Transcript for "Quantum's Real Risk: Board Complacency": The transition to post quantum cryptography is no longer a theoretical horizon. It's an urgent governance risk and procurement mandate. I am your moderator today. My name is April Walker. And following a four decade career scaling enterprise technology, my focus today spans public company board service, leading my advisory firm in HamptonIda Advisory Group, and serving as a senior executive adviser for Qtonic Quantum Corp. As a board director, I view post quantum readiness not just as an IT upgrade, but also a governance imperative and a critical fiduciary responsibility. Our goal today is to cut through the hype and focus on actionable readiness. And to do that, I am joined by three exceptional experts on the front lines of this transition. First, I wanna introduce you to Nikolai. And, Nikolai, help me pronounce your last name so I don't butcher it. Sure. Absolutely. I pull last name's Larbalestier. So Nikolai Larbalestier. Wonderful. And Nikolai is the senior vice president of enterprise architecture and system engineering at NASDAQ. Nikolai leads the research and development of emerging tech, including quantum and cybersecurity, and brings them to maturity within NASDAQ core ecosystem. Next up, we have doctor Marissa Maria Ramirez. And, again, I wanna make sure I spell say the name correctly. So, Marissa, you wanna help me with your last name? Yes. Marissa Ramirez de Chanlatte. Wonderful. And Marissa has spent over a decade working in advanced computing within the National Lab System, from modeling nuclear reactors on Oak Ridge's Titan cybersecurity excuse me, supercomputer to bridging high performance computing and AI at Lawrence Berkeley National Lab. She holds a PhD in computational and data science from US UC Berkeley with appointments at both Berkeley AI Research Lab and Berkeley National Lab. Today, she's an investor at Playground Global, an early stage deep tech fund that is one of the most active in the quantum space. And there she leads investments in quantum AI and robotics. And finally, we have J. Nathaniel Ader. He's the cofounder and chief innovation officer at Qtonic Quantum Corp and author of the Quantum Almanac. Nate brings a unique perspective to this issue. As a former top ranked Wall Street managing director, he was serving on a public board in 2014 during a historic nation state nation state cyber attack. Experiencing firsthand a dangerous gap between what a board believes about its tech risk and the actual reality. He now knows the exact vulnerability and intelligence tools that boards desperately need to uncover and fix their crypto cryptographic, that's a mouthful, exposure. Thank you all for being here, and let's just dive in. We've got a lot to cover. I think the first thing what I I wanna do is I wanna make sure we set the foundation for what is quantum and why should boards care. So, Marissa, I'll pose this to you. What is quantum computing, and why does it represent risk that companies and boards should be paying to paying attention to today? So in simple terms, quantum computing is a a new method of computing that's using the physical properties of quantum mechanics so so namely superposition and entanglement to process information in ways that let certain classes of problems be solved fundamentally faster than any classical computer ever could but the thing to remember is that it's not all classes of problems. It is certain classes of problems that it is very good at. And some of the ones that are most interesting and relevant are things like quantum simulation and also finding the period of a function. So finding a period of a function is, you know, mathematical primitive that underlies a lot of our cryptography, including RSA and elliptic curve. And so there have been, algorithms demonstrated that can efficiently do this on a quantum computer of sufficient size, and we are nearing the time in which we might have a quantum computer of that size, which will effectively break most of the cryptography that we have been relying on. So I would say that's the number one reason why Ford should be aware, and we are thinking about this in such an urgent way right now. Great. So, Nate, let me follow-up on that. How should boards position Quantum relative to other emerging priorities, particularly AI, cybersecurity, and geopolitical risk when setting the enterprise agenda? Well, thanks, April, for having me. Great great to see you. Great to be with you. You know, earlier this month, the g seven agreed on something, and I think that alone, you know, should get everybody's attention. The g seven and CISA told companies to start moving to post quantum encryption now. AI, Uh-huh. you know, to a large extent gets the budget, but quantum gets the deadline, and they feed each other. AI is now helping, design the the codes quantum computers need. AI is helping build the machine that breaks your encryption, but put put quantum inside your cyber agenda, with a date. I like to follow the money, April. You know that, but it's important that all boards realize that quantum computing companies last year raised more money than the prior fifteen years combined. And this year, including the 2,000,000,000 from the White House, quantum computing companies have raised 55% more money than last year. Wow. So how should boards position quantum relative to AI? My only suggestion is follow the money, pay attention, and give it some airtime in the boardrooms. My my experience with the boardroom meetings is it's a lot of AI, not so much quantum yet. Hopefully, in 2027, there'll be a little bit more balance. I suspect with those type of numbers, that will happen for sure. So this is a good segue to sort of talk a little bit about sort of that signal versus noise. Marissa, what are the most misunderstood aspects of quantum computing? What what's the hype? I mean, it's hard to know where to start, but I think the the number one thing that I want people to understand is that when we're talking about quantum computing, it's not one single technology. There are several different modalities that people are pursuing to find, you know, create a scale quantum computer. And so I think that sometimes people talk past each other because they'll have heard something about one modality, that's not necessarily true to another. So each of these have their own engineering challenges and their own timelines, and and they're all different modalities. I think the other thing to know is that we're also pushing on the algorithm side. So it's not just when we're able to build a quantum computer. At the same time, people are innovating on the algorithms that can run on quantum computers. So where we are right now is there are quantum computers that exist. They just are at smaller scale than we need to with our current algorithms to be able to do something like you have something cryptographically relevant. However, as we are building bigger and bigger computers and AI and other things are coming to make those algorithms better and better, those curves are gonna collapse upon each other. So just to understand that there are many, many different forces at play that are are bringing these two things together. Just to add in one more, I think the other. thing I want people to come away with is that quantum and AI sit in different buckets. Quantum is not a new AI or a replacement for AI. These are are separate things that can feed each other in different ways. So when I mentioned earlier about kind of fundamental mathematical primitives, I think you always need to think, what is a computer good at? So class algorithms like AI relies on matrix multiplication. That is not what quantum computers are great at. What quantum computers are great at are are things that are more quantum in nature. And so just understanding that these are powerful things that are are complementary, but are running in kind of different tracks than each other. Do you feel like there's a convergence though that's gonna happen there? I think there are ways in which they will work together. Right? Yeah. I think there are ways in which they will not work together. So when I when I think about hype, I hear a lot of people doing buzzword soup of their quantum AI, blah blah blah blah blah blah. And, I, you know, I can give a shorthand. I think, you know, ways in which quantum and AI will work together, I think quantum can produce scientific data that could be used to train AI models that will be really, strong, and I think we're excited about that. I think AI can speed up algorithm development that can make quantum computers more useful. I think those are great ways. But at least right now, from what I see, I don't take a lot of credence in, you know, some things that are quantum inspired and running on, you know, classical hardware or ideas that, you know, we're gonna be running large language models on a quantum computer. At least right now, where we're at, it doesn't really support that type of transition. So I think be very careful when when you hear those two words together to to not complete them and. Yeah. to dig into what somebody actually means if they're trying to group them into the same category. I love that. Nikolai, you know, before I ask you this next question in terms of capabilities, I would love to know, do you have any thoughts about what Marissa just shared? Yeah. Absolutely. And I think Marissa said a lot of things very well. Couple of things I I might highlight. One thing, in thinking about quantum computers, and there is so much so much so much terminology and buzzwords going around. So you might hear about how many qubits a particular quantum computer has. And, you know, a lot of that is is hype today. Right? Certainly, quantum qubits and the ability to scale is gonna be key to unlocking some of these advanced capabilities. But there's a lot of, what what you hear when you just talk people talking about how many qubits they have is they're they're kind of usually understating the noise. Right? And error correction is one of the big challenges. Like, how do you make, you need you need enough qubits, but you need those qubits to be coherent, coherent enough to actually solve the problem. And I think that's one of the the big, kind of points of confusion, and and you hear different companies throw out different quotes around, physical or logical qubits and how many they have. And and usually, it's not apples to apples. A couple other points, just to make. I mean, I think, agree with agree with Marissa Ramirez de Chanlatte Ramirez de Chanlatte's points, across the board. I think you have to balance, though, what what threats we know are real. Right? Regardless of whether this happens, you know, next year or in five years or in ten years. And that is about quantum encryption and and and how, Yeah. how to protect, how to make sure that the state of data that that you have is protected in the right way. I think when you're looking forward into how you can leverage quantum computers and to pick up another thing that Marissa Ramirez de Chanlatte said, Marissa Ramirez de Chanlatte references that, all of this is you know, as this matures, this is gonna be another tool in the compute toolbox. This is not going to replace. GPUs. This is not gonna replace CPUs. This is those things will will all work together or or work on different problems. Mhmm. You know, and there there will be a lot of interplay. Marissa Ramirez de Chanlatte again mentioned, like, how AI can can, help design quantum algorithms. So so there's gonna be a lot of interplay, but that is not like you're gonna say all of my CPU or GPU servers that I have today or in the cloud, wherever they may be, are gonna be replaced by quantum computers in the future. No. They'll be complimentary. Okay. So when you actually, this. is a really good segue to to ask you. about some of those capabilities that, companies should build today. Is that around talent or partnerships, infrastructure, data strategy? What does that what are those capabilities look like? What should it be thinking about and building today? Yeah. Absolutely. Well, first and foremost, it's it's cryptographic. You need to know what your cryptographic inventory is and and how you can make sure you you are tracking, what type of encryption you're using and where so that you can map that to and create a roadmap if if you're in order there to ensure you have you're post, you're secure against, quantum crypto attacks, that could happen in the future. K. So that's first and foremost, and I think everybody should have a program. This is more I I think typically think of this more as a typical cybersecurity, type, project where, you know, you're reviewing how you're using encryption, where you're using encryption, what that encryption standard is. Is it aligned to, post quantum encryption standards from this and other bodies and making sure, where you have gaps that you have a plan to close at? So that's kind of first top top of mind. Now, yeah, as far as talent, yes. I I think particularly if you're in a industry that can benefit from potentially benefit from simulation, maybe some optimization problems, then you should absolutely be thinking about how you build talent and knowledge so that you are keeping pace with what's happening, realizing that the horizon for an ROI, you know, could be relatively long. Mhmm. But, you know, but that will help prepare you for when the breakthroughs do happen that you are ready to kinda lead lead lead your industry or lead your your space, from the front. And, certainly, when whenever you're talking about and this is as true of AI as as, in many other technologies. But, again, making sure you have a robust data strategy that kinda ties into how you think about. the the cryptographic standards you need and what the level of sensitivity your data is. So you should think about, like, in in in this case for quantum or for quantum plus quantum encryption is what what is the, kind of time value of the data that you have? Like, if it's data that's really only valuable, you know, in the moment or for minutes, then it's probably a lower priority to get post quantum encryption. But if it's data that if you leak out in five year or or someone is able to crack in five years and still has, you know, things that you would much rather not get out, then you. need to protect that with post quantum encryption as soon as possible. Yeah. And that's industry agnostic. Right? Yes. Absolutely. Mhmm. Marissa, where are you seeing real capital being deployed? What are what are those use cases where we've where we're already seeing meaningful commercial impact? Yeah. So I think first, I'll start with, you know, something slightly tangential to quantum computing, which is quantum sensing. So when we talk about quantum, there's, computing capabilities, but there are also many sensing capabilities that are being used now. So quantum sensing, I mean, it could be used in in medical applications. We have a a company called Envision that is using this for, contrast agents for MRIs, to, detect cancer earlier. I think where you're seeing a lot of, activity is in, precision navigation and timing, so making really accurate clocks. This is a quantum sensing problem, and this has applications and just anywhere where you need timing precision. So this could be, in a data center, but I think also where people are really excited is, in GPS denied environments. So whether that's just being remote or because you have security concerns where you're actively worried about spamming or spoofing, spamming or spoofing jamming or spoofing. Sorry. You can, you know, put in very, very accurate clocks that are able to help you with that navigation. So I think, again, when people think about quantum as this very long term horizon, it's there's actually stuff happening right now that we are using right now, that is really transformational. On the timelines for computing, I think where we're seeing now we are seeing early scientific relevance. I think when we're talking about a relevant computer, I would say you we're gonna get some scientific relevance and then some cryptographic relevance and then, you know, who knows? I think we'll see an explosion of all kinds of different applications. But on the scientific side, we're seeing the ability to, get some scientific data, recreate some types of scientific data that haven't been able to, be recreated before, which can, again, be helpful for AI training and just better understanding of our universe. There were some results, with the the spallation neutron source at Oak Ridge where they were able to recreate some some data there, which was impressive. We have a company called BaseCraft that has been working on quantum algorithms for material science, and they have had early results, doing material simulation on the Willow hardware with Google. So these are things that are happening today on today's hardware, that are are nearing scientific relevance. So when you think about that, though, considering that our audience is probably today primarily comprised of many, board members, what was what does that mean for them in terms of how they interact with the executive teams? Yes. So I think number one, there's a reason that we're focusing so much on cryptography because I would say that is probably the number one thing that should be on the minds of just every industry, every board, anyone who has data. But I think for anyone who is, interested or dependent on novel materials discovery or novel drug discovery, this should be on their radar as well. So that's, you know, people in the semiconductor industry, people in the pharmaceutical industry, people even in, you know, textiles or, food industries. There's a lot of people who are, you know, interested in understanding quantum chemistry for new development. And I would say that a lot of them are paying attention. A lot of them are investing in these companies now, and recognize that quantum computing is gonna make a meaningful impact on how they are, discovering and designing new materials and drugs. Yeah. So, J. Nathaniel, I'm gonna pivot to you here. I've got a couple of questions for you. The first one, though, you know, I wanna know what developments would make you say this is real now and organizations need to accelerate their response considering what, Marissa and and Nikolai just shared. Well, yes. Again, you know, thank you, April. I I wouldn't call myself an alarmist. I'm much more of a, calendar reader. So let me read you the calendar. In in in 2019 remember 2019 just before COVID, it was a very different time. Yeah. And, the best estimate to, break RSA encryption was about 20,000,000 qubits. By 2025, it was under a million. The machine didn't get closer. The math essentially got cheaper. Quantum doesn't break math. It breaks timelines. Then in March, Google published, research on breaking the encryption behind Bitcoin, and they did something I've never seen in this field. They withheld the attack circuits and published only a mathematical proof they that they work. So they published a mathematical proof that they work. So when people building the machine, okay, and I think Willow is the best machine, start redacting their own homework, Really, you know, for boards, pay attention. And Google set its own deadline. It it. plans to be off off old encryption by 2029, and the company with the best information in the world really isn't waiting. That's signal. That is the signal. It it already happened. You know, the question for this audience is whether your company's plan is on Google's clock or on nobody's clock. Well, you know that you've you've speak you've, peaked a lot of interest the moment you mentioned Bitcoin. So I know you're not you said you're not an alarmist, but I want you to sort of clarify the whole notion around Bitcoin and encryption, though. Well, Bitcoin has, you know, generally better encryption than most corporations. That being said, you know, there has been a decline, in Bitcoin, as it relates to insecurity around the potential for, you know, quantum, vulnerability. There's some great companies and and and incredible people who are out there, you know, both, you know, the, the coin, governance bodies as well as the brokers like Coinbase who have put, you know, real scientists together to try to address this problem. Yeah. But it's it is a more complicated problem because the outcome, you know, is is a bit more binary. If there is a day that we all wake up and the digital assets, have been compromised, Right. that that really changes confidence. You know? To BlackRock's credit last summer, so over a year ago, in the digital asset fund of BlackRock, they introduced Quantum as one of the biggest risks of that fund. So talk about forward thinking. They very much identified, you know, quantum risk to digital assets. I think it's it's, one of their biggest and most profitable funds. So we watch you know, BlackRock tends to be a firm that sends out a lot of signal. Mhmm. I think it's something to pay attention to. And as quantum evolves, in my view, the risks of digital assets, do increase as well. That's actually really interest I'm sorry. Go ahead. Yeah. I I would just love to add on to to what Nathaniel was saying because, I mean, Yeah. I I absolutely agree, and I I think it's important that, you know, we we do sound the alarm. But I think I also want to make sure people know that post quantum cryptography algorithms that are very good do exist now. So this is not just an alarm we are sounding with no solution. Yeah. So NIST has standard algorithms that are lattice based encryption, that people can be implementing now. So I think when you think about something like Bitcoin and and the risk of it collapsing and with all of these types of things, I think it's also important that we don't just fall into kind of fear that can shake markets. I think what's. what the the call should be not, you know, divest from everything and go buy a bunker. I think the call should be invest in post quantum cryptography, implement the algorithms that that NIST has has released, implement this lot of space cryptography, and importantly, implement it in a way that is flexible because understand that I think we're in a new world with, Yeah. AI attacks on cryptography, and these are the gold standard right now. Five, ten years from now, could we have a new gold standard? That is possible. So just be ready to have an agile, you know, cybersecurity posture that allows you to just constantly be updating and preparing as these things happen. But, while this is a very, very real risk, you do need to implement new algorithms. It it's not a, you know, panic. We don't know what to do. Go hide in a bunker. type of thing. It is adopt the right posture, and and things will be okay. Makes sense. Makes sense. And, Nathaniel, I wanna sort of bring this back to the director. So, because we can certainly talk about Bitcoin. It's a whole other webinar, I'm sure. But, I'm just curious. So one phrase and as a public director, I can tell you this for sure that one phrase directors hear often is harvest now, decrypt later. How seriously is that threat being taken across regulated industries today? Well, let me tell you a true story. In, 1943, the US army started quietly collecting Soviet diplomatic cables. It it couldn't read, but it didn't matter. They kept them. And over the following decades, those cables were decrypted, and they exposed Soviet spies inside the Manhattan Project. That program was called, Venona. So harvest now to crypt later is an eighty year old playbook. Today's version is, salt typhoon. Chinese, state hackers, that's the name they operate under. They spent, years inside American phone networks and took call records and private communications. You don't you. don't break into phone companies for fun. You collect. So now think about what your company stores. Okay? You're a board member. Maybe thirty year mortgage, you know, the your patient's medical history, Mhmm. m and a files, trade secrets. Your thirty year mortgage file outlives the lock. on it. And so I think, you know, here's the test for every regulated company. How long does this data have to stay secret? How long will it take us to migrate? If the first number is bigger than the second, you're already exposed today. Not in 2030, today. Good day. Yeah. Yeah. Wow. So that's a lot. Nikolai, I I'm gonna turn to you for a second here and sort of ask you what evidence to that end should directors expect from technology providers or management teams to to substantiate claims about quantum capabilities and readiness? Yeah. So I think that that's a good segue from from J. Nathaniel, comments. To to that end, I I think management, Mhmm. yeah, management needs to understand what the cryptographic inventory of their enterprises, Yeah. and combine that, as J. Nathaniel said, with with a view on what the the time horizon of usefulness or or the the, the desired security of that data. And you need to go through that, and you need to look at that. And and, you know, as Marissa said, look at the lattice based NIST standards that are out there. Those are the ones that that you need to get, get moving on now if if not, already done. And so managing that inventory, I think, is job one, that, you know, it it analogous to many other crypto, cybersecurity initiatives usually managed, you know, by the by the CSO or or someone in technology. Not always. Mhmm. And to make sure that both, you know, what the standards you're using internally, you have the appropriate, you know, lattice based encryption, being leveraged. And then importantly, looking at your vendors, looking at whether. they're cloud providers or third party data processors or other service providers. You also need to look at their encryption standards and make sure they have a, post quantum encryption plan as well and a known date for, for supporting and depreciating the old standards and supporting the new NIST algorithms. So so that's the second part really is to make sure that your vendor management, is tracking, Mhmm. their all your vendors status of, validation with things like FIPS one forty dash three, that they're using the standardized algorithms, various, FIP standards around that. And that's importantly, they're not using proprietary schemes. You do not want to get trapped down into some some vendors proprietary, you know, either encryption or key key exchange. You really wanna leverage standards unless you are in some super special case. Yeah. It it. sounds like to me that yep. you're I'm sorry. I was gonna I I to to. your point, I was just gonna say it sounds like to me that there's going to need to be, per your comment here, Nikolai, a very, very tight alignment with your vendors. Yeah. Absolutely. Because it it's not if if you're handing over, you know, medical records to a third party to do some processing or, you know, other transaction data and they and your your internal systems are up to scratch with encryption, but theirs aren't well, that's just. a wide open door. Right? So, yes, that's that's as important as doing it for yourself, and to understand your vendor's positioning. And, yeah, I did mention, yeah, just look out for red flags. There are standards here, so everybody should be adopting going down proprietary solutions. And and one thing I did wanna recall that Marissa said. Right? While we have standards and this test published standards, the reality is and and there's there's a known algorithm, Shor's algorithm, that can can be used with a with an appropriate quantum computer to, crack today's encryption. We've you know, to the best, I think, of the of the developers, those encryption standards, we believe that they're, you know, quantum safe for quite some time, but it's it's a completely possible that some weakness gets exposed, both as quantum computers mature and as other attack vectors become become clear. So don't think of this as a one and done. This program should. be stood up. You should track your metrics, and then that should be an ongoing program to make sure. that you're always staying up to date with with encryption standards. It sounds like what we should be doing anyway. Right? And all along. Mhmm. Okay. So. let's talk so let's. talk a little bit about strategic optionality and and competitive advantage. We're all in the business. We're all in businesses now. We wanna make sure that we are leveraging those competitive advantages, and we're maintaining our competitive advantage. Marissa, just question for you. In in what industries are we most likely to just to see early winner take most advantages emerge? So I think the discussion we're having around photography is actually on, you know, on the level of nation states, and I think there's that's where. you're gonna see not just a winner take most, but a winner take all. So I think the race to having a cryptographically relevant quantum computer right now between us and China, I mean, obviously in Europe and other nations are are working as well, but I I view it very much right now as a race with China. It it is a winner take all thing. Right? So, I I, you know, by no doubt the Chinese are investing heavily in this and are working towards a cryptographically relevant quantum computer. It is great to see that The United States has taken this seriously as well. So so J. Nathaniel. mentioned the the 2,000,000,000, investment in quantum computing companies here domestically, to promote that, you're also seeing, the recent executive orders, that are mandating post quantum cryptography and also, tasking DOE with, purchasing a machine by 2028 that's scientifically relevant. And then I think there's been a lot of investment in NIST. And so I think we are lucky to have very serious investment here, and have great scientists, in our our national labs and NIST who are working on these problems and hoping that we. can maintain advantage here. But I think it's important to understand that when when it comes to cryptography, I do think it's a winner take all type of thing, and and we need to stay, ahead of that. When it comes to industry, I think then you're gonna see a little bit more distribution. I mean, I think, honestly, I think there are room for different modalities of quantum computing. Although, I do think the first two utility scale will have a huge advantage over everyone. You know, we've invested in a company called PsiQuantum, which is one of the largest privately held quantum computing companies. They have broken ground on 2,000,000 qubit machines, one in Chicago and one in Australia. And they, are optimistic. that they will have a million qubit machine by the end of this decade. So, obviously, that is a a big race, and I think there's certain certainly advantage to whoever gets to that scale first. Again, I think that, this is really gonna disrupt industries where quantum physics is kind of at at the core. So things like quantum chemistry for. drug discovery and things like material science. And so, again, that's where where where you see a lot of those companies investing early into this technology so that they can be the first to, you know, radically disrupt those industries. It seems like to me there's going to be a lot of opportunity for some of the smaller and midsized companies to really be thinking about this. So, Nathaniel, just curious to to know your thoughts on this. How should those small and midsize companies think about quantum differently than the larger enterprises? Yeah, April. Well, picture a 300 person manufacturer, great margins, great team. Its biggest customer is a defense prime. And then one morning, a supplier questionnaire lands. Describe your post quantum migration plan. Yeah. That's that's not a hacker. That's procurement. And and sometimes procurement is scarier. A hacker might get you someday. Procurement will drop you next quarter. And the new executive order sets 2030 for covered federal contractors, and that date rolls downhill to every supplier they depend on. And banks will do the same to their vendors. Yeah. Hospitals will do it to theirs. So here's the difference for smaller companies. You mostly rent your encryption from cloud providers, Mhmm. software vendors, and payment processors. So your work is in the contracts. Ask every critical vendor for a written plan and date. And the first step doesn't have to be a two year study anymore. Yeah. We run our our our cryptographic audit and discovery and, crypto agility, program and product called QScout Gold, and the first results land in seventy two hours. So small companies don't need a bigger budget. They need a faster first answer. Yeah. Yeah. It's it's it's it's interesting. I always think about the cost of not doing something, and the cost of doing something, of course. But I also wanna think about sort of those risks. So in that same vein, Nathaniel, what's the risk of not just a small and midsize company, but all companies? What's the risk of doing nothing? I could tell you this this is, what I learned as a, director of, New York Stock Exchange company in February, 2014. I was on the board of a well known company that, when Iran hit it with a destructive cyberattack, the director of national intelligence later named Iran. in a testimony. before the senate. And what stays with me isn't the technology. It's that the board got no warning. One day, it was normal company. The next day, it was a national security story. So quantum will be the same. Nobody will send a press release the day RSA fails. The first sign may be data you thought was safe showing up somewhere where it shouldn't. So the risk of doing nothing just you know, it isn't just a breach. It's discovering you had years to prepare and a board record that shows you never asked. And doing nothing isn't neutral. It's a decision to find out last. Yeah. I'm I'm inclined to agree with that, and I think that, you know, you mentioned earlier the recent executive orders. I think that what we're seeing is, you know, the federal government is taking this seriously, and anyone who wants to engage with the federal government is now having to do this. So I think there's, you know, both risk of losing your contracts. There's risk of embarrassment. But I think the signal is that this is is happening now and something we need to be paying attention to now. I think we've lost April, so maybe we can have her questions if we wanna just keep going. So I know her next question for you, Nathaniel, is, how board should think about signaling investors regarding preparedness and emerging technology strategy? Yeah. Well, April always has great questions. You know, I I spent part of my, career, you know, on in Wall Street, like many, at the beginning, on the other side of the table, reading what companies disclosed and and more important, what they left out. And I think here's the lesson from all those years. Investors don't punish risk. They punish surprise. And so disclose the process, not the promises. Something like we've inventoried our encryption. Here's the executive who owns it. Here's the here's our timeline. And that is that's a sentence, that an investor trusts. What not to do? Don't write quantum safe in your 10 k unless you can prove it. The SEC, already fined firms for AI washing, making claims about AI that they couldn't back up. Nobody in this audience wants to be the first quantum washing case. That's that's a bad way to be, early. And and here's what's new. A board can now show evidence, not adjectives. A signed cryptographic bill of materials is something an auditor can actually check. Adjectives get you sued. Evidence gets you credit. So that's how I think board should think about signaling, investors. And I think it that's a great point. I just wanna add quickly because I see this all the time. Luckily, I think it's a little bit harder to quantum watch or at least you it's easier to show evidence than it is with AI. So just, again, as a PSA out there, you know, post quantum cryptography standards do exist. And so there is a little bit of a meaning behind that if you're able to say, okay, this is post quantum ready. That means I have, gone up to the standards. AI safe algorithms do not exist. So the number of people who are trying to pitch me on, you know, post ai cryptography that they're going to have, you know, Ai safe that does not exist in the same way. So also if somebody is trying to give you cybersecurity software that is both quantum and AI safe, those are two different things. It does not mean the same thing in AI as it does in quantum. Quantum has a more, established algorithmic, standard, that does not yet exist for AI. Well, I'm back. I apologize. Looks like I have a storm, coming. in. Perfect, timing. goodness. Right? Thank you for continuing to keep going. I I wanna ask a question here of of Nikolai. So given the uncertainty surrounding the timing and commercial maturity of quantum computing, how should companies create strategic optionality today without committing too much capital too early? Yeah. That's a great question. And I think, you know, it obviously depends to some degree how relevant, quantum computing or or other quantum sensing, are going to be for your particular industry. But I think that beyond the the post quantum encryption, which I think, you know, as we as we've tried to make clear, I think is table stakes. Right? You need to make sure you have. you have that, you know, crypto agility, and you know your data classification, etcetera. Once you get beyond that, then I I think it it does it it is important to engage with the industry with key vendors, perhaps with some of the the university research that's that's going on. Many many programs have industry or many, universities have industry collaborations that, that can be interesting or briefing. But make sure you understand, how this is evolving. As, hopefully, one of the through threads through all of the conversation has been, there's there's just a a lot here. There's a lot. of different things in the quantum space. There's a lot of different terminology. There's a lot of different proof points and and, problems, or or, I should say, challenges for, quantum computers to to realize their potential. So having a a an understanding of, you know, really grounded what is the current state of, let's say, quantum computing specifically, and how does that relate to things that might be relevant to my industry or to my, my company. So in I I we have we have used extensively the university outreach. We have partnerships with a few, UIC, MIT, and hopefully. soon, Vanderbilt. They're really useful to kinda understand where where the university is seeing the where the researchers are seeing the the technology go and connecting it to problems that, you know, we we might we think may have some relevance on doing some experiments in a low cost, like, to trying to think of them as, like, test kitchen. So we don't commit, like, a huge number of resources or a huge amount of capital, do some small tests, see if it works. It doesn't work, you haven't lost a whole lot. You probably gained some knowledge. But. if it looks promising, that's something you can continue to build on as you as you move forward. They really need to formulate the problems. Of course, you you don't wanna go in there and just be like, well, we wanna use a quantum computer. You need to understand what problem you're trying to solve, and I think that's because not every problem. In fact, many problems are are really, there's no advantage and may never be an advantage to, trying to solve them on quantum computers. So you need to you need to really work on what are the problems, the problem spaces that are going to be potentially useful that are relevant to you. And so I think that's a kind of key early education piece to to undertake. And that, really define yeah. Good. no. Please please please get you just sparked my interest when you said the, education piece. Please keep going, Nikolai. Oh, sure. Yeah. And and I think, you know, we we use we also use stage gates. Like, okay. We if we're trying to do it for entering into a proof of concept or some exploration with a with a vendor or partner, what is it we're trying to make sure we can we can, state as clearly as possible what we're trying to accomplish with this. And usually, that's very small in scope. You can't, you can't try to boil ocean. You're not gonna solve, you know, you're not gonna create a new compound in your first state, you know, first foray into quantum computers. Maybe you'll learn if this particular approach to problem solving is is interesting. So, we try to keep our spend small. Right? This is this is a, it's a high high reward potentially high reward, Okay. but it would be very easy to overspend. And I would unless you find a really compelling use case for you right now, I think you it's right to be prudent with any r and d spend, but but make sure you you do have your toe in the water and are are us taking advantage of opportunities to partner and, deepen your understanding of of where the capabilities exist and what they might look like in the next two, five That's a great that's a great segue. What I wanna do is kind. of, pose now some of the questions that I'm seeing from the audience, and I'll pose this to anyone that wants to answer, but it's a great follow-up, Nikolai. Question, most companies do not have quantum experts on staff and are too small to hire one. Where should these companies turn to to become quantum ready now? And where can consultants be found, and how do you recommend vetting them to make sure they're truly qualified? Anyone wanna take that one? I can jump in. take it. Or go ahead. Marissa. and then and then Nate. Yeah. Go ahead, Marissa. I mean, I really, I was gonna say that I think for most companies who who don't have a quantum expert, again, your primary concern right now is just gonna be, your cybersecurity posture and and migrating that over. And there are several firms that are able to provide solutions in this regard, and able to take care of that for you. I think, again, the biggest thing just echoing what Nikolai had mentioned this again earlier is, you know, make sure they are following standards that they're, you know, NASDAQ, FIPS compliant. Mhmm. You don't need somebody who is inventing their own algorithms. You know, I think that I saw some questions on hardware as well. I I don't think most people are going to need, special quantum safe hardware. I think most people can do this as a software only migration with the existing hardware that they have. So, you know, I think for most people, while we are making it sound very scary so that everybody pays attention because you do need to do it, Yeah. I don't think the fix is actually really that complicated. I think, again, if you are in some of the target industries that, we had mentioned earlier, it it might be worth it of, you know, exploring a contractor, understanding the landscape a little bit more. But if your main concern is just compliance and security, you know, find a trusted vendor that is NIST and and fits compliant. Yeah. That's the key part. Right? The trust piece. Mhmm. J. Nathaniel, do you, wanna, take that? if I could add yeah. If I could add, well, good news first. You don't need a physicist, on staff. You need somebody or someone who can translate between the physicist and the boardroom, and that's really a rare skill. And it's the one to hire for. And I'd look I'd look in three places. First, the public sources because they're free. NIST, CISA, and the NSA have all published guidance. The g seven put out its call to action this month. Your team should read those before paying anybody. I'd say. second, an adviser to the board, not just to IT. Boards added a financial expert after Enron. Many added a cyber adviser after the big breaches. Quantum is next. So. the right person has sat in a boardroom and understands encryption, and that that combination is rare. Third, someone who tests, someone who tells. Here's the trap. Okay? Someone who tests, not some I mean, not someone who tells. And here's the trap. The vendor selling you the fix will happily tell you we have this where we're fixing houses. Right? The the vendor selling you the fix will happily tell you how, broken you are. Yeah. Okay? Right? So so here's the here's here's the three tests for any adviser. One, do they take money from the vendors they recommend? If yes, it's a sales pitch. Okay? Two, can they show you evidence or only slides? Ask for the list, not the opinion. Three, have. they ever sat on your side of the table? Advice lands differently from someone who has signed board minutes. And that third test, you know, is is is why I do, you know, this work. I've sat on a public board during a nation state attack. The best quantum adviser isn't the one who knows the most physics. It know it's the one that it's the one who knows what a board has to decide on Monday. Mhmm. Love that. So, Nikolai, I'm gonna ask you another question from we got another question from the audience. Are boards of large companies worldwide sufficiently collecting collective suitability wise prepared to challenge management? Oh, that's a good question. Prepared to challenge management on quantum risk and integrate into strategy. Is that. put push, and pull. Right? yeah, that's a great question. So I would like to think so. Hopefully, forums like this and others, kind of help raise awareness. From my experience, I would say that, the board members that I've I've been talked to are are are clued into this. They don't necessarily know what needs to be done, but I think they're aware that there's a risk here that needs to be managed. But, you know, there's there's obviously uneven understanding. Things are changing rapidly. You know, I think J. Nathaniel mentioned the the the Google advanced their, PQC deadlines, just recently. And so it can be quite confusing to understand, like, how relevant this is. So I think if you if you are a board member or your management, and it it maybe if your management and you don't feel that your board is is paying this with with enough attention, I think you can you can use some of these resources out there. Google's got a great blog on a post on this to to J. Nathaniel point, and and Marissa mentioned a bunch of material from this and others. You can certainly use that to make sure you bring it to the board's attention if if for some reason, you know, you feel like maybe it's not getting the attention it needs. But I think we're in pretty good shape there from my from Mike's, understanding. Okay. Marissa, there's a question for you directly. Given your background in high performance computing and now quantum investment, what technical milestone would convince you that a quantum system has crossed from an experimental platform into infrastructure capable of delivering commercially meaningful advantage over classic HPC? And what metric do the do you think the industry is currently underestimating? Wow. That's a great question. So, you know, the wild thing about quantum, which I just think is so different than what we saw happen with AI or other algorithmic advances or just even other technology in general, is that the test algorithm that we all know that kind of can show that this is working, the one that is best understood is also the algorithm just breaks the entire world's encryption. Like, that is just wild to me. Like, most other technologies, we had some type of test warning. You know, I think even with AI, you know, it's I think we're still in this, you know, development period before we get to the the full doom and gloom that people are, expecting. And so you're, like, able to see some of these, this incremental growth. That's. not gonna happen with quantum. Right? It's gonna go from being experimental to all of a sudden breaking RSA and elliptic curve. And I think, as Nathaniel mentioned, we're not gonna find that out via press release. We're gonna find that out because someone's data is gonna be released. Yeah. Right? So, unfortunately, I think you're gonna have to we're our ability to look for warning signs and stuff is a little bit more subtle. So I think paying attention to the scientific relevance, paying attention to some of the scaling that you're seeing in qubits and all that type of stuff is important. I've I think that, you know, when we see when it comes to quantum advantage specifically in HPC and simulation, I'm I'm looking a lot at the results happening in in DFT and density functional theory. That seems to be like a good candidate, and, you know, I I imagine we might see some scientific advantage there. I think that yeah. I mean, I think that's probably the short answer, but I think the the wild thing to me that just is still hard for me to wrap my head around is that our test problem is also probably our most consequential problem right out the gate. So it's gonna go zero to 60 just really, really fast. Yeah. Okay. Well, we've got five minutes left, and I I wanted to ask this of the panel. Bear with me here. So if if we were to reconvene three years from now, who would you say or what companies would you say that are doing the right things now, or not? Where do you say where would you think that they would be from now? You know, if we three years from now, they've done all the right things. What would those right things be? What would good look like for them? I think wanna take that? it's all about yeah. I mean, I I think it's all about the the main theme that we've all been talking about, which. is, are you, do you have a you fully understand where your encryption estate for you yourself. and for your vendors? And that those are all, post quantum and that they're also quantum or encryption agile so that you can adjust those. That is the number one thing, and I think if if at least in three years because because that due day is coming up in, in about that time, you should you. need to be there. And and so, hopefully, everybody will be there. And I think other others have mentioned on the panel. Like, that's the point is of all of this is to say, you know, now they're these are all standards. They're they're defined. They're they're they're not things that require, you know, massive lifts from technology or anything like that. These are, you know, updates to encryption schemes and, things like TLS versions that provide this capability. If you're using, you know, cloud platforms, you have access to and probably are using mostly post quantum encryption already. But you do need to make sure that you have the hygiene and you understand that that, that estate, as as your first priority. And I would expect, that all large companies are there in three years I I think just a. a. cybersecurity audit, you know, and the Yeah. I, you know, like I said, the the first thing is just understanding where your vulnerabilities are. So some type of audit, migration over. And then what I would like people to have is just a forward looking quantum strategy. I feel like AI caught a lot of people flat. footed, and a lot of. boards then were scrambling to come up with an AI strategy. And I feel like a lot of it was, very reactive and not very well thought out. Right? You had people just jumping into, like, okay. Let's start token maxing. Let's start doing that. You know? And then immediately taking that back. And and I just think, you know, putting a little bit of thought into, okay, these are the the key areas in our industry that we we suspect might, you know, be affected by this. I think it doesn't even necessarily need to be any type of investment or action items, but just a a clear understanding and strategy so that, you know, if all of a sudden we wake up tomorrow and we have a utility scale quantum computer, that the boards, it's not the first time they've ever heard the word quantum. Hello? Nathaniel? So sorry. Can I get the last word? Yeah. Yes. Three words. Three words. Write them down. The list, the clock, and the proof. Right? The list, show me where your crypt your your encryption lives. Not a slide, the list. If management can't produce it, that's your finding. The clock. If we had to swap an encryption algorithm tomorrow, would it take days or years? That's that's crypto agility. It tells you how fast you could respond to anything, not just quantum. Mhmm. The proof. The proof. Which of our vendors are pro post quantum ready today, and how do we know other than they told us? So I like I like, you know, prognostications. So if we reconvene in three years, who's doing it right? Where will companies be? So three years from now is 2029. That's not a random year. That's the year. Google set to be off old encryption. Who's doing it right today? Google for one. They set a public date and is migrating its own systems first. And and here's the contrast this audience will enjoy. When Google published its Bitcoin research in March, the Ethereum community got praise. It it already had a post quantum research program, more than 10 teams running tests and a migration roadmap, Bitcoin's response drew concern. Same threat, same week, two very different boards. One had the the list and the clock. One was still debating whether the problem was real. So what does good look like in 2029? I think five things. One, the list is done. The company knows where every piece of encryption lives, and it's updated continuously, not once a year. Two, the clock is measured in days. Swapping algorithms is routine, not a two year project. Three, Yeah. everything facing the Internet runs on hybrid, old, everything facing the Internet runs hybrid, old and new encryption together. Four, every critical vendor contract has a post quantum clause and date. And then five, proof is in the board minutes. Evidence, not adjectives, reviewed on a regular basis. So where will companies be honestly? Split in two. I think about the same split we saw after y two k and after big breaches, a group that started early and made it routine, and a group that waited for a signal which never came and is now playing, you know, is now actually paying Yeah. the highest rates possible for the same work. So, yeah, the winners in 2029 won't be the ones who predicted the quantum computer. They. will be the ones who stopped waiting for it. Well, I can't think of a better way to to leave this, discussion on that note. And I just wanna extend my sincere thanks to our panelists, Nikolai, Marissa, and Nate, for sharing your exceptional insight from the front lines of this transition. And I wanna thank the Nasdaq Center for Board Excellence for hosting this critical conversation and to all of our members of the audience for joining us today. Have a wonderful afternoon, and that will now conclude our session. Thank you. Thank.