On October 15, 2025, global security technology company Thales Group published the "2025 Data Threat Report: Critical Infrastructure Edition", based on an S&P Global Market Intelligence survey of 500 global critical infrastructure security leaders, and for the first time identified rapid changes in the AI ecosystem and quantum computing risks as primary security challenges. The report notes that across energy, communications, transport and healthcare, 73% of respondents view the "rapidly changing AI ecosystem" as the most significant current security threat, while 63% expressed high concern about "future quantum computing breaking encryption mechanisms." Wired reported that the report signals AI's shift from efficiency tool to systemic risk source, particularly in highly networked, real‑time infrastructure environments where AI's potential to cause disruption has surpassed traditional threats.
As a global leader in encryption and data protection, Thales produced this special edition of its annual series to focus on the unique risks to critical infrastructure (CI). Australian Cyber Security Magazine emphasized that the report reveals a dual shock from AI and quantum computing that is driving the industry from passive defense toward active investment. As of October 21, 2025, the report has prompted broad responses from international organizations and companies calling for strengthened AI security research and regulatory frameworks.
AI risk shift: from tool to systemic threat
The report's core finding is that the rapid evolution of the AI ecosystem has become the top security challenge for critical infrastructure. Seventy‑three percent of respondents said the spread of generative AI (GenAI) and changes in its ecosystem have created unprecedented risks, a proportion far higher than concerns over traditional cyberattacks or data breaches. A Thales press release explained that AI is shifting from an "efficiency tool" to a "systemic risk source", and in highly networked environments AI could be used to generate false data, manipulate control systems or amplify cyberattacks. The report gives examples: in the energy sector AI algorithms could falsify sensor data leading to grid failures; in transportation, AI‑generated false signals could trigger large‑scale accidents.
On the technical side, the report identifies AI risks as stemming mainly from model integrity issues and lack of trustworthiness of third‑party data. The black‑box nature of generative AI makes it difficult for infrastructure operators to verify algorithm outputs, leaving potential vulnerabilities open to malicious exploitation. Chosun Daily reported that 74% of participants have begun heavy investment in GenAI‑specific security tools, such as AI firewalls and model auditing software, to address these threats. Thales' survey shows AI adoption in critical infrastructure reached 85%, but only 40% have mature security frameworks, highlighting regulatory lag. The report calls for international standards focused on model integrity and data source verification to ensure AI's use in CI does not introduce new vulnerabilities.
Quantum computing concerns: potential catastrophic encryption breaks
Another focus of the report is quantum computing risk: 63% of respondents are worried about its ability to undermine existing encryption mechanisms. Thales' press release emphasizes that quantum computers could use Shor's algorithm to break public‑key cryptography such as RSA and ECC in minutes, and these algorithms are widely used for data transmission and authentication in critical infrastructure. The report predicts that by 2030 quantum attacks could increase the global CI data breach rate by 50%.
On a technical level, the report analyzes the "harvest now, decrypt later" strategy: attackers currently steal encrypted data and decrypt it once quantum technology matures. This poses a long‑term threat to communications and financial infrastructure. Australian Cyber Security Magazine noted that 73% of energy operators have already included quantum risk in their five‑year plans. Thales recommends adopting quantum‑safe encryption (such as the Kyber algorithm), but only 25% of respondents have implemented it, underscoring inadequate preparedness.
Industry response: investing in security tools and calling for regulation
Facing the dual threat, critical infrastructure operators have begun taking action. The report shows 74% of participants invest in GenAI‑specific security tools, such as Thales' CipherTrust platform, to monitor AI models and data flows. Chosun Daily reported that 80% of companies in the telecom sector have adopted AI firewalls, while the energy sector is focusing on quantum encryption migration.
The report calls for strengthened AI security research and regulatory frameworks: model integrity verification and third‑party data trust audits are central. Thales suggests establishing a global CI AI standard similar to the NIST framework. The EU has responded and plans to update the AI Act in 2026 to cover CI risks.
Global impact: cascading effects of AI and quantum risks
The report's influence has spread worldwide. Data Centre Solutions reported CI security investment is expected to grow 25% in 2025 to reach $150 billion. This shift is driving AI from a peripheral tool into core systems, but also increasing risk. Discussions on X show industry leaders calling for international cooperation.
Conclusion: the urgency of balancing innovation with security
The Thales report warns that AI and quantum risks have become the top security challenges for critical infrastructure (CI). The industry must accelerate investment in tools and regulation to shore up the digital foundation. Going forward, AI security research will be critical, driving a shift from reactive responses to proactive prevention.
Report link: Critical Infrastructure 2025 Thales Data Threat Report