Prediction: Quantum computing awareness goes mainstream.
In 2025 we’ll see an uptick in mainstream awareness of quantum computing and companies will start taking the looming post-quantum world more seriously. As the National Institute for Standards and Technology (NIST) in the U.S. is already certifying post-quantum encryption methods for various applications, these standards will be adopted throughout the industry and companies will begin planning for how they’ll need to adapt their products. While tech giants have long been planning – including Apple with the announcement of iMessage with PQ3, a post-quantum cryptographic protocol for secure messaging in 2024 – smaller tech companies will now follow suit.
While we’re still a minimum of five years away from “Q Day” – when quantum computers finally break encryption algorithms – that could change quickly. Consider ChatGPT and the drastic changes we’ve seen in AI over the past two years, very few predicted this mass adoption would happen as quickly as it did, and now you’d be hard-pressed to find a product or service that doesn’t incorporate it.
Advice: As quantum computing advances, organizations must prepare for its profound impact on remote data security. Future quantum computers will likely be able to crack the encryption systems we rely on today, rendering many of today’s security measures obsolete. The first step is to identify encryption use across critical remote access points – from VPNs to employee logins – and plan the transition to post-quantum cryptographic standards. While they can be threatening, quantum technologies also present opportunities to enhance remote connectivity.
Prediction: Regulation will be priority #1 for most CISOs.
2025 will be a year of tremendous regulatory change that will require the utmost attention of CISOs navigating in an ever-evolving geo-political environment.
In the U.S., a potential focus on de-regulation by the incoming administration will be something that impacts businesses globally, especially regarding standards set by organizations like the National Institute for Standards and Technology (NIST), which issued NIST 2.0 in 2024, guidelines for managing risks in all industries of any size, including government and academia. CISOs will also get more protective about how they see cybersecurity in regard to national security, especially as we see China ramping up its regulatory frameworks, making it more difficult for Western companies to comply.
In Europe, CISOs will also be focused on the Digital Operational Resilience Act (DORA), which banks, credit institutions, investment firms, and other financial entities must comply with, beginning Jan. 17, 2025, as well as the broader Network and Information Security Directive (NIS-2), which impacts a wide range of EU businesses.
Advice: CISOs are wise to think globally when it comes to cyber regulations, and this is a must for enterprises with customers located around the world. By dedicating resources to stay abreast of the latest regulatory changes – which could be plentiful in 2025 – CISOs will be able to anticipate changes to their organization’s security policy before it becomes a concern with a customer or prospect.