Emerging Security Trends and Strategic Futures

Introduction

Information security is entering a period in which the boundaries between infrastructure, software, physical systems, regulation, and geopolitics are increasingly indistinct. Cloud computing, artificial intelligence (AI), quantum information science, decentralized systems, and pervasive connectivity are changing both the attack surface and the assumptions on which security programmes have traditionally been built. At the same time, governments are imposing stronger obligations concerning resilience, breach reporting, software assurance, privacy, and accountability.

The central challenge is not simply to adopt the newest security technology. It is to determine which assumptions remain valid, which controls must be redesigned, and how security investment should be governed under uncertainty. A strategic security leader must therefore combine technical analysis with risk management, legal interpretation, organisational design, and foresight.

This chapter examines six mutually related developments: the evolution of zero-trust security, post-quantum cryptography, autonomous and AI-enabled attacks, confidential computing, decentralized technologies, and regulatory change. It concludes by developing future cyber-risk scenarios and a strategic planning framework.

Learning Objectives

After completing this chapter, the reader should be able to:

1. Explain the principles and evolution of zero-trust architecture and evaluate its limitations.

2. Assess the migration implications of quantum computing for cryptographic systems.

3. Analyse autonomous attacks and AI-enabled defence, including governance risks.

4. Describe confidential computing and distinguish it from conventional encryption.

5. Evaluate security and governance issues in decentralized technologies.

6. Interpret the strategic effects of changing cyber regulations.

7. Construct plausible cyber-risk scenarios and derive suitable security priorities.

1. From Perimeter Security to Adaptive Trust Decisions

Traditional enterprise security was designed around a relatively stable perimeter. Users and devices located inside a corporate network were often treated as more trustworthy than external entities. Firewalls, virtual private networks, network segmentation, and identity directories implemented this model. It was effective when applications were hosted in enterprise data centres and employees worked mainly from controlled locations.

That model weakened as organisations adopted software as a service, mobile work, outsourced operations, application programming interfaces, operational technology, and multi-cloud environments. A connection through a corporate network no longer reliably indicated that a user, device, process, or workload was safe. Compromised credentials could provide an attacker with legitimate access, while supply-chain compromise could introduce malicious code through an apparently trusted component.

Zero trust is a security approach in which no request is trusted solely because of network location or previous authentication. Access is continuously evaluated using identity, device posture, workload context, resource sensitivity, behavioural signals, and policy. The commonly expressed principle is “verify explicitly, use least privilege, and assume breach.” These principles are strategic goals rather than a single product or architecture.

1.1 A conceptual access model

A useful abstraction is to represent an access decision as:

Decision = Policy(Identity, Device, Resource, Context, Behaviour, Threat Signals)

This is not a universal numerical formula; it is a conceptual model. Identity may include authentication strength and role. Device attributes may include patch status, encryption, and endpoint protection. Context can include location, time, network characteristics, and transaction purpose. Behavioural and threat signals may alter the decision after access has been granted.

A zero-trust architecture normally includes:

• a policy engine that evaluates access rules;
• a policy administrator that creates or terminates sessions; and
• policy enforcement points that mediate access to applications, data, services, or devices.

Strong identity is necessary but insufficient. Multi-factor authentication, phishing-resistant credentials, workload identities, privileged-access management, device compliance, microsegmentation, software-defined access, continuous monitoring, and data classification must operate as a coordinated system.

1.2 Evolution and critical evaluation

Early zero-trust programmes often concentrated on identity and access management. More mature implementations extend the model to application-to-application communication, service identities, software supply chains, operational technology, and data-level controls. The long-term direction is towards adaptive authorization: permissions are narrow, time-limited, purpose-specific, and recalculated when relevant conditions change.

Zero trust does not mean that every request is challenged with a disruptive authentication prompt. Excessive prompts encourage unsafe workarounds and reduce usability. Nor does it eliminate the need for network security, backups, vulnerability management, or incident response. It changes their role from perimeter assumptions to supporting evidence and enforcement mechanisms.

Implementation challenges include legacy applications that cannot expose useful identity signals, incomplete asset inventories, inconsistent policy definitions, weak service-account governance, and excessive dependence on a single identity provider. Continuous evaluation can also create privacy concerns if organisations collect detailed location or behavioural information without proportionality, transparency, and retention controls.

1.3 Measuring progress

Maturity should not be measured by the number of zero-trust products purchased. More useful indicators include the percentage of critical applications protected by strong authentication, the proportion of privileged access that is just-in-time, the coverage of machine identities, the time required to revoke access, the number of unmanaged devices accessing sensitive resources, and the frequency with which policies are tested against realistic attack paths.

A mature programme also measures business outcomes: reduced lateral movement, fewer standing privileges, faster containment, and improved visibility. These measures should be interpreted with context. A fall in detected incidents may indicate improvement, but it may also indicate declining monitoring quality.

2. Post-Quantum Cryptography and Cryptographic Transition

Quantum computers exploit physical phenomena that can solve certain mathematical problems more efficiently than classical computers. Shor’s algorithm threatens widely used public-key systems based on integer factorization and discrete logarithms, including RSA and elliptic-curve cryptography, if sufficiently capable fault-tolerant quantum computers become available. Grover’s algorithm provides a quadratic speedup for exhaustive search, which affects symmetric cryptography and hash-based constructions, although the practical impact differs from the direct break of public-key systems.

The timing is uncertain. A capable cryptographically relevant quantum computer may be years away, but migration cannot be postponed until one exists. Encrypted data captured today may be decrypted later, a risk commonly called “harvest now, decrypt later.” Long-lived information—such as health records, industrial designs, diplomatic communications, and intellectual property—requires particular attention.

2.1 Post-quantum cryptography

Post-quantum cryptography (PQC) uses mathematical problems believed to resist both classical and quantum attacks. Important families include:

• lattice-based cryptography, used for key establishment and digital signatures;
• hash-based signatures, which rely primarily on secure hash functions;
• code-based cryptography, based on error-correcting codes; and
• multivariate and other structured mathematical approaches, some of which have experienced significant cryptanalytic failures.

Standardisation is an ongoing engineering and governance process. A selected algorithm should not be treated as permanently secure merely because it has been standardised. Implementations, parameter choices, protocols, side-channel resistance, performance, and future cryptanalysis remain relevant.

2.2 Migration is an asset and dependency problem

Cryptographic migration begins with cryptographic inventory, not algorithm replacement. Organisations need to identify where public-key cryptography is used in certificates, VPNs, messaging, code signing, firmware updates, APIs, databases, embedded systems, identity systems, and third-party services. They must also record data sensitivity and retention periods.

Cryptographic agility is the ability to replace algorithms, parameters, or implementations without redesigning an entire system. It requires abstraction in software, versioned protocols, algorithm negotiation that prevents downgrade attacks, lifecycle ownership, and testing. Agility does not mean accepting arbitrary algorithms dynamically; approved choices and secure defaults remain necessary.

Hybrid key establishment can combine a conventional mechanism with a post-quantum mechanism, so that an attacker must compromise both components under the intended security model. Hybrid approaches can ease transition but increase message sizes, implementation complexity, and opportunities for configuration errors.

2.3 Symmetric cryptography and quantum effects

Grover’s algorithm implies that an ideal exhaustive search over an n-bit key space may require roughly 2^(n/2) quantum queries rather than 2^n classical queries. This is an asymptotic observation, not a complete practical attack estimate. Quantum error correction, circuit depth, memory, and implementation costs matter. The usual response is to use adequately sized symmetric keys and approved hash constructions rather than abandoning symmetric cryptography.

The strategic lesson is that quantum readiness is a long-term systems-engineering programme. It includes procurement requirements, supplier engagement, certificate and protocol testing, archival-data protection, and periodic reassessment of cryptanalytic evidence.

3. Autonomous Attacks and AI-Enabled Security

Automation has long existed in security: worms scan automatically, botnets launch distributed attacks, and tools generate password guesses or exploit known vulnerabilities. Recent AI advances increase the ability of systems to interpret unstructured information, generate code, adapt lures, and coordinate actions. The important change is not that an attack becomes completely independent of humans, but that the scale, speed, personalization, and adaptability of attack operations can increase.

An AI-enabled attack chain may include automated reconnaissance, target prioritization, social-engineering content generation, exploitation assistance, credential abuse, lateral movement, and data selection for extortion. Generative models can lower the skill barrier for some activities, although they do not remove the need for infrastructure, access, operational security, and domain knowledge.

3.1 Autonomous systems as a control problem

Security automation can be classified by the degree of human control:

1. Decision support: the system recommends an action.

2. Human approval: the system prepares an action that requires authorization.

3. Bounded autonomy: the system executes predefined actions within strict limits.

4. High autonomy: the system selects and performs multi-step actions with limited intervention.

The appropriate level depends on reversibility, potential harm, confidence, and time sensitivity. Automatically isolating a clearly malicious endpoint may be justified. Automatically deleting production data based on an uncertain model classification is not.

A useful governance principle is proportional autonomy: the more consequential, irreversible, or externally affecting an action is, the stronger the requirement for human approval, independent validation, logging, and rollback.

3.2 Defensive applications and limitations

AI can support anomaly detection, malware classification, alert triage, attack-path analysis, vulnerability prioritization, phishing analysis, code review, incident summarisation, and security knowledge retrieval. However, statistical accuracy does not guarantee operational safety. False positives can exhaust analysts; false negatives can create misplaced confidence. Attackers may evade models, poison training data, manipulate prompts, or exploit excessive permissions granted to an AI agent.

AI systems themselves introduce risks: sensitive data may be disclosed to external services, generated code may contain vulnerabilities, model outputs may be untraceable, and agentic tools may perform actions outside their intended scope. Security architecture should therefore apply least privilege to AI agents, isolate tools, validate outputs, record prompts and actions where lawful, and test against adversarial inputs.

4. Confidential Computing and Data-in-Use Protection

Conventional encryption protects data at rest and in transit. Data must often be decrypted in memory while it is processed, creating exposure to a malicious cloud administrator, compromised hypervisor, privileged malware, or forensic acquisition. Confidential computing seeks to protect data in use by executing sensitive workloads inside a hardware-supported trusted execution environment (TEE).

A TEE generally provides an isolated execution region, memory protection, measurement of the initial software state, and attestation. Attestation enables a remote party to verify that a particular workload is running in an expected environment before releasing keys or data. The exact security properties depend on the processor, firmware, trusted computing base, deployment model, and implementation.

Confidential computing is valuable for multi-party analytics, privacy-preserving health research, financial processing, confidential AI inference, and cloud workloads handling regulated information. It can reduce the amount of infrastructure that must be fully trusted, but it does not make the application secure automatically.

Threats include side-channel attacks, rollback, denial of service, compromised firmware, malicious application code inside the enclave, insecure input and output channels, and inadequate attestation policy. A confidential workload can faithfully protect a vulnerable application. Organisations must therefore combine TEEs with secure development, key management, monitoring, patching, and carefully defined trust claims.

5. Decentralized Technologies and Distributed Trust

Decentralized technologies redistribute authority, data, or execution across multiple participants. Distributed ledgers, blockchains, decentralized identifiers, token-based systems, and smart contracts are prominent examples. They can reduce dependence on a single intermediary, support shared records, and enable programmable transactions. They also create new security and governance problems.

A blockchain does not make data true merely because it is immutably recorded. It provides a particular method of reaching agreement about state under specified assumptions. Security depends on consensus design, participant incentives, key management, client software, bridges, oracles, smart contracts, and governance processes.

Smart contracts are especially important. Their code may control valuable assets, yet code vulnerabilities can be difficult to correct after deployment. Common risks include reentrancy, inadequate access control, arithmetic errors, oracle manipulation, flash-loan-assisted attacks, and flawed upgrade mechanisms. Formal verification can improve assurance for selected properties, but it does not prove that the requirements themselves are correct or that external dependencies are honest.

Decentralized identity can give individuals greater control over credentials, but key loss, recovery, revocation, correlation, and coercion remain difficult. Privacy is also not guaranteed: public transaction histories can support detailed behavioural analysis. Governance must address who can change protocols, resolve disputes, respond to emergencies, and comply with lawful requests.

The strategic question is not whether decentralization is inherently safer. It is whether distributing trust reduces the relevant threat more effectively than the complexity and new dependencies it introduces.

6. Regulatory Change as a Security Driver

Cyber regulation is evolving from general expectations of “reasonable security” towards more explicit duties concerning risk management, incident reporting, governance, software assurance, resilience, supply chains, and personal-data protection. Requirements vary by jurisdiction and sector, and organisations operating internationally may face overlapping or conflicting obligations.

Regulation affects security in at least four ways. First, it establishes minimum controls and reporting deadlines. Second, it allocates responsibility to boards, executives, manufacturers, service providers, and operators of critical infrastructure. Third, it creates evidence requirements: policies, risk assessments, testing records, logs, and supplier due diligence. Fourth, it changes the economic consequences of failure through penalties, litigation, contractual remedies, and reputational harm.

Regulatory compliance is not equivalent to security. A checklist can be satisfied while attack paths remain open. Conversely, technically strong controls may fail to meet a duty because evidence, accountability, or notification processes are missing. The appropriate approach is to map regulatory obligations to a common control framework, assign accountable owners, document risk acceptance, and test both technical and organisational controls.

Boards should receive risk information in business terms: critical services, plausible loss scenarios, recovery dependencies, material suppliers, and residual risk. They should not be presented only with counts of blocked attacks. Incident reporting should be accurate and timely, but organisations must avoid speculative statements that later undermine credibility. Legal, technical, communications, and executive teams should rehearse decision-making before an incident occurs.

7. Future Cyber-Risk Scenarios

Foresight is not prediction. A scenario is a structured, plausible description of how conditions could develop. Effective scenarios identify drivers, uncertainties, affected assets, attack pathways, consequences, and decision triggers.

Scenario A: The adaptive identity breach

In this illustrative scenario, an attacker obtains a valid contractor credential through a convincing, AI-generated social-engineering campaign. The account passes basic multi-factor authentication, but the attacker’s device and behaviour differ from the contractor’s normal pattern. A mature zero-trust architecture detects the anomaly, restricts access to low-risk resources, requires phishing-resistant reauthentication, and prevents access to administrative functions. The event becomes a contained identity incident rather than a domain-wide compromise.

The scenario demonstrates that identity assurance, device signals, behaviour analytics, privilege reduction, and rapid response must operate together. It also shows that zero trust does not prevent credential theft; it limits the consequences.

Scenario B: Harvest now, decrypt later

A research organisation stores sensitive design documents for several decades. Adversaries intercept current encrypted communications and archive them. The organisation has no inventory of cryptographic use and relies on long-lived certificates and obsolete protocols. When quantum-capable attacks become practical, historical material is exposed.

The required response is not an immediate replacement of every algorithm. It is a prioritised programme: identify long-lived secrets, protect the most sensitive channels, remove obsolete cryptography, introduce approved hybrid mechanisms where suitable, and ensure future systems are cryptographically agile.

Scenario C: Autonomous supply-chain manipulation

An AI-enabled attacker studies public repositories, identifies a poorly maintained dependency, generates a plausible malicious update, and adapts its activity to evade standard tests. The dependency is incorporated into a widely deployed service. A software bill of materials, signed builds, provenance verification, dependency pinning, reproducible builds, and behavioural monitoring reduce the likelihood and impact of compromise.

This scenario illustrates that AI does not replace traditional supply-chain controls. It increases the urgency of provenance, independent verification, secure development, and rapid revocation.

8. Integrated Strategy for Security Futures

A strategic programme should begin with mission and impact analysis. Identify essential services, safety consequences, critical data, recovery tolerances, legal duties, and dependencies. Then assess how emerging technologies change threats and control assumptions.

A practical portfolio has five layers:

1. Foundational hygiene: asset inventory, vulnerability management, secure configuration, backup, identity governance, logging, and incident response.

2. Adaptive architecture: zero-trust access, segmentation, workload identity, secure APIs, and continuous policy evaluation.

3. Future-resistant technology: cryptographic inventory and migration, confidential computing where its trust model is appropriate, and secure AI governance.

4. Resilient ecosystems: supplier assurance, software provenance, contractual controls, sector collaboration, and exercised recovery plans.

5. Governance and foresight: board accountability, regulatory mapping, risk appetite, scenario exercises, metrics, and periodic technology reassessment.

Prioritisation should consider impact, exposure, exploitability, time to remediation, dependency concentration, and reversibility. Security leaders should avoid both technological determinism and complacency. Not every emerging technology deserves immediate adoption, but every material change in threat capability deserves assessment.

Applied Case: Northstar Health Network

Background

Northstar Health Network is an illustrative multi-site healthcare provider operating hospitals, laboratories, telemedicine services, and a cloud-based research platform. It has legacy medical devices, a large contractor population, and research data requiring protection for decades. Its security architecture uses VPN access, perimeter firewalls, conventional public-key cryptography, and several externally hosted AI services.

Problem

A review identifies three strategic risks. First, compromised contractor credentials could provide broad internal access. Second, research communications and archived data may be vulnerable to future quantum decryption. Third, clinicians are beginning to use generative AI tools without consistent privacy or approval controls. The organisation also faces expanding reporting and resilience obligations.

Analysis

The risks are connected. VPN access creates a coarse trust boundary; legacy devices cannot all support modern agents; cryptographic usage is poorly documented; and AI services may process protected information outside approved environments. A product-by-product response would leave systemic weaknesses unresolved.

Approach

Northstar adopts a phased programme. It first maps critical clinical services, devices, data flows, suppliers, and cryptographic dependencies. It introduces phishing-resistant authentication for privileged and contractor access, application-level access controls, network segmentation, and time-limited privileges. Legacy devices are isolated through compensating controls rather than assumed to be modernised immediately.

The organisation establishes a PQC inventory and prioritises long-lived research data and external communications. It tests approved hybrid protocols in a non-production environment and requires cryptographic agility in new procurement. For AI, it creates an approved-use policy, prohibits sensitive-data entry into unapproved services, deploys a controlled internal assistant, and requires human review for clinical or security decisions. Confidential computing is piloted for a multi-institution research workload after an explicit assessment of attestation, side-channel, and provider risks.

Incident exercises combine technical response with legal notification, patient communication, clinical continuity, and supplier coordination. The board receives quarterly indicators on privileged access, critical-service recovery, cryptographic coverage, high-risk suppliers, and unresolved exceptions.

Outcome

After the first programme phase, Northstar has reduced standing administrative access, improved visibility of service identities, and established a migration roadmap rather than claiming immediate quantum resistance. AI use becomes more controlled without prohibiting productive experimentation. The organisation remains exposed to legacy-device and supply-chain risks, but those risks are documented, monitored, and linked to funded remediation.

Learning Points

The case demonstrates that strategic security is an architecture and governance problem, not a sequence of isolated purchases. Zero trust reduces blast radius; PQC planning addresses long-term confidentiality; AI governance manages both offensive and defensive automation; confidential computing is applied selectively; and regulatory readiness depends on evidence and accountable decisions.

Challenges, Ethical Issues, and Research Directions

Emerging security controls can themselves create social risks. Continuous monitoring may become disproportionate surveillance. Automated risk scores may discriminate against users or locations. Decentralized systems may make correction difficult when personal data is recorded immutably. AI-enabled defence can produce opaque decisions affecting employment, access, or public services. Security decisions must therefore include necessity, proportionality, explainability, accessibility, and appeal mechanisms.

Research challenges include measuring zero-trust effectiveness without reducing it to product counts; designing robust, interoperable PQC implementations; proving meaningful properties of AI agents; defending TEEs against side channels; governing decentralized systems across jurisdictions; and creating regulatory approaches that encourage security without freezing beneficial innovation.

A further challenge is systemic concentration. Cloud providers, identity platforms, software repositories, certificate authorities, and security vendors can become critical dependencies. A control that improves local security may increase systemic fragility if many organisations depend on the same provider. Strategic risk analysis must therefore include monoculture, correlated failure, and geopolitical disruption.

Best-Practice Principles

• Treat emerging technology as a change in assumptions, not merely a new product category.
• Begin with critical services, data lifetime, and business impact.
• Build zero-trust capabilities around strong identity, least privilege, segmentation, and continuous evidence.
• Maintain a cryptographic inventory and require algorithm agility in new systems.
• Use AI with bounded permissions, human oversight for consequential actions, and auditable decisions.
• Distinguish confidential-computing claims from broader application and supply-chain security.
• Evaluate decentralized systems through their governance, key management, consensus, and recovery models.
• Map regulation to accountable controls and evidence rather than treating compliance as a checklist.
• Exercise plausible scenarios involving suppliers, identity compromise, quantum transition, and service concentration.
• Reassess strategy as threat intelligence, standards, technology, and law develop.

Chapter Summary

Emerging security trends are best understood as changes to trust, computation, control, and accountability. Zero trust replaces location-based assumptions with explicit, least-privileged, context-aware decisions, but requires reliable identity, asset visibility, policy enforcement, and monitoring. Post-quantum cryptography responds to future quantum threats and the present danger of harvested encrypted data; successful migration depends on inventory, prioritisation, agility, and testing. AI increases the scale and adaptability of attacks while supporting detection and response, making bounded autonomy and governance essential. Confidential computing protects data during processing through trusted execution and attestation, but does not eliminate application, side-channel, or provider risks. Decentralized technologies distribute authority but introduce challenges involving consensus, keys, smart contracts, privacy, and governance. Regulation increasingly demands demonstrable resilience, accountability, reporting, and supply-chain assurance. Strategic futures work connects these developments through scenarios, impact analysis, portfolio prioritisation, and continuous reassessment.

Key Terms

Zero trust: A security approach that avoids implicit trust and evaluates access using identity, context, policy, and risk.

Least privilege: Granting only the access necessary for an authorised task.

Adaptive authorization: Re-evaluating permissions as context, behaviour, or threat conditions change.

Post-quantum cryptography: Cryptography designed to resist attacks by classical and quantum computers.

Harvest now, decrypt later: Collecting encrypted information today for possible decryption when capabilities improve.

Cryptographic agility: The ability to replace cryptographic algorithms or parameters without wholesale system redesign.

Hybrid key establishment: Combining conventional and post-quantum mechanisms in a transition design.

Autonomous attack: An attack in which software performs significant discovery, decision, or action with limited human intervention.

Agentic AI: An AI system able to pursue goals through tools or multi-step actions.

Trusted execution environment: An isolated computing environment intended to protect code and data during execution.

Remote attestation: Evidence allowing a party to verify the state or identity of a remote computing environment.

Confidential computing: Protection of data while it is being processed, commonly through hardware-supported isolation.

Decentralization: Distribution of authority, data, or execution across multiple participants.

Smart contract: Program code that executes or governs transactions in a distributed system.

Oracle: A mechanism that supplies external information to a smart contract or distributed application.

Software supply chain: The people, processes, code, tools, and dependencies involved in producing and delivering software.

Cryptographic transition: The organisational and technical process of moving from existing cryptographic systems to new ones.

Cyber resilience: The ability to prepare for, withstand, recover from, and adapt to cyber disruption.

Scenario planning: A structured method for exploring plausible future conditions and strategic responses.

Residual risk: Risk remaining after controls and treatments have been applied.

Review Questions

Short Answer Questions

1. What are the three commonly associated principles of zero-trust security?

2. Why is cryptographic inventory necessary before post-quantum migration?

3. What does remote attestation provide in confidential computing?

4. Identify two risks associated with smart contracts.

5. Why is regulatory compliance not equivalent to security?

Long Answer Questions

1. Explain the evolution from perimeter security to adaptive zero-trust architecture and critically evaluate its implementation challenges.

2. Discuss the strategic, technical, and organisational dimensions of post-quantum cryptographic migration.

3. Analyse the benefits and risks of AI-enabled autonomous security operations.

4. Compare confidential computing with encryption at rest and in transit, including limitations of trusted execution environments.

5. Evaluate how regulation and supply-chain concentration influence enterprise cyber-resilience.

Analytical / Application Questions

1. A university has long-lived research data, VPN-based access, and many unmanaged devices. Develop a two-phase strategy addressing zero trust and quantum readiness, and justify the order of priorities.

2. A security AI agent can automatically isolate endpoints and revoke credentials. Propose a governance model specifying which actions may be autonomous, which require approval, and what evidence must be recorded.

3. Using the Northstar Health Network scenario, identify three residual risks after the proposed programme and recommend metrics that would reveal whether those risks are decreasing.

Multiple Choice Questions with Answers

Question 1

Which statement best represents the core logic of zero-trust security?

A. All internal network traffic is trusted after perimeter authentication.

B. Access is evaluated explicitly using identity, context, policy, and risk.

C. Security is achieved primarily by increasing firewall capacity.

D. Users should receive permanent access to avoid operational delays.

Correct Answer: B. Access is evaluated explicitly using identity, context, policy, and risk.

Question 2

Why should an organisation begin post-quantum migration with a cryptographic inventory?

A. To identify where cryptography, dependencies, and long-lived data require prioritisation.

B. To eliminate the need for certificate management.

C. To guarantee that every algorithm will remain secure indefinitely.

D. To replace all symmetric encryption immediately.

Correct Answer: A. To identify where cryptography, dependencies, and long-lived data require prioritisation.

Question 3

What is the principal purpose of remote attestation in confidential computing?

A. To increase network bandwidth for encrypted traffic.

B. To verify that a remote workload is running in an expected trusted environment.

C. To recover deleted data from a cloud provider.

D. To replace application vulnerability testing.

Correct Answer: B. To verify that a remote workload is running in an expected trusted environment.

Question 4

Which action is most appropriate for a high-consequence AI security agent?

A. Allow unrestricted autonomous deletion of production data.

B. Grant permanent administrator privileges to improve response speed.

C. Require bounded permissions, logging, validation, and human approval where actions are difficult to reverse.

D. Disable all monitoring to prevent model bias.

Correct Answer: C. Require bounded permissions, logging, validation, and human approval where actions are difficult to reverse.

Question 5

Which statement about decentralized technologies is most accurate?

A. Immutability guarantees that recorded information is factually correct.

B. Distributed ledgers remove the need for key management.

C. Security depends on consensus, incentives, software, keys, governance, and external dependencies.

D. Smart contracts cannot contain exploitable logic.

Correct Answer: C. Security depends on consensus, incentives, software, keys, governance, and external dependencies.

Question 6

Grover’s algorithm is relevant to security because it

A. directly breaks all digital signatures in constant time.

B. can reduce the effective security of exhaustive search against symmetric keys in an idealised model.

C. prevents quantum computers from running cryptographic algorithms.

D. only affects network firewalls.

Correct Answer: B. can reduce the effective security of exhaustive search against symmetric keys in an idealised model.

Question 7

What is a key limitation of confidential computing?

A. It protects every application from logical vulnerabilities automatically.

B. It makes software supply-chain security unnecessary.

C. A protected enclave can still run vulnerable code or expose insecure inputs and outputs.

D. It cannot protect data during processing.

Correct Answer: C. A protected enclave can still run vulnerable code or expose insecure inputs and outputs.

Question 8

Which metric is most meaningful for evaluating zero-trust maturity?

A. The number of security products purchased.

B. The number of firewall rules created.

C. The proportion of privileged access that is time-limited and appropriately governed.

D. The number of internal IP addresses.

Correct Answer: C. The proportion of privileged access that is time-limited and appropriately governed.

Question 9

What does “harvest now, decrypt later” describe?

A. Deleting encrypted data before a backup is made.

B. Collecting encrypted information now for possible future decryption.

C. Using quantum computers to encrypt all traffic today.

D. Replacing public-key cryptography with passwords.

Correct Answer: B. Collecting encrypted information now for possible future decryption.

Question 10

Why should scenario planning be used in emerging cyber-risk strategy?

A. It predicts one certain future with complete accuracy.

B. It replaces technical risk assessment entirely.

C. It explores plausible conditions, consequences, decision triggers, and response options under uncertainty.

D. It focuses only on historical incidents.

Correct Answer: C. It explores plausible conditions, consequences, decision triggers, and response options under uncertainty.