Welcome to the new reality of digital security, where yesterday’s concerns of malware and phishing are now competing with the onslaught of new threats driven by artificial intelligence and quantum computing.

The world is moving fast, with new technologies that claim to change everything from how we conduct business processes to issues of national security. But as organizations race to take advantage of these innovations, a stark new reality is emerging: the very tools that were envisioned to help foster the future will also be its greatest threat.

That is the essential warning in the 2025 Thales Data Threat Report, a comprehensive annual study that unpacks the state of cybersecurity and data protection facing organizations across global industries. The results? A wake-up call.

Table of Contents

Thales: AI and quantum threats top security priorities

⚠️ AI and quantum threats shoot straight to the top of the cybersecurity list

For the past few years, CIOs have had cloud misconfigurations, ransomware attacks, and insidious insider threats as top-of-mind concerns. But by 2025, AI and quantum computing will have ascended to the top of this list, surpassing almost all contemporary threat vectors.

This is not simply a new focus, it is a complete transformation in the cyber threat vector ecosystem.

According to Thales:

70% of respondents now cite the insatiable development speed of AI, particularly generative AI (GenAI), as their number one priority security risk.

64% reported significant doubt regarding AI system integrity, and 57% listed their worry as a growing concern regarding AI system trustworthiness.

Why the fear? GenAI is not a clever piece of software; it is, at its core, a decision-making, data-consuming entity of considerable power. And like many of the power tools we use, it is only as good—and safe—as the materials it was made from.

🤖 GenAI: Innovation Engine or Data Security Nightmare?

Generative AI has captivated the minds of every sector of the economy; everyone seems to be pursuing hyper-productivity, automated creativity, or machine-speed decision-making.

But here’s the rub.

GenAI takes its nourishment from data. And not just any data—it wants high-quality, high-fidelity, often very closely-held information, think private customer records, internal business logic, proprietary designs, confidential memos, etc., all of which become potential training material.

And now, as AI capabilities evolve toward what researchers refer to as agentic AI, where systems can make decisions and execute tasks on their own, their value rises exponentially. In these systems, data is not simply input; data is instruction! The risk from one bad dataset or corrupted model could be colossal business errors, biased decisions, or even autonomous actions that yield unpredictable results.

With this complexity, data quality is no longer a third-party concern; it is a strategic imperative.

💡 A Digital Gold Rush—Sans Map?

It’s clear from the Thales report that companies are moving forward, deploying their AI initiatives—many without fully appreciating the architecture or security risks associated with the tools they’re implementing, despite the clear risks.

33% of organizations reported that they are already deploying or deeply embedding GenAI into their operations. But does that mean they are doing this safely?

Eric Hanselman, Chief Analyst, and the S&P Global Market Intelligence 451 Research, cautions, “Accelerating innovation in the rapidly evolving GenAI landscape is stressing enterprises, sometimes to the point of sacrificing caution… Enterprises are deploying GenAI faster than their capability to understand their application architectures.”

This is an archetypal FOMO, digital style. Many organizations are merely leaping into GenAI and hoping to identify and capitalize on their competitive advantage… while potentially knitting together a collection of “AI” systems with poor foundations.

🔐 Security Leaders Are Reacting, But Is It Fast Enough?

If there is a bright side to this rising distress, it is that most organizations aren’t just sitting around.

The Thales report revealed that:

73% of enterprises are actively investing in AI-specific security.
More than two-thirds are sourcing these from major cloud providers.
Three out of five are buying from cybersecurity vendors they trust.
Just under half are looking for solutions from fledgling AI Security start-ups.

This isn’t window dressing. In 2025, AI security is now the second-highest spending priority, second only to cloud security, the bedrock of digital infrastructure protection for a long time.

This is in part about the dawning revelation that AI is not some corporate IT whim; it is a significant development with serious security implications.

📉The Good News: Breaches Are Down (Slightly).

Between the dark and gloomy clouds, some rays of sunshine are coming through, such as the fact that Thales found that breaches continue to trend mostly downward:

56% of organizations reported there was a breach in 2021.
That drops to 45% by 2025.
Perhaps most importantly, only 14% had a breach last year compared to 28% four years ago.

So, what’s changing?

Enhanced cybersecurity awareness levels, more compliance activity, better incident reporting plans, better cloud-native security products, all may be helping this trend downward, but that said, experts warn not to become complacent because your threat levels are reduced, ”The attackers are changing. The attacks could be more dangerous.”

🦠 The Usual Suspects: Malware, Phishing, and Ransomware

As AI and quantum threats gain gravitas, our cybersecurity “classic villains” remain:

Malware is still, and will remain, the most exploited attack vector—especially the more advanced, fileless variants.
Phishing has become smarter and more targeted, especially with GenAI tools that generate legitimate-sounding bait emails.
Ransomware continues to drop—now in third place—but that’s not to say it’s out of the picture. Newer ransomware includes both data theft and encryption (double extortion).

And interestingly, the perceptions of the source of the threat landscape are evolving. In 2025, organizations believe the greatest risk comes from:

Hacktivists driven by political or ideological motives.
Nation-state actors who are stealthy and well-funded.
Human error has slightly diminished in perceived risk; however, human error is still the primary enabler of breaches.

🧬 Quantum Computing: Tomorrow’s Danger That’s Already Here

While the threats posed by GenAI are immediate and tangible, the report also provides a warning about a different and perhaps more dangerous threat: quantum computing.

As the quantum technology space gets closer to practical use, experts warn that our existing encryption methods could one day be obsolete.

And the Thales report supports the fears that are considerably growing:

63% of study respondents said their biggest concern is that encryption will be compromised in the future—the idea that quantum computers can break even the strongest cryptographic protections available today.
61% of respondents cited concerns about vulnerabilities in key distribution, as quantum attacks may succeed in cracking the exchanges of encrypted distributed key exchanges.
58% of respondents flag a concerning “harvest now, exploit later” exercise, in which bad actors hold onto today’s encrypted data to decrypt it when quantum technology becomes fully capable.

Impact? Anything from health records to military communications.

🔐 Post-Quantum Defenses: The New Security Frontier

Organizations are beginning to take action, but cautiously.

60% are currently testing or prototyping post-quantum cryptography (PQC).
Half are at least thinking through their encryption strategies from the ground up.
But organizations are hesitant to trust third-party vendors – only a third of those surveyed trust their telecom or cloud providers’ care for them during this transition.

As Todd Moore, Global VP of Data Security at Thales, astutely remarked:

“While it is great that three out of five organizations are now prototyping new ciphers, time is running out for post-quantum readiness. The timelines are tight for deployment, and unfortunately, not preparing could leave your critical data exposed.”

And with each passing moment, the race becomes more difficult due to legacy systems, technical debt, and development trade-offs between security and innovation.

🧠 Final Thoughts: The Security Race No One Can Afford to Lose.

The overarching takeaway from the Thales 2025 Data Threat Report is this: the future of cybersecurity is being shaped by forces that didn’t exist as little as two years ago:

AI is no longer a novelty – it is now a strategic asset and a strategic risk.
Quantum computing isn’t here, but the shadows of it are dictating today’s encryption decisions.
Data is now the most valued – and most vulnerable – resource organizations have.

Organizations looking to be leaders of the next digital decade can’t just deploy the latest technology – they must secure it. And that requires building strong, built-for-change, future-proof cybersecurity frameworks against the current day threats and those of tomorrow that we don’t yet know.

The world is moving fast. Will your data defenses keep pace, or will they fall victim to the dust created by progress?