1. As AI Enters Enterprise Workflows, a New Governance Target Emerges

AI is rapidly becoming part of everyday enterprise operations, from data processing and content generation to system queries, automated actions, and workflow collaboration. Its role has already moved well beyond simply providing recommendations. As AI agents begin accessing enterprise systems, reading data, calling APIs, and even performing tasks on behalf of users, enterprises must govern a new class of digital actors with the ability to take real action.

This creates a new set of governance questions: Who created each AI agent, who is accountable for it, what data can it access, and what actions is it permitted to perform? Common risks include unauthorized or unmanaged shadow AI agents, unclear identity and accountability, excessive privileges, anomalous access to sensitive data, API calls, and unintended actions.

As AI agents enter the enterprise, a new governance target emerges. (AI-generated conceptual illustration; not an actual product interface or customer data.)

For enterprises, the real challenge is that an AI agent's privileges and behavior can change continuously as its tasks evolve. In the past, once an account signed in to a system, enterprises could generally determine what it was allowed to do based on its identity, role, and permissions. When an AI agent connects to models, prompts, APIs, MCP, tools, and enterprise data sources at the same time, however, a single task may cross multiple systems and authorization boundaries. Enterprises must therefore go beyond confirming who signed in. They must continuously understand who is acting on whose behalf, what privileges are currently available, and whether actual behavior remains consistent with the original authorized purpose.

The more deeply AI is integrated into enterprise operations, the more enterprises need to reconsider how trust should be established. As AI gains greater autonomy, cybersecurity governance must extend beyond managing accounts and devices to cover AI identities, privileges, and behavior.

2. Beyond AI Agents: Post-Quantum Risks Put Existing Encryption and Certificates to the Test

If AI agents introduce new challenges in identity and access governance, the post-quantum era challenges the encryption and certificate-based trust that enterprises have long relied on. As quantum computing continues to advance, enterprises are beginning to ask whether the cryptographic mechanisms used today to protect data, verify identities, and establish secure connections will remain reliable in the future.

One frequently discussed risk is Harvest Now, Decrypt Later. Attackers may intercept and retain sensitive data that cannot currently be decrypted, then attempt to decrypt it once quantum computing becomes sufficiently capable. Digital signatures and certificates present another concern. If existing cryptographic mechanisms are compromised, the foundation of trust used to authenticate devices, services, and identities could also be affected.

In the post-quantum era, enterprises must first gain visibility into their cryptographic assets. (AI-generated conceptual illustration; not an actual product interface or customer data.)

For enterprises, the real challenge is often not simply whether to migrate to PQC, but whether they know which systems currently use which algorithms, certificates, and keys—and which assets should be migrated first. Without visibility into cryptographic assets, it becomes difficult to prioritize risks for PQC migration, especially when legacy equipment and vendor support impose additional constraints.

The core issue introduced by the post-quantum era is therefore similar to the challenge posed by AI agents: enterprises must first understand what they are trusting before they can determine whether that trust remains secure or needs to be adjusted.

3. From Stopping a Single Attack to Continuously Verifying Trustworthiness

As AI agents gain the ability to take action and existing encryption and certificates face post-quantum challenges, enterprise cybersecurity must address more than isolated incidents. It must continuously determine whether devices, identities, privileges, connections, and behavior remain trustworthy.

This is shifting cybersecurity governance from one-time verification to continuous trust assessment. In addition to deciding whether a device or identity may access a system, enterprises must continuously monitor subsequent changes: whether privileges remain appropriate, whether connections are anomalous, whether devices have developed vulnerabilities, and whether an AI agent is performing actions beyond the scope of its original task.

From visibility to continuous trust governance. (AI-generated conceptual illustration; not an actual product interface or customer data.)

Enterprises must therefore establish sufficient visibility to continuously understand their assets, identities, and behavior. They can then govern and assess trust according to risk, taking measures such as restriction, isolation, or blocking when necessary. In the AI and post-quantum era, trust can no longer be established once and assumed indefinitely; it must be continuously verified as devices, identities, privileges, and risks change.

4. UPAS Builds the Device Governance Foundation with NAC and ITAM, Then Extends Trust Governance to AI and PQC

To address the new governance requirements introduced by AI agents and the post-quantum era, UPAS begins with the most fundamental layer: enterprise device governance. The reason is straightforward. If an enterprise cannot continuously identify which devices are on its network, who is using them, whether they are authorized, and whether they currently meet security requirements, it will also lack a complete basis for determining whether AI, identities, or cryptographic assets can be trusted.

NAC and ITAM address these two layers. UPAS NAC first identifies who and what is on the network. Through device discovery, identity correlation, and network access control, it verifies whether devices are authorized and comply with established policies. ITAM then tracks device status after network access, including asset inventory, vulnerability remediation, configuration, Active Directory information, and day-to-day operations. By integrating the two, enterprises can continuously evaluate device identity, network access, and security status within a unified governance framework.

This foundation also directly supports AI and PQC governance. Governing an AI agent requires enterprises to know who created it, which models and APIs it uses, which systems and data it connects to, and how its identity, privileges, and behavior change over time. PQC migration requires visibility into devices, algorithms, certificates, keys, and software dependencies before enterprises can assess risk and prioritize migration. In other words, although the new governance targets differ, they all rely on the same underlying approach: inventory first, identify next, and verify continuously.

UPAS extends the foundation of trust from device governance to AI and PQC. (AI-generated conceptual illustration; not an actual product interface or customer data.)

UPAS therefore uses NAC and ITAM to establish device visibility and continuous governance, then progressively extends that foundation to the dynamic governance of AI agents, PQC, and OT, IoT, and IoMT environments. This enables enterprise trust management to evolve from determining whether devices are trustworthy to assessing whether AI can be trusted and whether cryptographic mechanisms remain secure.

5. In the AI and Post-Quantum Era, Enterprises Must Upgrade How They Establish Trust

AI agents introduce a new class of digital actors capable of operating autonomously, while post-quantum risks challenge the foundations of existing encryption and certificates. Although the two may appear different, they ultimately lead to the same question: Does the enterprise know whom and what it is trusting, and does that trust still hold?

Future cybersecurity governance must therefore do more than block attacks. It must continuously track devices, identities, privileges, behavior, and asset status so that trust can be reassessed as the environment changes.

Technology will continue to change, but the starting point of governance remains the same: first gain visibility, then understand, and only then establish trust that can be sustained over time.