The bitterest pill to swallow for many mid-market CFOs is not that their cybersecurity budget is growing. It is that some of what they already spend has stopped making economic sense.
Artificial intelligence, quantum computing and blockchain-based finance are attacking three different assumptions on which the modern security stack was built. AI challenges the economics of human-centered detection and response. Quantum challenges the expected lifespan of cryptography. Digital money challenges the separation between cybersecurity infrastructure and financial infrastructure.
That’s creating a more complicated capital-allocation problem than another round of security-tool purchasing.
Read more: How 153 Million Stolen IDs Could Supercharge 5 Enterprise Fraud Attacks
AI Is Putting a Price on Every Minute of Cyber Response
For years, enterprises could respond to a new attack surface by adding another layer of defense: endpoint protection, identity management, cloud security, data-loss prevention, threat intelligence, vulnerability management. The resulting security stack frequently became an accumulation of products purchased against individual categories of risk.
The next spending cycle looks different. CFOs and CISOs have to fund capabilities that change the economics of the entire stack. The question is no longer simply what new AI, quantum or crypto controls they need to buy. It is what existing spending those technologies make redundant, inadequate or mispriced.
AI, for example, is lowering the marginal cost of producing attacks while simultaneously lowering the marginal cost of investigating them. That creates an arms race measured in time rather than head count. CFOs should consequently be skeptical of measuring an AI-security investment by how much additional capability it buys. A better measure may be how much existing complexity it eliminates.
“If you’re going to experiment with agentic AI or any type of AI solutions, you want to focus on two things. One is the area where you’re most likely to have success. And two, is there going to be a good return on that investment?” WEX Chief Digital Officer Karen Stroup told PYMNTS in an earlier interview.
See also: Big Tech Races to Quantum Safety as Cyber Threat Clock Ticks Down
Quantum Is Giving Encryption a Depreciation Schedule
Quantum presents almost the inverse problem. The attack may be years away, but the liability already exists. That makes quantum cybersecurity unusual from a budgeting perspective. Companies are being asked to spend today not primarily because an existing control has failed, but because the expected useful life of that control has shortened.
We’d love to be your preferred source for news.
Please add us to your preferred sources list so our news, data and interviews show up in your feed. Thanks!
“The time to start thinking about migrating to quantum-resistant methods of encryption is now,” Professor Scott Aaronson, who recently joined StarkWare as scientific adviser, said during a conversation hosted by PYMNTS CEO Karen Webster in February.
Cryptography embedded across applications, certificates, APIs, hardware, software libraries and third-party systems is an enterprise asset whose future reliability can no longer be assumed. Migrating it requires inventorying cryptographic dependencies, classifying data by confidentiality horizon, testing replacement algorithms and pressuring vendors to provide migration paths.
That turns quantum readiness into a technology-debt problem. The enterprises facing the largest eventual bill may not necessarily be those with the most sensitive information. They may be those that do not know where their cryptography lives.
Read more: The Governance Problem Stablecoins Weren’t Built to Solve
Crypto Is Turning Cyber Credentials Into Balance-Sheet Assets
Digital assets introduce a different security equation because they can shorten the distance between compromise and financial loss. In conventional enterprise systems, compromising an employee identity and stealing corporate cash are generally different steps. Banking infrastructure, payment approvals, fraud controls and intermediaries create additional barriers between access and settlement.
But as companies use stablecoins, tokenized deposits and blockchain infrastructure, cryptographic credentials can become mechanisms for controlling financial assets directly. Private keys, wallet permissions and transaction-signing policies therefore begin to resemble treasury infrastructure as much as cybersecurity infrastructure.
The trusted counterparty identity issue is compounded by the anonymity blockchain transactions engender. The PYMNTS Intelligence report “Payment Protection: Why Firms Still Aren’t Real-Time Ready” found in August that 65% of firms plan to adopt or expand identity verification and know your customer (KYC) automation within the next 12 months, putting it ahead of secure bank connectivity and AI-based fraud detection, both at 59%. Only reconciliation automation, at 70%, drew more near-term interest.
Read also: The New Cyber Math for CFOs: One Attack, Hundreds of Disclosures
Taken separately, AI, quantum and crypto look like three emerging categories that cybersecurity vendors can sell against. But for farsighted CFOs, the job is no longer simply to demonstrate that a new threat deserves incremental funding. The task is showing which existing controls are becoming less valuable because the underlying economics of risk have changed.
For all PYMNTS B2B coverage, subscribe to the daily B2B Newsletter.
Add as Preferred Source
