By Bennett Indart, Vice President, SaltGrain Zero-Trust Data Security Suite, Head of Scale Academy, NTT Research
Every founder I’ve ever worked with has faced some version of the same question: how do you get ahead of a threat that’s still forming, before it’s fully arrived and the damage is already done? That’s where enterprise data security stands right now, and it’s worth being precise about why, because the shape of the threat is changing faster than most security postures are built to handle.
The threat landscape enterprises are planning around today is really two converging problems, not one. The first is AI. Attackers now have tools that compress what used to take skilled teams weeks — reconnaissance, credential stuffing, phishing lures tailored to a specific employee’s writing style, vulnerability scanning across thousands of endpoints — into hours, and increasingly, into automated pipelines that run continuously and improve on their own.
Defenders are adopting AI too, but the asymmetry matters: an attacker only needs one gap to work, while a defender has to close all of them, and AI has lowered the cost of finding that one gap faster than most organizations can raise the cost of losing it.
The second problem is quantum, and it’s different in kind because it’s retroactive. Today’s strongest public-key encryption is, for practical purposes, unbreakable with classical computers. A sufficiently capable quantum computer would change that math — not hypothetically, but for data that’s already been stolen and is sitting on a disk somewhere, waiting.
This is the “harvest now, decrypt later” pattern: nation-states and sophisticated criminal groups are already exfiltrating encrypted data they cannot currently read, on the bet that a working cryptographically relevant quantum computer arrives within the useful shelf life of that data. For a health record, a trade secret, a government file, or long-lived financial data, that shelf life can run decades. The attack already happened; only the decryption is waiting on the calendar.
Put those two together and the old security posture — protect the perimeter, trust the network, assume a breach means the intruder is inside a boundary you control — stops being sufficient on either count. AI erodes the perimeter faster than defenders can patch it. Quantum erodes the encryption protecting whatever gets through, on a timeline nobody can precisely predict but everybody agrees is coming. Waiting for certainty on either front before acting is itself a decision — one that assumes today’s data won’t matter by the time the threat fully arrives.
What does readiness actually look like in that environment? A few things enterprises can start now, independent of which specific technology they eventually choose.
First, know what data you actually have and how long it needs to stay confidential — a customer’s Social Security number and a five-year-old marketing deck don’t carry the same shelf-life risk, and treating them identically wastes effort where it matters least.
Second, build crypto agility into procurement and infrastructure decisions now, so that swapping in post-quantum algorithms as they mature doesn’t require ripping out core systems later.
Third, push access control down to the data itself rather than relying solely on network and application boundaries — because as AI agents, partners, and multi-cloud pipelines touch data in more places, the perimeter model has more seams than any single team can monitor.
And fourth, ask vendors hard, specific questions about their quantum-readiness claims and timelines rather than accepting marketing language at face value — this is a young field, and skepticism is a reasonable default until claims are independently tested.
That third point — access control that travels with the data itself, rather than living in a network perimeter or a specific application — is often described as “sovereign data,” and it’s the design principle I’d point to as the most durable of the four. A file, image, or record that carries its own access policy stays protected wherever it moves: across clouds, into a partner’s systems, or through an AI pipeline that was never part of the original security design. A stolen database under that model should yield unreadable ciphertext, not a breach.
It’s also the problem my team has spent the last several years working on. At NTT Research’s Scale Academy, our mission is to take findings from fundamental research and build them into technology enterprises can actually deploy.
Our first product out of that work, SaltGrain, is a sovereign-data security suite built along exactly these lines — encryption tied to policy rather than identity, so protection stays with the data rather than the network around it. I mention it not to sell it here, but because it’s a useful proof point: the sovereign-data approach isn’t just a concept worth discussing, it’s buildable today, and enterprises evaluating their own posture against AI- and quantum-era threats don’t have to wait for the theory to catch up with the engineering.
