The landscape of global cybersecurity is undergoing a profound and unprecedented transformation as organizations grapple with the simultaneous integration of artificial intelligence and the looming horizon of quantum computing. According to comprehensive new research published by digital security leader Thales, the convergence of these two rapidly advancing technological frontiers is placing immense, compounding pressure on traditional corporate security architectures, data governance frameworks, and cryptographic defenses. The findings underscore a critical juncture for enterprise risk management, revealing that modern security teams are increasingly fighting battles on multiple fronts—managing the immediate vulnerabilities introduced by rapid AI deployment while concurrently preparing for the cryptographic obsolescence threatened by quantum algorithms.
The study, titled the 2026 Thales Data Threat Report: Quantum and AI Trends, was conducted by 451 Research, a part of S&P Global, and captures the insights of 3,120 security and IT management professionals spread across 20 countries. The sheer scale of the survey highlights a global consensus among enterprise leaders: an overwhelming 98 percent of respondents are actively evaluating how artificial intelligence and quantum computing intersect to alter their risk profiles. Furthermore, this realization is translating directly into corporate expenditure, with 30 percent of surveyed organizations reporting a significant, targeted expansion of their security budgets specifically dedicated to mitigating AI-related threats.
Background Context and the Evolution of Enterprise Risk
To understand the urgency reflected in the 2026 data, one must examine the rapid trajectory of enterprise technology adoption over the preceding years. For decades, traditional cybersecurity strategies relied heavily on perimeter defense, static encryption standards, and reactive vulnerability patching. However, the generative AI boom that accelerated sharply in the early 2020s fundamentally altered the corporate data footprint. Enterprises began aggregating massive, highly sensitive datasets to train proprietary large language models, often bypassing standard data lifecycle and classification protocols in the race for market advantage.
By 2025, security surveys began sounding the alarm. Last year’s Thales research revealed that AI security had surged to become the second-highest spending priority for organizations, trailing only overarching cloud security investments. At that time, however, 52 percent of respondents admitted that their burgeoning AI security expenditures were not additive, but were instead directly displacing existing security budgets—leaving critical legacy infrastructure vulnerable. Moreover, historical comparisons within the latest data reveal a disturbing regression in foundational data protection: the average share of sensitive cloud data being actively encrypted dropped from 51 percent in 2025 to just 47 percent in 2026. Only 7 percent of organizations currently report encrypting more than 80 percent of their sensitive cloud repositories.
Simultaneously, the threat horizon is expanding due to theoretical and practical advancements in quantum computing. While fully realized, cryptanalytically relevant quantum computers remain under development, the timeline for their arrival continues to compress. Threat actors are already engaging in "harvest now, decrypt later" operations, intercepting and storing encrypted enterprise traffic today to be decrypted once quantum hardware matures. This looming reality forces organizations to look past traditional cryptographic algorithms, such as RSA and ECC, and begin migrating toward quantum-resistant encryption standards before legacy data protection becomes entirely obsolete.
Cloud Assets at the Epicenter of Modern Cyber Attacks
As organizations digitize operations and migrate core workloads off-premises, cloud environments have definitively become the primary battleground for malicious actors. The Thales report identifies cloud-based storage, cloud-delivered applications, and cloud management infrastructure as the three most frequently targeted asset types by cybercriminals, cited by 35 percent, 34 percent, and 32 percent of respondents, respectively.
This heavy concentration of attacks is directly linked to the operational realities of artificial intelligence. Training, fine-tuning, and deploying modern AI models require vast, centralized data repositories that frequently reside within multi-cloud or hybrid-cloud architectures. The rapid, decentralized expansion of AI infrastructure often outpaces the visibility of corporate security operations centers, creating invisible blind spots and expanding the enterprise attack surface.
Interestingly, organizations are looking increasingly to third-party ecosystems to bolster their defenses against these cloud-native threats. Sixty-seven percent of surveyed IT professionals reported investing directly in the AI-specific security tools provided by their cloud service providers. This edges out traditional third-party security vendors, which were utilized by 63 percent of respondents. Enterprises are adopting a multi-layered defensive posture, drawing protection from a mix of cloud hyperscalers, emerging security startups, specialized large language model providers, and internally developed access controls.
The Paradox of AI Spending and Data Governance Gaps
Despite the escalating risk profile of artificial intelligence, enterprise spending priorities reveal a striking internal contradiction regarding business objectives versus risk mitigation. While AI security remains the second-highest overall budget priority after cloud security, the criteria by which organizations measure the success of their AI projects tell a very different story.
When asked how they evaluate the return on investment or success of AI initiatives, risk management placed near the absolute bottom. Reducing or managing the risks of data loss, regulatory noncompliance, or security exposure ranked sixth out of seven potential success criteria, cited by only 35 percent of respondents. In stark contrast, business performance and productivity metrics dominated the evaluation criteria: 68 percent of organizations prioritized improving customer experience, and 63 percent focused on reducing employee toil through task automation.
This disconnect between spending and risk valuation has severe operational consequences. The report highlights that poor data quality and inadequate initial data governance are now the single greatest inhibitors to AI adoption, cited by 65 percent of participants. Closely following this are the inherent security risks associated with exposed or poorly sanitized data, noted by 61 percent. Furthermore, 51 percent of organizations admitted that their internal AI initiatives are simply moving too quickly for security teams to properly secure them—a velocity-versus-safety dilemma that leaves corporate networks continuously exposed.
Implications for the Future of Global Cybersecurity
The convergence of AI and quantum computing risks represents a watershed moment for the cybersecurity industry. The findings from the Thales report suggest that incremental adjustments to legacy security frameworks will no longer suffice. As machine learning models become deeply embedded in core business processes and quantum horizons draw closer, CISOs and enterprise risk officers face a complex mandate.
First, the sharp decline in sensitive cloud data encryption coverage is an alarming trend that must be reversed. Without robust, end-to-end encryption across all data lifecycle stages, the aggregation of AI training data creates catastrophic honeypots for cybercriminals. Regulatory bodies across the globe are already increasing scrutiny on data privacy and AI governance, meaning that organizations lagging in data classification and encryption face not only severe cyber threats, but also massive financial penalties for noncompliance.
Second, the dual challenge of AI and quantum readiness requires a shift from reactive patching to proactive cryptographic agility. Security leaders must decouple their AI deployment strategies from risky operational shortcuts. Ensuring that data governance, loss prevention, and compliance metrics are elevated to primary success criteria—rather than treated as afterthoughts—will be essential for sustainable enterprise innovation.
Ultimately, the 2026 Thales data signals that the future of cybersecurity will belong to organizations capable of harmonizing technological velocity with rigorous cryptographic defense. As AI continues to reshape the corporate enterprise and quantum milestones approach, bridging the gap between high-level security spending and foundational data hygiene will determine which organizations successfully navigate the next era of digital transformation and which remain vulnerable to compounding systemic risks.
