAClh2MQPYM&t=1023s) AI trust truly is a cryptographic decision. — Jake Hammock

> Enterprise AI trust will only be as durable as the cryptographic foundation beneath it. — Jake Hammock

## Mentioned Jake Hammock, City of Seattle, Ai4, National Institute of Standards and Technology (NIST), Palo Alto Networks, CyberArk, ML-KEM (CRYSTALS-Kyber), ML-DSA (Dilithium), SLH-DSA, FIPS 203, FIPS 204, FIPS 205, Shor's Algorithm, Grover's Algorithm, RSA / RSA-2048, Elliptic Curve Cryptography (ECC), AES-256, CycloneDX, Model Context Protocol (MCP), FedRAMP High, X.509, TLS 1.3

## Video description Jake Hammock - Chief Information Security Officer, Assistant CTO and Director of Security & Infrastructure, City of Seattle

Enterprise AI is being built on a trust layer already marked for replacement. Model signing, attestation, agent communication, machine identity, key management, API security, and software supply chain provenance all depend on cryptographic systems with a known expiration horizon. Adversaries are no longer harvesting blindly. They are selecting what to capture today for future decryption, using automation to prioritize high-value data, systems, and relationships. This session gives technology and security executives a practical operating model for post-quantum crypto-agility across AI governance, CBOM analysis, vendor evidence, identity architecture, and migration sequencing. Enterprise AI trust will only be as durable as the cryptographic foundation beneath it.

[Source](https://www.youtube.com/watch?v=sAClh2MQPYM)

中文简报

因AI签名伪造风险，西雅图CISO设定2029年量子安全期限对手利用传统公钥密码学将伪造AI模型签名并追溯性地使历史审计线索失效，迫使企业在2029年之前部署混合后量子架构。企业AI系统高度依赖RSA和椭圆曲线密码学（ECC）等密码学信任锚，而这些技术正迅速面临量子技术带来的淘汰风险。尽管传统讨论多聚焦于数据收集，但AI面临的最严峻威胁是签名伪造，它会追溯性地使模型溯源、智能体身份和历史审计日志失效。企业不应依赖难以管理的原始CBOM扫描或颠覆性的彻底推倒重来，而必须采用信任半衰期模型（Trust Half-Life Model），优先处理根信任锚和非人类身份激增问题。技术领导者被敦促采纳为期36个月的混合双支柱路线图，在2029年1月1日之前强制执行符合NIST FIPS标准的严格供应商采购截止期，并通过年度损失预期模型向董事会传达风险。企业AI的信任建立在传统公钥密码学基础（RSA和ECC）之上，由于量子技术的进步，该基础即将面临失效期限。 (0:04) 尽管后量子密码学（PQC）的讨论通常聚焦于数据机密性与“先收集、后解密”，但AI面临的最直接的灾难性威胁是签名伪造。 (3:14) 签名密钥被破解会引发双向信任危机，追溯性地使历史模型权重、证明文件以及未来的智能体决策失效。 (3:14) 自动化的CBOM扫描往往会产生压倒性的噪点（例如超过18,000项发现），而无法为企业风险提供可操作的优先级划分。 (3:29) 信任半衰期模型从三个层级对修复工作进行优先级排序：威胁载体识别、根信任锚优先级确定以及治理爆炸半径速度。 (7:29)

Reading summary

Enterprise artificial intelligence fundamentally depends on cryptographic integrity and attestations, but its underlying classical public-key infrastructure faces an impending expiration against quantum computing advances. To prevent systemic signature forgery and retroactive audit invalidation, technology executives must shift from passive data-protection models to a prioritized trust operating model and hybrid migration by 2029. AI Signature Forgery Over Data Secrecy (3:14) Post-quantum cryptography debates frequently center on the "Harvest Now, Decrypt Later" narrative, which emphasizes data confidentiality. However, the program asserts that enterprise AI is anchored fundamentally in the integrity dimension of the CIA triad rather than secrecy. AI systems rely extensively on digital signatures and attestations to validate model weights, authenticate agent-to-agent interactions, and verify Model Context Protocol pipelines. If adversaries compute the private keys of classical algorithms such as RSA-2048 or elliptic-curve cryptography via quantum capabilities like Shor’s algorithm, the primary danger is immediate and historical signature forgery. An attacker could forge model weights and spoof autonomous agent authorizations. This breach causes a bi-directional trust collapse: it corrupts future agent decisions while retroactively rendering past training records, audit logs, and compliance trails fundamentally untrustworthy. Machine Identity Surge and Operational Blindspots (10:39) The enterprise attack surface has expanded substantially due to an explosion in automated machine credentials. Telemetry from Palo Alto Networks and CyberArk indicates that non-human identities outnumber human identities by a ratio exceeding 130 to 1, with over 80 percent operating in autonomous agentic environments where certificates are issued and managed directly by AI systems. Meanwhile, symmetric baselines like AES-256 face potential theoretical pressure from Grover's algorithm. While enterprises frequently secure client-facing interfaces with TLS 1.3, internal data centers, root key exchanges, and legacy Hardware Security Modules remain heavily dependent on vulnerable public-key cryptography. Furthermore, attempting to manage this debt through uncurated Cryptographic Bill of Materials scans often yields over 18,000 raw findings, causing operational paralysis among engineering teams without actionable risk signaling. The Trust Half-Life Prioritization Framework (7:29) To bridge the gap between sprawling inventory scans and finite engineering capacity, the program proposes the Trust Half-Life Model. This architecture prioritizes assets across three tiers: categorizing explicit threat vectors (such as active signature forgery versus passive exfiltration), identifying centralized root trust anchors (including Key Management Systems, model-signing authorities, and agentic identity wrappers), and measuring blast-radius velocity against remediation speed. Under this model, systems are labeled "underwater" when remediation lag exceeds the functional lifespan of the underlying cryptographic trust anchor. This signaling mechanism enables organizations to map ownership to specific business units and sequence mitigations according to NIST post-quantum standards—such as finalized algorithms and candidates currently under active standardization review. The 2029 Horizon and Procurement Mandates (15:00) Industry consensus on post-quantum resilience has compressed its operational target horizon from 2035 to January 1, 2029. Given the scale of enterprise estates—such as the City of Seattle managing over 2,700 applications—an immediate "rip-and-replace" migration is deemed technically unfeasible. Organizations must instead adopt a 36-month roadmap establishing hybrid dual-stack rollover schemes, implementing NIST standards such as FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA) alongside legacy protocols. Because enterprises procure the majority of their IT infrastructure, vendor management serves as a critical defense line. For example, the City of Seattle has established binding procurement rules requiring vendors of critical services to demonstrate post-quantum compatibility by the 2029 deadline. Security executives are advised to articulate these technical risks to boards through Annual Loss Expectancy risk modeling to secure capital allocation and govern burndown roadmaps. The source concludes that enterprise AI governance cannot be separated from its underlying cryptographic foundation, as invalid mathematical trust roots inevitably compromise AI provenance. A critical challenge remains whether organizations can execute complex hybrid protocol migrations and enforce vendor procurement compliance across legacy environments before the accelerated 2029 threshold.

精炼阅读摘要

企业人工智能的繁荣建立在脆弱的传统公钥密码学之上，正面临量子计算发展带来的结构性失效风险。根据业内观点，AI系统的核心安全威胁已从被动的数据窃取转向主动的签名伪造，技术高管须通过信任半衰期模型、供应链采购硬约束及双柱混合架构，在2029年1月1日这一加速到来的基准节点前实现后量子密码迁移。 AI信任危机：从窃取机密转向签名伪造 (3:14) 现代企业AI的运转极度依赖身份验证、模型输出检验与自动化审计，这些能力深植于RSA与椭圆曲线密码学（ECC）等传统公钥算法。然而，企业往往只升级外围的TLS 1.3协议，却长期搁置核心数据中心和遗留硬件安全模块（HSM）的改造。在后量子密码学（PQC）讨论中，安全管理者习惯强调“先拦截、后解密”（HNDL）的数据机密性风险，但针对AI架构，最致命且迫在眉睫的威胁在于数字签名伪造。发言人指出，AI系统从根本上建立在签名与身份认证之上，而非单纯依赖保密性。一旦对手破解私钥，无需等待成熟量子计算机问世，便能伪造模型权重、篡改训练与推理凭证，甚至冒充智能体授权载荷。这种签名层面的破坏引发了双向信任危机：它不仅使未来的决策失效，还会溯及既往地破坏所有历史审计日志与嵌入式工作流的真实性，导致全系统信任崩溃。机器身份激增与CBOM治理瘫痪 (3:29) 自动化凭证的爆炸式增长大幅放大了密码学暴露面。来自Palo Alto Networks与CyberArk的行业遥测数据显示，企业内部非人类身份与人类身份的比例已从早先的109:1攀升至超过130:1，其中逾80%由全自主智能体驱动。当前诸多模型签名根证书与智能体工作流直接由AI系统管理，底层却普遍延用极易被Shor算法攻破的RSA-2048或ECC密钥。即便被FedRAMP High标准认可的AES-256对称加密，也面临Grover算法在量子叠加态下的理论与实用加速破解挑战。面对错综复杂的混合网络（例如西雅图市需要管理跨数据中心和云端的2,700多个独立应用），许多安全团队试图利用CycloneDX等标准推行密码学物料清单（CBOM）动态扫描。然而，单次扫描往往会吐出多达18,000余项杂乱结果。直接将上万行的电子表格抛给工程团队，不仅无法提供明确的风险优先级，反而在面对嵌入式AI封装与第三方SaaS依赖时造成严重的运营瘫痪。信任半衰期模型与爆炸半径量化 (7:29) 为打破海量扫描数据与有限工程资源之间的治理僵局，方案提出了“信任半衰期模型”（Trust Half-Life Model）。该框架分为三个层次：第一层是威胁向量分类，跳过泛化的量子预警，针对性评估主动运行时签名伪造与被动数据外泄的具体行为；第二层聚焦根信任锚点优先级，精确锁定密钥管理系统（KMS）、模型签名根授权机构以及智能体MCP（模型上下文协议）接口，因为一旦根节点被攻破，安全边界将整体瓦解。第三层则是量化治理与爆炸半径扩散速度，向董事会等最高决策层明确风险燃尽路径。当企业资产的补救修复滞后于密码信任锚点的衰变周期时，该系统即被判定为进入不可控的“溺水”（underwater）状态。目前美国国家标准与技术研究院（NIST）已完成约6种后量子算法的正式审批，并正在对另外9种算法展开审查。企业必须建立明确的密码分类账，划定业务权属并测算整个生命周期中的信任半衰期。 36个月双柱路线图与供应链硬约束 (13:00) 后量子密码韧性的达标窗口正在急剧收紧，行业预期已从最初的2035年一路前移至2031年和2030年，目前进一步确立为2029年1月1日这一刚性基准。面对繁重的工程改造，企业无法实施激进的推倒重来（rip-and-replace），而应在36个月内构建平滑过渡的双柱混合架构。前期工作需全面排查第6层和第7层网络中的遗留TLS 1.1与过时RSA密钥，随后部署采用现代化X.509扩展和混合密钥交换机制的双协议栈，确保系统在故障转移时不中断AI业务调用。由于企业与公共部门普遍大量采购外部软件，供应链采购管理成为防御的关键抓手。作为全美第17大城市，西雅图市已实施强制性采购条款，要求供应商在采购新关键服务前必须证明符合2029年1月1日的后量子标准，并与FIPS 203（ML-KEM）、FIPS 204（ML-DSA）和FIPS 205（SLH-DSA）对齐。在推进技术迁移的同时，安全主管须向董事会引入年度预期损失（ALE）风险模型，将密码技术债务精准转化为资产层面的财务风险指标，以支撑资本预算决策。后量子迁移本质上是一场关于AI系统存亡的信任治理决断。尽管NIST标准推进与双柱混合架构提供了明确的落地路径，但面对2029年紧迫的合规节点以及大量传统数据中心和硬件安全模块（HSM）的改造滞后，如何在有限预算与激增的非人类凭证压力下协调多方生态，依然是企业技术高管必须应对的严峻考验。

Detailed notes — zh

## Background 本内容由 Ai4 频道于 2026 年 8 月 17 日发布在 YouTube 平台上，演讲者为西雅图市首席信息安全官、助理首席技术官兼安全与基础设施总监 Jake Hammock。演讲重点探讨了企业级 AI 所依赖的经典密码学信任底座面临的量子威胁，并为技术与安全高管提供了一套涵盖 AI 治理、加密软件物料清单（CBOM）、供应链采购与混合迁移序列的抗量子密码学（PQC）实用运营模型。 ## TL;DR 企业级 AI 的模型签名、智能体身份认证与 API 交互目前严重依赖 RSA 和 ECC 等经典公钥密码体系，如同建立在脆弱地基上的“纸牌屋”。相比传统的“先收集后解密”数据泄露威胁，量子计算驱动的“签名伪造”对 AI 完整性具有更致命的前溯与后延双向破坏力。为了化解 CBOM 扫描带来的海量告警瘫痪，西雅图市提出了包含威胁建模、信任锚点优先级与燃尽图治理的“信任半衰期模型”。技术高管应在未来 36 个月窗口期内推行混合过渡架构，利用年度预期损失（ALE）向董事会量化财务风险，并在采购合同中硬性嵌入后量子（ML-KEM、ML-DSA）容错合规指标。 ## Atmosphere & style 演讲节奏紧凑、直击痛点且极具实战紧迫感，Jake Hammock 凭借市政级复杂架构的治理实战经验，打破了密码学与 AI 治理之间的技术壁垒。他运用“纸牌屋”、“信任半衰期”等生动比喻与拉斯维加斯现场的幽默调侃，巧妙地将枯燥晦涩的数学算法危机转化为高管听得懂的财务与生存风险。整体氛围既有对量子击穿经典加密确定性危机的冷峻警示，又给出了条理清晰、可立即落地的防御路线图，给听众带来强烈的危机意识与架构启发。 ## Key takeaways - [00:04](https://www.youtube.com/watch?v=sAClh2MQPYM&t=4s) 企业级 AI 的信任大厦建立在脆弱的经典密码学底座上，模型签名、智能体身份与 API 交互仍依赖易被量子计算击破的 RSA 和 ECC 体系，存在“纸牌屋”坍塌的系统性风险。 - [03:14](https://www.youtube.com/watch?v=sAClh2MQPYM&t=194s) 后量子时代的核心威胁已从保密维度的“先收集后解密”（HNDL）转变为即时发生的“签名伪造”（Forgery），直接威胁 AI 系统的完整性与审计追踪链条。 - [03:14](https://www.youtube.com/watch?v=sAClh2MQPYM&t=194s) 签名伪造具有前溯性与后延性的双重破坏：一旦根密钥被攻破，AI 系统过往积累的所有合规审计历史全部失去信任效力，攻击者未来还能持续注入伪造指令。 - [05:29](https://www.youtube.com/watch?v=sAClh2MQPYM&t=329s) PQC 改造必须上升至董事会层级的财务与战略议题，单纯依靠静态 CBOM 扫描容易产生上万条告警并陷入修复瘫痪，亟需结构化的风险收敛框架。 - [07:24](https://www.youtube.com/watch?v=sAClh2MQPYM&t=444s) “信任半衰期模型”提供了三层治理路径，核心在于将有限的安全工程资源精准聚焦于密钥管理系统（KMS）与模型签名根等高爆炸半径的关键信任锚点。 - [10:39](https://www.youtube.com/watch?v=sAClh2MQPYM&t=639s) 非人身份（NHI）与人类员工比例已激增至 130:1 以上，且超 80% 为全自主运行的 Agent 智能体，其调度的证书体系大多依托已不再安全的传统公钥架构。 - [10:39](https://www.youtube.com/watch?v=sAClh2MQPYM&t=639s) 秀尔算法从数学根基上摧毁了经典公钥加密，而格罗弗算法也在大幅压缩对称加密（如 AES-256）的安全时间窗口，迫使组织加速向 ML-KEM 和 ML-DSA 演进。 - [13:06](https://www.youtube.com/watch?v=sAClh2MQPYM&t=786s) 应对量子威胁应摒弃全盘推倒重来的休克疗法，转而采用 X.509 混合双证书及混合密钥交换（如 X25519 结合抗量子算法），在 36 个月窗口期内实现平滑过渡。 - [14:59](https://www.youtube.com/watch?v=sAClh2MQPYM&t=899s) 技术高管必须推动供应链准入硬性指标，如西雅图市明确规定 2029 年 1 月 1 日前采购的关键供应商技术必须具备抗量子加密（PQC）耐受性与互操作能力。 - [16:03](https://www.youtube.com/watch?v=sAClh2MQPYM&t=963s) 借助年度预期损失（ALE）等财务量化模型与风险燃尽图，安全团队可将抽象的密码学术语转换为董事会能够理解的高价值资产财务敞口与资本分配决策。 - [16:03](https://www.youtube.com/watch?v=sAClh2MQPYM&t=963s) AI 信任的本质归根结底是一项密码学决断；如果支撑模型权重与行为审计的加密根基失守，整个系统的合规性与可信度将面临全盘崩溃。 ## Detailed walkthrough ### [00:04](https://www.youtube.com/watch?v=sAClh2MQPYM&t=4s) AI 信任底座的隐患：建立在脆弱密码学之上的“纸牌屋” 在企业级 AI 系统的构建过程中，无论最终交付的是模型生成结果、智能体（Agent）签名、证书颁发机构（CA）认证，还是模型注册签名，企业都在无条件地生产和依赖“信任”。即便是部署了最尖端的深度质量检验（QA）模型来审核其他模型的输出，底层系统依旧完全依托于信任链条。然而，支撑当今所有前沿 AI 系统与模型的信任支柱正在从底部发生碎裂——其根基仍然建立在 RSA 和椭圆曲线密码学（ECC）等经典公钥密码体系之上。随着量子计算的发展，这些算法的数学基础在本质上已不再安全，正在从根本上动摇“信任”的定义。当今的技术架构往往被设计得像一座精密的“纸牌屋”。企业在产品线中层层加码，不断堆叠高价值资产以强化信任，涵盖了模型签名、智能体身份、智能体认证、API 调用乃至模型上下文协议（MCP）和对抗性生成测试。然而，位于最底层的加密密钥交换与数字签名组件却存在根本性的安全脆弱性。一旦最底部的公钥基础设施被攻破，无论上层的信任架构搭建得多高、投入了多少工程资源，整座大厦都会随之坍塌。许多组织在应用层快速部署了 TLS 1.3，却忽视了数据中心内硬件安全模块（HSM）的后量子改造，抱着“这是十年后才需要考虑的问题”的拖延心态；但事实上，简单的加密软件物料清单（CBOM）根本无法独立解决这一底层系统性危机。 ```mermaid flowchart TD accTitle: AI Trust Architecture House of Cards subgraph UpperLayers ["应用与智能体信任层（高投入）"] A["模型输出与深度 QA 质检"] B["智能体身份认证与 MCP / API 交互"] C["模型签名与 CA 证书验证"] end subgraph CryptoBase ["底层密码学支柱（高风险脆断点）"] D["公钥密码学体系（RSA / ECC 密钥交换）"] end UpperLayers --> D style D fill:#f96,stroke:#333,stroke-width:2px ``` --- ### [03:14](https://www.youtube.com/watch?v=sAClh2MQPYM&t=194s) 从“先收集后解密”转向即时威胁：AI 签名的“伪造”危机在传统的后量子密码学（PQC）讨论中，话题往往始于并局限于“先收集，后解密”（Harvest Now, Decrypt Later, HNDL）模型。CISO 们通常将这种保密性风险作为争取预算的“末日故事”，向管理层主张必须立即升级系统，以防攻击者在未来量子处理器普及后解密窃取的数据。然而，在嵌入式 AI 与前沿模型体系中，潜伏着更为致命的直接威胁——签名伪造（Forgery）。这一威胁将安全重心从传统的机密性（Confidentiality）直接转移到了安全三要素中的完整性（Integrity）锚点上。 AI 系统的核心架构从来都不是建立在绝对的“秘密”之上的，而是建立在**数字签名与认证**（Attestation Signatures）之上——即精确记录并证明“谁在什么时间执行了什么操作”，并通过不可篡改的审计追踪加以固化。伪造攻击的危险在于它具备即时可操作性：攻击者无需等待实用化量子计算机的诞生，只要识别并攻破 AI 系统链条中任何一个薄弱的签名节点即可。这种破坏具有双向的毁灭性（Duality）： - **前溯性破坏（Precursor）**：AI 系统历史上构建、输出与集成的所有历史记录和审计结果全部失去信任效力。 - **后延性破坏（Postcursor）**：攻击者能够以合法的认证身份向未来系统持续注入恶意指令与伪造结果。正如讲者所强调的：“如果加密体系被攻破或失窃……该 AI 系统曾经构建、输出、集成的所有内容，都将从根本上遭到彻底破坏。” --- ### [05:29](https://www.youtube.com/watch?v=sAClh2MQPYM&t=329s) 董事会级治理危机与 CBOM 的“海量告警困境” PQC 现代化改造与 AI 签名安全绝对不是一个可以随意丢给加密团队或平台安全工程团队、让他们“自行搞定”的单点技术问题，而是一个必须上升到董事会维度的企业战略与财务风险议题。技术高管（CISO、CIO、CTO、CPO）必须在整个应用技术栈中全面评估自身的风险敞口。以西雅图市政府为例，其 IT 基础设施涵盖了多达 2,700 个应用程序、横跨多个数据中心和异构混合环境，资产治理极其庞杂。许多组织试图通过动态扫描工具（如 CycloneDX 标准）生成加密软件物料清单（CBOM）来应对合规与安全审查，但往往会陷入“告警瘫痪”的困局： - 单次扫描可能产生超过 **18,000 个**加密资产发现项。 - 直接将包含 1.8 万行对象的 CSV 文件甩给安全团队是毫无实操价值的，不仅无法解决问题，反而会导致修复动作停滞。 - 无论是自主研发 AI 架构还是集成第三方嵌入式 AI 服务，若无法精确收敛伪造风险，企业就会不断引入反复出现的系统性缺陷，导致后期治理和补救成本呈指数级上升。 --- ### [07:24](https://www.youtube.com/watch?v=sAClh2MQPYM&t=444s) 信任半衰期模型：后量子时代 AI 治理的三层架构为了化解海量资产无法落地的矛盾，西雅图团队提出了**信任半衰期模型（Trust Half-Life Model）**，旨在帮助企业系统化识别并保护其核心“信任锚点”（Trust Anchors）。面对传统安全大会上宣称的“优先级排序已死”的论调，该模型通过严密的逻辑框架重构了后量子迁移的实施路径，分为三个核心层级： ```mermaid flowchart LR accTitle: Trust Half-Life Model Three Tiers subgraph Tier1 ["第一层：威胁建模"] T["针对 AI 签名的伪造威胁 (Forgery)"] end subgraph Tier2 ["第二层：优先级排序"] P1["密钥管理系统 (KMS)"] P2["模型签名根 (Model Signing Roots)"] end subgraph Tier3 ["第三层：董事会治理"] G["燃尽图修复路径 (Burndown Path)"] end Tier1 --> Tier2 --> Tier3 ``` 1. **第一层：威胁建模（Threat）** 以危害最大的签名伪造威胁为基准，识别薄弱环节对 AI 整体信任链的穿透力。 2. **第二层：根信任锚点优先级排序（Prioritization）** 锁定具有超大爆炸半径（Blast Radius）的关键基础设施。其中，密钥管理系统（KMS）与**模型签名根（Model Signing Roots）**是 AI 系统的核心命脉。无论企业是自研大模型、调用托管服务，还是使用封装的外层应用与智能体协议（如私有 MCP），模型签名根都是决定资产合法性的最终信任锚点。 3. **第三层：治理与燃尽路径（Governance）** 向董事会清晰展示具体的修复与风险燃尽路径（Burndown Remediation Path）。在治理分析矩阵中，若系统关键节点落在警示区域（模型图谱中的“黄点”），即意味着该系统的潜在爆炸半径已经超出控制时效，处于实质上的“水下（Underwater）”失控状态。企业必须建立结构化的加密资产账本（Ledger），清晰界定各个信任锚点的所有权及其抵御现有与后量子攻击的信任寿命。目前，美国国家标准与技术研究院（NIST）已正式批准了约 6 种后量子密码算法，并有 9 种算法正在接受审查。组织必须以这些前沿标准为基准，将有限的工程与安全资源精准投放至核心信任锚点上。 ### [10:39](https://www.youtube.com/watch?v=sAClh2MQPYM&t=639s) 信任半衰期模型与非人身份（NHI）的指数级激增在展示其“信任半衰期模型”（Trust Half-Life Model）的幻灯片时，Jake Hammock 极力建议台下的技术高管们拿出手机拍照存盘。对于正在构建 AI 系统并需要向市场、客户、社区乃至市民证明其系统安全性（包括模型内嵌的签名分发功能）的团队而言，这套治理框架能提供直接的架构参考。直接把 ML-DSA（CRYSTALS-Dilithium）这类基于格的数字签名算法或 ML-KEM（CRYSTALS-Kyber）密钥封装机制硬塞进现有的生产技术栈绝非易事，工程团队面临着前所未有的兼容性挑战，这正是为何业界必须依赖混合平滑过渡方案（Hybrid Rollover Schemes）的原因。更为严峻的挑战在于机器身份与代理权力的爆发式失控。Jake 引用了 Palo Alto Networks 与 CyberArk 的最新调研数据，半开玩笑地调侃道：“既然我们人在拉斯维加斯，那就把赌注再抬高一点”——当前企业环境中非人身份（Non-Human Identities, NHI）与人类员工的比例已经达到了 109 比 1；而在演讲当天，这一数据甚至已经刷新到了 130 比 1 以上，使得现存的统计图表在制作完成的瞬间便已过时。这种结构性巨变深刻地改变了抗量子密码（PQC）迁移与安全投资的底层逻辑：在庞大的非人身份中，超过 80% 是完全自主运行的 Agent 智能体。当下许多证书颁发机构（CA）实际上正由 AI 自主系统直接掌管与调度，但它们底层依赖的却往往是传统的公钥体系，如 ECC 或 RSA-2048 非对称密钥交换。Jake 直言不讳地警告：“我向你们保证，它们实际上已经被攻破了。”量子领域的秀尔算法（Shor's algorithm）从数学根基上摧毁了经典非对称加密体系。即便企业退回到对称加密，寄希望于将 AES-256 与 FedRAMP High 合规标准作为救命稻草，格罗弗算法（Grover's algorithm）也正在利用量子叠加态特性全面挑战对称密钥的有效安全边界，大幅压缩密钥破解所需的时间窗口，迫使所有产品型组织必须紧急提速其应对日程。 - **非人身份悬殊比例**：企业内部非人身份（NHI）与人类身份的比例已从 109:1 飙升至 130:1 以上，且超过 80% 属于全自主 Agent 智能体。 - **经典算法失效威胁**：Shor 算法使传统的 RSA-2048 和 ECC 密钥交换机制面临确定性失效；Grover 算法则大幅削弱了包括 AES-256 在内的对称密码体系的安全冗余。 - **架构过渡路径**：弃用单点暴力替换，转向支持 ML-KEM 与 ML-DSA 的混合密钥交换与过渡机制。 --- ### [13:06](https://www.youtube.com/watch?v=sAClh2MQPYM&t=786s) 36个月倒计时：从资产可见性到混合式过渡（Hybrid Rollout）面对迫在眉睫的量子威胁，留给企业的安全窗口正在加速关闭。尽管业界口口相传的倒计时往往被称为“剩余 36 个月”，甚至长期流传着“必须在 2029 年 1 月 1 日、2030 年或 2031 年前全面完成 PQC 改造”的末日预案，但十年前人们对这一时刻的预估普遍还是遥远的 2035 年——整个行业的时间表正被持续大幅向左压缩。然而，量子迁移绝非像部署一个监控 Agent 扫描全部加密流量那样轻松。在复杂的企业 AI 环境中，多租户架构、深层遗留代码栈以及错综复杂的客户间依赖关系，往往使得全盘被动探测变得寸步难行。 ```mermaid flowchart LR accTitle: Post-Quantum Cryptography Hybrid Migration Lifecycle subgraph Phase1["第一阶段：可见性梳理"] A["发现遗留密码资产 (RSA / TLS 1.1 / 明文数据)"] --> B["绘制 AI 系统与代理 加密依赖图谱"] end subgraph Phase2["第二阶段：混合式架构"] C["部署双协议栈 (X.509 混合证书 / X25519)"] --> D["平滑分流加密负载 建立后量子容错基线"] end subgraph Phase3["第三阶段：采购与量化治理"] E["供应链强制条款 (2029年前具备 PQC 容错)"] --> F["ALE 财务风险模型 向董事会汇报优先级"] end Phase1 --> Phase2 Phase2 --> Phase3 ``` 应对这一庞大工程的切入点正是“信任半衰期模型”。首先必须建立彻底的资产可见性（Visibility），Jake 幽默地表示每次参加安全或 AI 峰会大家都在复读这个词，但他仍必须强调其核心价值：企业必须准确掌握自身拥有的 RSA 版本分布、敏感数据是否在特定节点裸奔、以及在技术栈的第 6 层与第 7 层是否仍在隐秘运行老旧的 TLS 1.1 协议。然而，第二阶段的核心战略绝不是“推倒重来”（Rip and Replace）的休克疗法。谈及 PQC 或量子密钥分发（QKD）时，业内往往容易产生全面推倒现有架构的恐慌。真正可落地的策略是实施混合式推进（Hybridized Rollouts），例如基于升级的 X.509 双证书架构或结合经典椭圆曲线的混合密钥交换协议（如 X25519 配合后量子算法）。通过这些混合过渡机制，企业得以在采购或构建的 AI 系统中建立起全新的安全基线，并在保障业务连续性的同时，安全地实现加密负载的故障切换（Failover）。 --- ### [14:59](https://www.youtube.com/watch?v=sAClh2MQPYM&t=899s) 供应链治理与西雅图市的 PQC 采购硬性指标作为全美第 17 大市政实体，西雅图市虽然高度重视技术创新，但在引入系统时极为严苛，因为政府的核心职能更侧重于审慎采购而非自主开发产品。Jake 借此向在场所有技术负责人抛出了一个现实问题：在未来 36 个月内，有多少组织已经正式更新了核心关键供应商的采购合同条款？企业必须在采购政策中明确加入“供应商应用必须在指定日期前具备抗量子密码（PQC）耐受性或防御能力”的硬性指标。这一举措是第三方风险管理（TPRM）和 GRC（治理、风险与合规）策略中最关键、也最容易被忽视的一环。 Jake 强烈建议技术高管立即与组织内的法务、采购和风险控制团队展开协同，在合同模板中前置植入后量子要求。西雅图市政府目前已经全面推行该规范：在 2029 年 1 月 1 日最后期限到来前，任何采购进市政系统的新技术与关键服务，都必须内置能够与市政安全体系互操作并保持容错的后量子加密算法。在具体标准选择上，企业应遵循美国国家标准与技术研究院（NIST）的联邦信息处理标准（FIPS）路线图，优先关注已标准化的 FIPS 203（ML-KEM）、FIPS 204（ML-DSA）和 FIPS 205（SLH-DSA）等算法注册表。事实上，许多主流现代浏览器在当下底层已经开始默默运行 ML-KEM 的试验性握手。Jake 再次厘清了 36 个月里程碑的真实定义：它并不要求企业在三年内彻底淘汰所有旧资产，而是要求组织必须在三年内完成混合双架构的铺设，从而能够在技术周期节点到来时胸有成竹地推进后续治理。 --- ### [16:03](https://www.youtube.com/watch?v=sAClh2MQPYM&t=963s) 向董事会量化风险：年度预期损失（ALE）与双支柱信任架构建立起混合双架构路径后，首席信息安全官与技术主管们便能底气十足地面向董事会、执行管理层或西雅图市议会等权力机构汇报。此时的汇报语言不再是抽象的密码学术语，而是清晰的燃尽图优先级（Burndown Prioritization）、资本支出分配、真实敞口以及风险容忍度。更为关键的是，安全团队能够借助“年度预期损失”（Annual Loss Expectancy, ALE）风险量化分析模型，精确计算出承载核心高价值数据的 AI 系统在面对解密风险时所背负的真实财务敞口。这种量化商业语言能让非技术决策层迅速理解在底层架构中引入抗量子能力的经济必要性。 Jake 用其经典的架构示意图进行总结：原先支撑企业系统信任的传统密码学支柱已经发生了结构性断裂，而在它身旁，业界正在浇筑起一根崭新的、支持 ML-KEM、ML-DSA 等算法的现代化抗量子支柱。随着 NIST 正在对第二批 9 种备选算法进行评估，并在年底前有望最终敲定 4 至 6 种新标准，企业的技术武器库与选择自由度还将持续扩大。最后，Jake 强调了整个演讲中最具毁灭性的风险维度——AI 原生环境中基于数字签名的伪造威胁（Forgery Threat Vector）。在当今由 AI 驱动的自主工作流中，如果底层代码签名、权重验证与代理证明系统的签名密钥因经典加密被攻破而遭到追溯性伪造，那么系统历来所有的合规审计结果、不可篡改日志以及机器身份认证将全线失去可信度。那将是一场谁也无法在监管机构面前自圆其说的灾难。“AI 信任的本质，归根结底是一项密码学决断”（"AI trust truly is a cryptographic decision."），Jake 在全场的掌声中结束了演讲，并邀请参会者共同深思这一关乎企业长期存亡的技术基石。 - **高管汇报工具**：利用年度预期损失（ALE）数学模型，将 AI 系统加密漏洞转换为具象的财务风险数据，制定分阶段的燃尽优先级图谱。 - **算法评估演进**：除了现行的 ML-KEM 和 ML-DSA 标准外，NIST 正在评估另外 9 种候选算法，预计年内增选 4 至 6 种，进一步丰富后量子防御矩阵。 - **签名伪造灾难**：数字签名算法一旦被量子算力击穿，不仅未来数据受损，过去所有依赖数字签名的历史模型存证、AI 行为审计轨迹与合规背书都将被全盘推翻。 ## Notable quotes > [03:14](https://www.youtube.com/watch?v=sAClh2MQPYM&t=194s) 如果加密体系被攻破或失窃……该 AI 系统曾经构建、输出、集成的所有内容，都将从根本上遭到彻底破坏。 — Jake Hammock > [10:39](https://www.youtube.com/watch?v=sAClh2MQPYM&t=639s) 既然我们人在拉斯维加斯，那就把赌注再抬高一点 — Jake Hammock > [10:39](https://www.youtube.com/watch?v=sAClh2MQPYM&t=639s) 我向你们保证，它们实际上已经被攻破了。 — Jake Hammock > [16:03](https://www.youtube.com/watch?v=sAClh2MQPYM&t=963s) AI trust truly is a cryptographic decision. — Jake Hammock ## Mentioned Jake Hammock, 西雅图市政府 (City of Seattle), NIST (美国国家标准与技术研究院), Palo Alto Networks, CyberArk, RSA, ECC, TLS 1.3, TLS 1.1, HSM (硬件安全模块), CBOM (加密软件物料清单), CycloneDX, HNDL (先收集后解密), MCP (模型上下文协议), KMS (密钥管理系统), ML-DSA (CRYSTALS-Dilithium), ML-KEM (CRYSTALS-Kyber), SLH-DSA, FIPS 203, FIPS 204, FIPS 205, Shor 算法, Grover 算法, AES-256, FedRAMP High, X.509, X25519, QKD (量子密钥分发), ALE (年度预期损失) ## Video description Jake Hammock - Chief Information Security Officer, Assistant CTO and Director of Security & Infrastructure, City of Seattle Enterprise AI is being built on a trust layer already marked for replacement. Model signing, attestation, agent communication, machine identity, key management, API security, and software supply chain provenance all depend on cryptographic systems with a known expiration horizon. Adversaries are no longer harvesting blindly. They are selecting what to capture today for future decryption, using automation to prioritize high-value data, systems, and relationships. This session gives technology and security executives a practical operating model for post-quantum crypto-agility across AI governance, CBOM analysis, vendor evidence, identity architecture, and migration sequencing. Enterprise AI trust will only be as durable as the cryptographic foundation beneath it. [Source](https://www.youtube.com/watch?v=sAClh2MQPYM)

Source quotes

[3:14] Jake Hammock: 如果加密体系被攻破或失窃……该 AI 系统曾经构建、输出、集成的所有内容，都将从根本上遭到彻底破坏。 [10:39] Jake Hammock: 既然我们人在拉斯维加斯，那就把赌注再抬高一点 [10:39] Jake Hammock: 我向你们保证，它们实际上已经被攻破了。 [16:03] Jake Hammock: AI trust truly is a cryptographic decision.

Source quotes

[0:04] Jake Hammock: Enterprise AI is being built on a trust layer already marked for replacement. [0:04] Jake Hammock: The foundational trust layer of modern enterprise AI is built on traditional public key cryptography—predominantly RSA and elliptic-curve cryptography (ECC)—which possesses a finite expiration horizon in the face of quantum computing advances. [3:14] Jake Hammock: AI systems were not built on secrecy. They never were. AI systems were generally built on signatures, attestation signatures: who is doing what at what time. [3:14] Jake Hammock: Breaking the signature layer creates a bi-directional crisis of trust: it invalidates both historical records (precursors) and future decisions (postcursors), rendering every output, audit trail, and embedded workflow historically suspect and fundamentally untrustworthy. [3:29] Jake Hammock: Dumping an 18,000-row spreadsheet onto an engineering team provides zero actionable signal on where actual enterprise risk resides, especially when dealing with deeply embedded AI wrappers, proprietary intellectual property, and third-party SaaS dependencies. [7:29] Jake Hammock: When remediation lag exceeds the lifespan of cryptographic trust anchors, the system is deemed 'underwater,' signaling where migrations must be sequenced immediately. [10:39] Jake Hammock: The operational attack surface has exploded due to an unprecedented surge in machine credentials. Industry telemetry from Palo Alto Networks and CyberArk revealed an alarming ratio of 109 non-human identities for every single human identity in the enterprise, a metric that has already accelerated past 130 to 1. [13:00] Jake Hammock: Historically, industry consensus projected a quantum transition horizon around 2035, but target dates have continually shifted left to 2031, 2030, and now a firm benchmark of January 1, 2029. [13:00] Jake Hammock: The response must be governed by a structured trust half-life model rather than an abrupt rip-and-replace approach. [15:00] Jake Hammock: A 36-month timeline should not be treated as a sprint toward a complete stack rewrite, but as a window to establish a hybrid dual-architecture foundation. [17:03] Jake Hammock: AI trust truly is a cryptographic decision. Jake Hammock: Enterprise AI trust will only be as durable as the cryptographic foundation beneath it.

Original transcript

[0:04] Today we're actually talking about PQC modernization or postquantum cryptography [0:08] modernization. And so every one of you most of you are in product engineers but by show of [0:15] hands because I want to know exactly my audience here who's in cyber cyber security syso platform. [0:20] Yes. Okay. We got allies here. Generally when I have these conversations they are product [0:24] engineers, developers, machine learning engineers and I'm kind of owned in this [0:27] actually conversation. So got allies. Right? All of the AI systems that you're using right [0:32] now is producing an output of trust. Whether that would be a model output, [0:38] agent signing, certificate authority signing, signature registrations, you trust it. [0:44] Even with your fancy deep QA inspect models that are QA inspecting the other models output, [0:50] we inherently rely on trust. And so if you look at the slide, you're going to see a pillar there [0:56] that is fracturing where all of our AI systems and models are built on top of. And at the very bottom [1:02] of this, and you'll see a key theme, it's built on public key cryptography, elliptic curve, RSA, [1:10] those signatures are inherently weak and they are crumbling the very virtue of how we define trust. [1:17] So let's talk about a little bit that right now, right? [1:20] And if we're talking about PQC or quantum key distribution, very complicated, but it doesn't [1:25] have to be. We generally design our systems like a house of cards, like models. And so in [1:31] this particular example, as you look at the slide, every floor is something that we have invested so [1:38] much value in to deliver trust and we beef them up within our product inventory lines, right? [1:43] model signing, agent identity, agent addestations, API calls, and we can go really down in the [1:48] weeds even to MCP or adversarial generation testing if we need to go there at that level. [1:54] But what's at the very bottom? We still rely on inherently vulnerable cryptographic inventories [2:02] such as public key exchanges. And if we have any level of attribution of trust that could [2:08] be compromised, it's there. And so no matter how high this tower gets in this trust layer, [2:14] which is why I call it more of a trust layer than anything else, no matter how high we build, [2:18] how much energy that we invest into it, how much that we even deploy PQC, [2:25] do include a TLS 1.3 connection in our app stacks, but we just completely forget our data centers [2:29] and don't deploy the HSMs and we just say, "Ah, we'll get to that 10 years from now. It's not my [2:33] problem right now." Right? And it happens every one of you. It happens in your organization. It [2:37] happens to us. We're public sector. We're generally pretty slow to move candidly, [2:42] but we've actually taken a model to take this very seriously. And I'm introducing a model [2:45] now that may actually help you because a seab bomb is not coming to save you. [2:50] And we'll get to that in a moment on what cryptographic bill of materials or software bill [2:54] of materials lineage. I'm going to introduce to you a model and a threat vector in just a moment [2:59] that will actually preemptively retrograde your existing sebomb initiatives. [3:06] But it's all in one layer. It's all in one asynchronous layer what your foundation is in. [3:14] And so kind of going right into the meat of it here in most PQC conversations or postquantum [3:19] cryptography conversations, we generally start and end with harvest now decrypt. It's our best way of [3:26] our doomsday stories as a syso to try to allocate us funding so that we can get the necessary [3:30] capital to upgrade all of our systems. Right? If we upgrade now, our attackers won't be able to [3:34] steal the confidentiality of the data later when quantum processors become eventually distributed. [3:40] Um, having developed in this world for quite many years now that I can tell you there's far more [3:45] worse dangers actually lurking right around the corner. Today we're going to talk about forgery. [3:50] So forgery within AI systems specifically to include embedded AI, not just frontier AI models, [3:55] but embedded AI. We now actually shift the threat from confidentiality now to the old CIA triad into [4:02] the integrity anchor point. Integrity of these signatures. AI systems were not built on secrecy. [4:10] They never were. AI systems were generally built on signatures at a station signatures who is doing [4:18] what at what time. And we have audit trails. Those audit trails can also be logged at a stations. [4:24] The previous pres presenter I think did a fantastic job by the And this kind of flows [4:27] right into what he was talking about. But forgery on the other hand is quite simple to replicate. [4:34] All I have to do is actually identify where any of your weak signatures are [4:40] in the AI system itself. I don't have to no longer wait until quantum processors becomes available. [4:46] And what this particular vector shows us, not just in theory, but now in applied mechanics [4:50] and applied computational science and even in your network today, is that if that cryptography breaks [4:58] or it's stolen again because AI systems are not based on secrecy, they are based on signatures. [5:05] Everything that that AI system has ever built, output, integrated with is inherently compromised. [5:12] Everything. So now we have duality. We have the precursor postcursor [5:18] right of everything the AI system has touched. So we're actually going to go a little bit more and [5:22] beyond the harvest now decrypt later threat vector sequence into forgery threat signing. [5:29] And I think this slide kind of speaks to itself. I won't spend too much time on it, but this is not a [5:33] uh you know a presentation or a deck that we just hand to our crypto teams or our platform [5:37] security teams and say go figure it out. I wish it worked like that, right? This isn't one of those [5:41] problems to have. This is a board decision. And if you are an executive in this room, [5:45] I empower you to ask the question to your CISO, CIO, CTO, CPOS's, having been to all in order to [5:54] evaluate your risk. Where are you exposed today? And this can be a financial problem. [5:58] Where are you exposed today? Public sector, private sector, across your application stack. In [6:03] the city of Seattle, we have 2,700 applications. So that's a fun little problem that I get to [6:08] juggle, right? in terms of where we're exposed multiple data centers, multiple environments, [6:13] but this is a board problem. This is not one independent team problem that you hand. And I'll [6:19] even give you a matter of fact on that one. And we'll get into the actual model in just a moment, [6:23] but I want to have the slide up here because this is probably the most important slide I have. [6:28] If you were to conduct a seabbomb today and by way of reference because I really like where this [6:33] crowd and audience is going. How many's built one or has ran a scan for a sebomb? Cyclone DX. [6:39] Anybody dynamic? Okay. All right. So, [snorts] I'll just be a bit transparent and vulnerable. [6:46] We ran ours. Right. I have 18,000 findings. Am I going to hand an 18,000 object CSV file [6:52] also my security team to say, "Here we go. We solved it." Right? No. So in cryptographic [6:58] mechanics, in crypto security, especially within AI systems, whether you are developing AI within [7:03] your product stacks or you have embedded services that have native integrations within them, [7:08] it is paramount to ask this question because if forgery can be replaced and compromise the [7:14] confident confidentiality of your system, you therefore just introduced a reoccurring problem [7:21] that will eventually have to be contained and remediated later on downstream. [7:24] So we're actually going to talk about a model that we came up with. [7:29] This is called the trust half-life model. And what it is is identifying trust anchors. [7:34] And so in AI systems specifically because we went down this road, right? We did the SAS, we did the [7:38] on-prem applications um in terms of how to upgrade and where to upgrade. But again within AI systems, [7:44] it fundamentally changes the most consequential technology of our generation and of our time. And [7:49] a part of that is understanding well where do you upgrade first? We obviously have a prioritization [7:54] problem contrary to what you probably see at Black Hat and prioritization's dead. Well, [7:57] I challenge it, but we have a prioritization problem. We have a governance problem on top of [8:02] that. You can't just hand again your crypto teams 18,000 findings of your sebomb registry and say, [8:06] "Go figure it out. How do you identify these anchors?" And so using the forgery example here [8:13] is that we can identify ultimately what we need to upgrade first. And so it's three [8:18] tiers. The first one is the thread itself. And I give you an example here of forgery. [8:23] The second one is prioritization. Where is your root trust life anchors at within your model? [8:30] And in this particular one, we have key management systems, which is generally a very high blast [8:33] radius. But if you look to the right of that model, we're actually going to go into the third [8:37] pier and the third pillar at the very bottom, and that's governance. And governance is a big fancy [8:41] word, but it really means are we able to report to our board what our burndown remediation path is. [8:48] You generally don't get to that until about two years into your journey, but you can actually have [8:53] concurrent steps going forward. So model signing routes are critical clearly within any AI system. [8:58] If you're developing, if you have a product, if you're hosting, even if you have u interdependent [9:04] rappers that even spawn your new intellectual property, you still have model signing root [9:08] authorities within your agentic systems, right? even if they're calling out, if they're hosted, [9:14] u if you have your own MCP, IP, whatever the case may be, these roots become your new trust anchors. [9:21] And so on the very far right, when you hear of governance, the yellow dots on the slide [9:26] is ultimately you are now underwater. Your blast radius essentially cannot be contained in time. [9:31] If any of these cryptographic pillars become compromised using forgery in this example of your [9:37] AI systems, this is where I'd recommend to analyze and start first in the prioritization path. [9:43] So sebomb isn't going to come to save you, right? I think we talked a little bit about this. I'll [9:48] kind of skip this slide, but we need to have an overarching model of how we apply postquantum [9:55] cryptography, resilience, modernization, and migration specifically within AI systems, [10:00] which does change the ball game compared to other software stacks or especially legacy systems, [10:06] which I don't know if anybody's running any of those, but I got a handful of them. [10:10] So, I'm going to give you an example of what a ledger would look like, [10:12] right? What if we actually start breaking down some of these trust anchors that we have [10:19] from the previous slide? You saw a few of them now. Who owns what in the trust half-life of [10:25] how long you can trust that particular anchor to survive this level of encryption stack. [10:29] Now we have approximately six algorithms that are approved by Nest. There are now nine in review [10:34] uh by the end of the year. These are examples for example of how we in the city of Seattle [10:39] orchestrated our trust half-life model. This is just a few, right? But if you want to take a [10:44] picture of the slide, I'd highly recommend it because you can bring this back and I [10:47] hope the slides will be available too so you can actually use this. But take a picture of the slide [10:51] because this may actually help you in your AI security governance umbrella or especially if [10:54] you're building them and proving to your market, your customers, your residents, for us, your [10:59] community ultimately that your AI algorithms, your systems to include embedded functions of signature [11:05] delivery are safe, right? And it's not easy to stick a DSA or a dith lithium state algorithm or a [11:13] stateless algorithm or a kyber crystals algorithm right into your stack. I understand that. This [11:17] is why we have hybrid rollover schemes. And to make this matter a little bit more problematic, [11:22] we now are outnumbered uh by over a hundred. So thanks PaloAlto and Cyber Arc for that lovely [11:27] little stat. So let's up the games and up the stakes. We're in Vegas. We have 109 [11:33] non-human identities to everyone. And that number is also grown as of today. [11:38] We are now over 130 confirmed. So this slide's even outdated when I had it made, right? [11:43] But I think we know this philosophically, but how does it ultimately change the dynamic of where [11:49] you're migrating and placing your investments for your PQC transitions? That means there are now 109 [11:56] model signing root data stations, agents, most of them over 80 being agentic uh entirely agentic. [12:02] We now have certificate authorities that are ran by governing AI systems. Are they running on an [12:09] approved postquantum cryptography algorithm or are they typ typically using a public key or ECC [12:16] or RSA 2048 asymmetric key exchange because I assure you they're already broken [12:23] and we've proven that with two primary algorithms if you want to look them up. Grovers and shores [12:27] and AES may not actually come to save you right. So if we think that we are going [12:33] okay cool we're going to be AES 256 is what the government's going to be using right now for our [12:37] cryptographers in the room and we're fed ramp high beautiful that's great Grover's algorithm is now [12:43] challenging the very notion of what symmetric key exchanges can do within quantum processors [12:49] and how fast you can break these keys and I'll give a hopefully another lecture on this later [12:53] about states of superp position within Grover's algorithm specifically and how [12:56] they're breaking them but this slide does up the pressure and accelerates your timetables [13:00] especially if you are in a product based organization. Well, so what do we do about it, [13:06] right? We have 36 months left. Well, not really. [clears throat] You technically have a little bit [13:11] longer than that. The general doomsday scenario, which has always been shifting to the left, has [13:15] been we must be PQC by January 1st, 2029, right? Or 2030 or 2031. 10 years ago, that date was 2035. [13:24] what the ask is in my invitation and offer because this is a very hard problem to chew on and chunk [13:30] on. You can't simply throw an agent in and scan all of your cryptographic exchange relationships, [13:35] especially within sole AI environments. You may be multi-tenant. You may have legacy stacks. You [13:41] may have interdependencies within your customers themselves that would prohibit you from scanning. [13:45] I get that. But where do you start? And so the trust half-life model is the ability so that you [13:52] can start. So where do you Well, first, do you know what's actually in your inventory? Right? [13:56] How many times have you heard visibility at any security or AI conference? So I got to say it at [14:00] least once. Visibility. You got to have visibility right into your environment. Do you know what's [14:04] in there? What versions of RSA do you have? Is data even encrypted? Are you still running some [14:10] of the old legacy TLS 1.1 connections on the, you know, layer six and seven of your stack? You may. [14:15] So visibility is obviously first. The phase two though isn't a rip and replace. And I think that [14:22] may be part of the scary aspect of when we say PQC or even quantum key distribution [14:27] which is a little different but it's not a rip and replace. We're talking hybridized rollouts here. [14:33] So if you've heard of X509 or X23559 you can look those up. Those are hybrid protocols. Which ones [14:40] are we are implementing so that we can actually establish our new baseline pillars and fail over [14:45] our cryptographic loads especially within our AI systems that we've acquired. Right? We're not [14:51] generally in the product building space, right, being a municipality here. We're the 17th largest [14:54] municipality in the US. Um, and we certainly are in innovation and tech, but we're very careful [14:59] of how we procure. Another question then to the group in the next 36 months. How many of you have [15:04] already updated your procurement language within your critical core suppliers? Right? You must be [15:09] PQC resistant or tolerant in your applications by this date. Even that step is critical [15:17] for how we manage thirdparty risk management. GRC get the right products into your inventory. [15:23] I would highly encourage you to speak with your legal teams, procurement teams, risk teams, insert [15:27] that language now. All of your critical services, so if you can implement them by January 1st, 2029, [15:33] which is what we have done, all of our critical services must be before we acquire any new [15:38] technology in the city must have a PQC algorithm that would be tolerant and interactable with ours. [15:43] Now, you can pick whichever one you want so long as it's on the NIST FIPS 200 registry, [15:47] right? uh FIPS 2011 I believe through 206 is the current registry list. But most often than not, [15:53] you're running MLKM most likely in your browser today. So that's really the next 36 months. [15:59] But I'll say at the very tail end of that though, one last bit on this timeline is [16:04] this isn't a full migration within 36 months. start your hybrid roll out so that by the time [16:10] your three hits, you can now go to your board. Go to your executive staff, in my case, city council [16:16] and my other boards and communicate this is now my burndown prioritization. This is my investments. [16:22] This is where they land. Here's the risk tolerance. Here's truly where we are exposed. [16:25] And I can now give you the financial value of where we are exposed in our applications. [16:29] These applications are processing X, Y, and Z valuable data. We can compute that within [16:34] what's called an annual loss expectancy risk analysis. um happy to share more about that later. [16:39] That's where we needed to be at in 36 months. This isn't a full you must have delithium stateless [16:45] algorithms deployed across your entire stack. That is an incredible amount of investments that you'd [16:49] have to make within your architecture, but you can start the hybrid dual architecture path rollout [16:57] to enable the same trust that we just talked about today. And so, you know, finally, [17:03] just to leave you with this and my lovely little 2D drawing, I think it's a little 3D now, [17:07] is that we have another pillar next to the one that was fractured. And that pillar now [17:14] does support MLKM or DSA or pick an algorithm. It doesn't have to just be those two. And really [17:21] research what it means on FIPS 2011 through 206. FIPS federal information processing standards. [17:26] NIST now is evaluating nine new algorithms. By the end of the year, most likely around four to [17:31] six may be selected and chosen. When that happens, our inventory then grows, our options then grow, [17:36] our latitude now grows. But really pay attention to something that I mentioned earlier about [17:41] the forgery threat vector that I just mentioned on signaturebased systems in AI environments native. [17:49] Once they become compromised, all of the audit results, audit trails, [17:54] signing addations, all of them are no longer trustworthy. They have been broken. [18:00] That is not going to be a fun day to explain to anybody. So, it's not just moving forward. [18:04] It's also how we apply it now to guarantee the preservation of integrity and confidentiality [18:10] as we move through the lab. So, the one thing of many that I'm going to ask you to take away [18:15] is that AI trust truly is a cryptographic decision. [18:18] My name is Jake Hammock. I'll be around for any questions. And thank you so much for your time.