The Agentic AI/Quantum Talent Collision
AI Agents are expanding your cryptographic risk faster than the market can
produce talent to secure it.
Two curves are converging in both enterprise and government security, and most leaders are standing directly at the intersection.
The first curve is agentic AI adoption. Enterprises and agencies are deploying autonomous agents across their most critical operations at a pace no security, identity, or architecture team can realistically absorb. Every one of those agents authenticates, signs, and encrypts, and many rely on RSA, ECDSA, ECDH, and classical PKI components that federal migration policy now targets for replacement or augmentation.
The second curve is flat. The pool of people who understand cryptography, PKI modernization, machine identity, and AI-risk governance at once is one of the smallest in technology, and it is not growing at anything close to the rate of demand. McKinsey research has found only one qualified quantum candidate for every three open quantum roles, and MIT’s Quantum Index Report 2025 shows US job postings requiring quantum skills tripled from 2011 to mid-2024.
The cited quantum workforce data does not measure PQC migration specialists directly; it is a proxy for the broader shortage of people who can operate across quantum risk, cryptography, identity architecture, and enterprise governance. The actual intersection required for agentic-AI security is narrower still. Federal policy now reflects the same concern: recent White House directives on post-quantum cryptography order the Office of Personnel Management to build a strategy for recruiting quantum expertise into government service. When one of the world’s largest public-sector employers starts a formal recruiting campaign for a skill set, it is telling you what the market for that skill set looks like.
One curve is rising exponentially. The other is not moving. The organizations caught between them are accumulating a specifi kind of debt, and that debt now has a due date.
Agentic AI Does Not Just Use Cryptography. It Creates It.
AI agents are already embedded across critical operations:
- Financial services: risk scoring, fraud triage, loan processing
- Healthcare: care coordination, patient engagement, clinical workflow routing
- IT operations: cloud optimization, incident response, deployment analytics
- Retail and e-commerce: supply chain logistics, demand forecasting, personalization
- Government: benefits processing, regulatory monitoring, supply chain protection
Agentic AI is no longer an experiment. It is infrastructure. And every agent-to-agent interaction can create or depend on session keys, tokens, certificates, secrets, and trust relationships. Every deployment expands the quantum-vulnerable surface your organization will eventually have to inventory, prioritize, and migrate.
Organizations scaling agents today are, in effect, taking on cryptographic debt. Unlike most technical debt, this debt is acquiring repayment dates: mandated for federal agencies and their contractors, and increasingly assumed by customers, auditors, and markets everywhere else.
Where the Exposure Lives
Agentic systems concentrate their cryptographic risk in a few places:
RSA- and ECDSA-signed identity tokens (JWTs) used for agent identity and workflow routing
Classical TLS and mTLS certificates securing agent-to-agent and agent-to-service communication
Legacy PKI anchoring trust boundaries across multi-agent workflows
OAuth/OIDC token flows handling authorization and identity federation across agent and service boundaries
Workload identity systems (SPIFFE/SPIRE) issuing and rotating machine identities for agents and the services they call
Service mesh mTLS encrypting east-west traffic between agents, microservices, and data planes
API gateways and MCP/tool-calling gateways the choke points where agents authenticate to tools, models, and external services
Secrets managers and KMS/HSM integrations storing, wrapping, and distributing the keys every other layer depends on
Code-signing and container-signing chains providing provenance guarantees for agent binaries, models, and images
Vector database and API connector authentication guarding the data stores and endpoints which agents query
Agent orchestration frameworks and plug-in ecosystems importing inherited cryptographic dependencies from third-party components
Embedded cryptographic libraries buried inside agent frameworks and vendor products, often invisible to the teams deploying them
The issue is not that every cryptographic primitive fails equally. Symmetric encryption and hash-based mechanisms remain part of the future-state architecture when sized and implemented appropriately. The urgent exposure is concentrated in public-key cryptography: RSA, ECDSA, ECDH, certificate chains, token-signing keys, and PKI trust anchors that depend on integer factorization or discrete logarithm hardness.
These public-key dependencies do not survive a cryptanalytically relevant quantum computer (CRQC) without migration or compensating design. And the risk is not waiting for one to arrive: adversaries are harvesting encrypted traffic today to decrypt later (Harvest Now, Decrypt Later). Agent traffic is a prime target, because agents routinely touch an organization’s most sensitive datasets. The operational consequences compound: eroding PKI becomes a long-term liability, quantum-vulnerable tokens become identity bypass vectors, and cryptographic failures cascade across multi-agent workflows in ways single-application failures never did.
This is not a tooling problem. It is an architecture and governance problem, and architecture and governance problems are solved by people.
The Debt Has a Due Date
The regulatory environment has stopped asking whether organizations will migrate to post-quantum cryptography and started specifying when:
- Under Executive Order 14412 (June 2026), federal agencies must migrate high-value assets to PQC for key establishment by December 31, 2030, and for digital signatures by December 31, 2031.
- EO 14412 directs the FAR Council to publish a proposed Federal Acquisition Regulation rule requiring covered contractors to comply with NIST’s PQC standards by the end of 2030. If you sell to the government, the government’s deadlines are becoming your deadlines.
- Draft language in the FY27 National Defense Authorization Act would put the Department of Defense on an even faster migration schedule, with ripple effects across the defense industrial base.
- CISA and NIST are developing formal guidance on the Cryptographic Bill of Materials (CBOM), the inventory that every migration deadline quietly depends on. “We don’t have an inventory” is about to stop being an acceptable answer.
- NIST’s FIPS 140-2 certificates move to historical status in September 2026, tightening the module validation pipeline just as PQC demand surges.
These obligations do not fall uniformly, and it is worth being precise about who faces what. Federal agencies face direct, dated mandates. Federal contractors face requirements arriving through the FAR rulemaking and contract flow-down clauses. Commercial enterprises face no direct federal deadline today, but three pressures reach them anyway: NIST guidance targets deprecation of quantum-vulnerable algorithms by 2030 and disallowance by 2035, harvest-now-decrypt-later exposure accrues regardless of any regulatory date, and federal security requirements have historically amplified into commercial expectations through supply chains, insurers, auditors, and sector regulators. The deadline structure differs by sector; the direction does not. And every tier arrives at the same constraint: the deadlines land precisely as agentic AI is multiplying the surface that must be modernized.
The Five Actions That Matter, and Who Must Own Them
If your organization is deploying agentic AI, or buying it from vendors, these are the actions that determine whether you meet the coming requirements. Each one has a name attached to it, or it does not happen.
- CBOM inclusion. Every AI agent, agent runtime, and agent-to-service workflow should be brought into CBOM scope wherever it uses or depends on cryptography, including cryptographic libraries, protocols, token-signing mechanisms, certificates, keys, trust anchors, and service identities. Owner: a CBOM program lead with both cryptographic and asset-management fluency.
- Algorithm modernization. Prioritize replacement of RSA, ECDSA, and the classical PKI elements that anchor agent identity, moving to NIST-standardized PQC algorithms on a schedule aligned with the 2030 and 2031 deadlines. Owner: a cryptographic architect who can sequence migration without breaking production identity.
- Vendor compliance. Require that agentic AI vendors support NIST-approved PQC algorithms and publish cryptographic roadmaps. The FAR rulemaking directed by EO 14412 is set to make this a contract-eligibility question, not a preference. Owner: a security-literate procurement or third-party risk leader.
- Zero-trust boundaries. Agents must authenticate continuously, operate with least privilege, and stay isolated from sensitive trust boundaries. Zero trust is the architecture that makes PQC migration survivable while it is in progress. Owner: an identity and access architect who understands machine and agent identity, not just human identity.
- Leadership and governance. Someone at the executive level must own quantum risk and agentic AI security as a program, with board visibility and budget authority. In most organizations today, that role does not exist.
A Note for Boards
Directors do not need to understand token signing algorithms. They need to ask three questions. First: do our regulatory and contractual obligations now include PQC deadlines, directly or through our federal customers? For a growing share of organizations, the answer is yes. Second: are our AI initiatives expanding a risk surface we have not inventoried? Third: who in this organization owns quantum risk, by name? If the answer to the third question is “no one,” you are not alone: ISACA’s 2025 Quantum Computing Pulse Poll of more than 2,600 digital trust professionals found that while 62 percent worry quantum computing will break today’s encryption, only 5 percent of organizations have a defined quantum strategy, and only 7 percent of professionals claim a strong understanding of the NIST PQC standards. Being in the majority does not make it less of a governance gap with fiduciary implications, and it is the board’s job to see it closed.
The Market You Are Competing In
Every action above assumes access to people at the intersection of cryptography, PKI modernization, machine identity, and AI-risk governance. That intersection was thin before the deadlines existed. Now the federal government is formally recruiting from it, defense contractors are staffing against accelerated NDAA timelines, and every major vendor is hiring the same profiles to build the products everyone else will buy.
Without the right people, PQC programs stall, agentic systems stay vulnerable, and quantum-exposed architectures persist past deadlines that are no longer negotiable. The organizations that meet the 2030 and 2031 dates will be the ones that secured their leadership and architecture talent early, while it was still available.
This is the work we do. Herman Collins LLC identifies and places the cryptographic architects, PKI modernization leaders, and AI-risk executives who can actually deliver PQC migration, quantum-safe identity, interconnect and agentic AI security at enterprise scale.
C-Suite AI Defense Checklist
- Confirm AI agents, agent runtimes, and agent-to-service workflows are in CBOM scope
- Review quantum-vulnerable cryptographic components, starting with agent identity
- Prioritize modernization of RSA, ECDSA, and classical PKI dependencies
- Require vendor compliance with NIST PQC standards and published roadmaps
- Enforce zero-trust boundaries around agentic workflows
- Establish continuous cryptographic monitoring
- Name an executive owner for PQC and AI-risk governance, and report on the search until the seat is filled
Start With the Leadership Gap
The deadlines are set. The inventory requirements are coming. The talent pool is not getting larger. The one variable still under your control is how quickly you put the right people in the right seats.
Request a PQC Leadership Gap Assessment. We specialize in retained recruitment for Quantum Resilience and AI Security. In one briefing, we will map the roles your PQC and agentic AI security program requires, benchmark them against your current organization, and show you strategies to fill any gaps.