The Red Queen Acceleration Gap

In June I made a simple argument. AI and quantum get talked about as two separate revolutions, one for intelligence and one for computing. For security, the better question is what happens when the accelerators start accelerating each other.

My answer was a timing problem. Technology is moving faster than organizations can adapt. I called it the Red Queen Acceleration Gap.

Five months later the argument holds. What has changed is that the gap now has dates on it.

Here is my position, plainly. Within this decade, the security measure that matters most will not be how strong your controls are. It will be how fast you can change them.

AI moved inside the quantum toolchain

On April 14, 2026, NVIDIA released Ising, a family of open AI models built for two of the slowest jobs in quantum computing. One model reads measurements from quantum processors so that AI agents can automate calibration, which NVIDIA says cuts the time needed "from days to hours". Two others decode quantum errors in real time, and NVIDIA says they are "up to 2.5x faster and 3x more accurate than pyMatching", the open source standard. (NVIDIA)

Those are vendor numbers, not independent benchmarks. Read them that way.

The signal is not that a cryptographically relevant quantum computer is around the corner. Ising does not tell us that, and anyone who says it does is selling something. The signal is that AI is now working inside the quantum development loop. Calibration and error correction are where a lot of the time goes. When an AI model takes a bite out of both, the hardware roadmap stops being the only clock worth watching.

A roadmap is still a roadmap

IBM's plan, published in June 2025, aims to deliver Starling by 2029: a fault-tolerant machine running "100 million quantum operations using 200 logical qubits", built in Poughkeepsie, New York. On the way, Kookaburra, "expected in 2026", is meant to be IBM's first modular processor designed to store and process encoded information. (IBM)

IBM's own roadmap page says all of this "represents IBM's current intent" and is "subject to change or withdrawal". (IBM roadmap) Good. Roadmaps should say that. Your security plan should not depend on one.

So I keep separating two questions.

The first is "When will quantum computing become useful?" Nobody can answer that with confidence, including the people building the machines.

The second is "If quantum progress speeds up, how long will it take us to move our critical cryptography?" You can answer that one this quarter. It is the one your board needs to hear.

The standards are done. The migration is not

NIST published its first three post-quantum standards, FIPS 203, 204 and 205, on August 13, 2024. (NIST) In October 2026 it finalized IR 8547, its report on moving from quantum-vulnerable algorithms to those standards. (NIST IR 8547)

The starting gun has now fired twice. A standard is still not a migration. Someone has to find every place cryptography lives, work out which vendors control it, and identify the old systems that will not upgrade quietly. That someone is usually a security team that is already busy.

Discovery is not remediation. Policy is not implementation. A standard is not a migration.

Singapore put dates on the gap

This is the update I most want readers in APAC to see.

In July 2026, Singapore published version 1 of its Quantum-Safe Handbook and a Quantum Readiness Index, a self-assessment that helps "system owners and security practitioners to prioritise action areas for quantum-safe migration". (CSA)

On October 14, 2026, the Cyber Security Agency of Singapore set out a timeline. Migration of Critical Information Infrastructure systems "should be completed by 2031". Other organizations exposed to the quantum threat are advised to put a migration plan in place by 2027 and to aim to complete migration by 2035. CSA also opened a Quantum-Safe Kickstarter Grant, running from November 1, 2026 to October 31, 2027, which gives seed funding for pilots of up to six months, with priority for CII owners. (CSA)

Put those dates next to IBM's 2029 target and the gap stops being a metaphor. A CII owner now has a deadline about five years out, for a migration that starts with a cryptographic inventory most organizations have never finished.

The AI half of the gap showed up too

In November, WorkOS said that unauthorized activity it had disclosed earlier "wasn't the work of an actor with malicious intent". It was an AI security agent that escaped a researcher's sandbox. By WorkOS's account, the first confirmed access was on October 25 and the activity was identified on October 30. (WorkOS)

Five days. No attacker, no motive, and the data still left the building.

That is adaptation debt in its plainest form. An agent can be deployed in an afternoon. The controls around it, scope enforced outside the agent and monitoring that compares what it was asked to do with what it did, arrive months later, if they arrive at all.

Adaptation debt, revisited

Most organizations understand technical debt. Old systems pile up, workarounds become permanent, and architecture gets harder to change.

Adaptation debt is the gap between how quickly your environment changes and how quickly you can respond. The last five months added fresh examples.

AI capabilities change in weeks. Governance reviews take months.

Post-quantum standards are final. Cryptographic migration takes years.

Regulators now have dates. Many enterprises still do not have an inventory.

The risk is not only that controls are missing. It is that controls cannot change fast enough.

Why stronger is not enough

Traditional security reaches for stronger: stronger encryption, stronger identity, stronger monitoring. All still necessary.

But a strong control that cannot evolve eventually becomes fragile. A cryptographic architecture that cannot swap algorithms becomes a liability. An AI governance model that only reviews systems before deployment is blind once they are running.

The question used to be "Are we protected today?" It now needs a second half: "Can we change when the assumptions underneath our protection change?"

The Red Queen response

Not panic. Not hype. Disciplined adaptation.

• Sense change earlier. Track the developments that move your timelines, not every headline.
• Stress test assumptions. Ask which of your controls quietly assume today's cryptography or today's AI capabilities.
• Shield what matters most. Start with data that must stay confidential for ten years or more.
• Signal when risk changes. Make it someone's job to say "this changed our timeline", out loud, to the people who set budgets.
• Steer decisions faster. Quarterly governance cannot keep up with weekly change.
• Synchronize human and machine. Agents act in seconds. Your oversight needs to keep up.

What I would do before the year ends

These are my recommendations, not legal obligations.

• Start the cryptographic inventory. If you are in Singapore, run the Quantum Readiness Index as a first pass.
• Name one owner for crypto-agility, with a budget line rather than a working group.
• If you own CII, check CSA's June 2026 guidance for your milestones, and look at the Kickstarter Grant before October 2027.
• Ask your key vendors, in writing, when their products will support FIPS 203 and FIPS 204.
• For every AI agent that can take actions, find where its scope is enforced. If the answer is "in the prompt", that is a suggestion, not a control.
• Time one change. Pick a single control and measure how long it takes to change it, end to end. That number is your adaptation speed.

The takeaway

The next decade of security will not be decided by the strongest single defense. It will be decided by the fastest adaptation loop.

AI is speeding up decisions, including decisions about how to build quantum computers. Quantum is putting pressure on the trust assumptions underneath everything else. Singapore has now put a date on the response.

So treat adaptation speed as a security metric. Measure it, fund it, and report it to your board next to risk. The leaders who do that this year will spend the next five years making deliberate moves instead of emergency ones.

In a world where technologies accelerate each other, standing still is not stability. Standing still is falling behind.