Identity in the Age of AI and Quantum Computing
Why proving who and what we can trust is becoming a foundational security problem.
Formatted for board reading, technical briefings, and executive risk committees.
Executive Summary
Artificial intelligence is making convincing impersonation, synthetic media and personalised social engineering cheaper and more scalable. At the same time, future cryptographically relevant quantum computers threaten public-key algorithms that underpin digital signatures, certificates and identity systems. The shared issue is trust: AI makes identity easier to imitate, while quantum computing threatens parts of the cryptographic layer used to prove authenticity.
"AI challenges whether the evidence we see and hear is genuine. Quantum computing threatens some of the cryptography we use to prove what is genuine. Between them sits identity."
01 / AI Changes the Economics of Impersonation
Identity fraud is not new. What artificial intelligence changes is the cost, speed, and quality of creating convincing evidence around a false identity.
A single public profile photograph can provide source material for facial comparison models, correlation across platforms, or generative synthetic media. Voice samples can be cloned in seconds. Public employment histories and social activity can be assembled into hyper-targeted, persuasive spear-phishing narratives. Generative AI produces polished communications that eliminate the telltale grammar and formatting errors that previously exposed attacks.
"The question is no longer only: 'Does this person know the correct password?' It is: 'What evidence do we have that the person, device, credential and transaction are genuine?'"
A static photograph or password should not defeat a well-designed biometric or cryptographic system. Modern proofing must incorporate live capture, presentation-attack detection, sensor integrity, and device controls. NIST now explicitly addresses these attack vectors in the revised SP 800-63A-4 Digital Identity Guidelines.
02 / Identity Becomes the Security Perimeter
Traditional organisational boundaries have faded. Employees work remotely, customers use unmanaged personal devices, contractors cross tenant boundaries, automated APIs communicate autonomously, and AI agents act on behalf of humans and organisations.
This creates an unprecedented assurance problem. Organisations must be able to distinguish reliably between:
- A legitimate enrolled human operator
- A compromised account under adversary control
- An authorised cloud workload or service principal
- An approved autonomous AI agent
- Unauthorised software merely claiming to represent an authorised party
Authentication is necessary but no longer sufficient. Identity architecture must establish who was enrolled, what authority they hold, which device or workload is acting, whether the credential remains valid, and whether the requested action was genuinely authorised.
03 / The Next Trust Transition: Post-Quantum Readiness
Much of today’s digital trust depends on public-key cryptography. Certificates, secure communications, software signing, identity assertions, and modern credential systems rely on algorithms such as RSA and elliptic-curve cryptography (ECC).
A sufficiently capable cryptographically relevant quantum computer (CRQC) using Shor’s algorithm could undermine these widely deployed schemes. Symmetric cryptography and hashing algorithms are affected differently, but public-key cryptography is deeply embedded throughout modern infrastructure.
This matters acutely for identity because a digital credential or assertion is trustworthy only if a verifier can determine that an authorised issuer signed it and that the content has not been altered. If the signature algorithm becomes unsafe, the issue is not merely confidentiality. It becomes a fundamental problem of authenticity.
04 / Two Risks, One Trust Problem
AI challenges whether the evidence we see, hear, and receive is genuine.
Quantum computing threatens some of the cryptography we use to prove what is genuine.
Treating identity as an isolated login utility leaves organizations vulnerable to both threats simultaneously. Identity must be re-architected as foundational trust infrastructure.
05 / What Organisations Should Start Doing Now
The whitepaper defines twelve actionable imperatives split across immediate identity uplift and strategic post-quantum preparation:
Immediate Identity Controls Uplift
- Treat identity as a core security control: Elevate identity architecture from a routine application login function to an enterprise security perimeter control.
- Adopt phishing-resistant authentication: Eliminate password dependence and deploy FIDO2 / Passkeys and hardware-bound credentials with Conditional Access.
- Strengthen identity proofing: Defend onboarding and verification against synthetic media, deepfakes, replay, and injection attacks in line with NIST SP 800-63A-4.
- Protect biometric data: Treat biometric reference data as highly sensitive, irrevocably personal, and effectively non-replaceable.
- Bind high-risk transactions: Enforce step-up, context-aware re-authentication and explicit authorization for high-value operations.
- Establish clear non-human identities: Define explicit identities, lifecycles, and permission boundaries for cloud workloads, APIs, and AI agents.
- Replace document copies: Migrate away from vulnerable static document scans toward authoritative digital verification and verifiable credentials.
Post-Quantum Readiness & Cryptographic Agility
- Inventory public-key cryptography: Catalogue all uses of RSA, ECC, and public-key algorithms across TLS certificates, API gateways, token issuers, code-signing, and cloud platforms.
- Design for cryptographic agility: Ensure application frameworks, PKI, and key management systems can swap cipher suites and key lengths without architectural redesign.
- Build a post-quantum roadmap: Test NIST FIPS 203 (ML-KEM) and FIPS 204 (ML-DSA) standards or hybrid algorithms as enterprise vendors roll out support.
- Assess long-lived credentials: Audit digital archives, signed contracts, legal records, and long-validity credentials that require re-signing or timestamping.
- Address "harvest now, decrypt later": Evaluate high-value corporate, financial, and state data that adversaries may capture today to decrypt once quantum hardware arrives.
06 / Conclusion: Trust Becomes Infrastructure
The AI and quantum transitions initially appear to be separate technology problems. They are not. AI challenges our confidence in what we see and hear. Quantum computing challenges the cryptographic mechanisms used to mathematically prove authenticity.
Organisations that recognise identity as infrastructure will survive both transitions with operational resilience and trust intact.
Selected Standards & References
- NIST SP 800-63A-4Digital Identity Guidelines: Identity Proofing and Enrollment — addressing presentation-attack detection, biometric injection defense, and sensor integrity.
- NIST FIPS 203 (2024)Module-Lattice-Based Key-Encapsulation Mechanism Standard (ML-KEM) for quantum-resistant key establishment.
- NIST FIPS 204 (2024)Module-Lattice-Based Digital Signature Standard (ML-DSA) for quantum-resistant digital authentication and signing.