Jaya Baloo, COO and CISO at AISLE, tells Sean Martin at ISC2 Security Congress why fixating on a quantum date is a mistake, and how AI makes the timeline less certain. Listeners get concrete first steps on AI.
Everyone wants a date. If quantum computing is far enough away, the quantum work can wait, along with the backlog and the outdated asset inventory. Jaya Baloo says that comfort is the problem.
Sean Martin talks with Jaya Baloo, COO & CISO at AISLE, after her afternoon keynote at ISC2 Security Congress in Denver. Baloo has worked on quantum for years, including the EU Quantum Flagship, which organizes the field into four pillars: computing, communication, simulation, and sensing and metrology.
The conversation turns to her keynote message: stop fixating on numbers and artificial boundaries, and do not say you have until 2029. Baloo says AI is an accelerant to a potential break of RSA, which is why she urges people to keep marching forward, potentially at a faster clip. Sean raises the usual excuses, a backlog of old systems and a configuration management database that is not current. Baloo's reply is that ignoring them will not bring the database up to date.
They also cover why teams put the urgent ahead of the important, and whether not understanding AI or quantum excuses inaction. Baloo says it does not, and offers starting points: security protections on open-weight models, knowing what a frontier large language model is authorized to do, hunting shadow AI usage, an AI asset register, and visibility into third-party suppliers already using AI. She also says waiting for governments will be too little, too late, and closes on observability for AI systems.
For security leaders, the takeaway is a place to start now rather than a year to wait for.
Read the full story on ITSPmagazine: https://www.itspmagazine.com/blog?p=waiting-for-q-day-is-the-wrong-plan-and-ai-removes-the-date
ISO/IEC 42001:2023 - AI management systems | https://www.iso.org/standard/42001
Quantum Flagship (EU) | https://qt.eu/
Dr Jaya Baloo
Recorded 2026-11-05
With Jaya Baloo, COO & CISO at AISLE; Sean Martin, Co-Founder & CTO at ITSPmagazine
Times are in the published episode: the conversation starts at 00:00:47, after the front bumper.
[00:00:47] Jaya - 10-26-2026_14-57-24_A: Here That's so cool. A friend of mine sent me a whole bunch of images of the, of the talk Oh, yeah so that's- fantastic. that's- a good backdrop. ? It's a good backdrop to have. Yeah So, t- is this in the way? No. I can move this behind. From, kinda like from here. Okay. Okay. Yeah. I think the hand- Okay... might be seen, but- Okay. Should I lean back or lean forward? However you're comfortable. Okay. Okay. This is good. Okay. You can be relaxed. Mm-hmm. yeah. So let's just have some fun. Okay. Let's enlighten people- Mm-hmm... myself included. these tidal waves of technology that keep lashing at us- Mm... we have, For some reason, a sort of amnesia collectively in our community that we don't remember the lessons that we just learned from the previous tidal wave I wonder what that is. Is it we get s- we get distracted by the shiny, or- Or the new... or the n- I think the new presents itself- Yeah... in such a way that we think everything- Is it a Generational thing? is different now. Perhaps. Yeah. Potentially. But there is that notion of those who do not remember their history are doomed to repeat it. Exactly. You see that happening All right. Here we are. Dr. Jaya Baloo. How are you? Good. So good to see you. We met last night for the first time- Mm-hmm at the, What was it, the 50 by 50- Mm-hmm event from the Center for Cyber Safety and Education. Yeah. I s- I call it ISC2. Scott keeps correcting me. I said, "But that's what I called it 20 some years ago." What is it called? It's ISC2. Oh, ISC2. I also say ISC2. Yeah. Yeah. I don't know. Yeah. That's what it, that's what it was when I got my cert back in the day, so anyway. Exactly, me too. What's your cert number? Do You remember I'm 4053... I don't know. Something in the 40,000. I'm 30509. There you go. Something like that. Yeah. Yeah. Ear- early days. Early days. I think I was, I think I was one of the early marketing people, 'cause I was in marketing at the time. Yeah. So fun times. I remember being, like, so impressed that there was like, you know, 29,900- Right.... people before me. I was like, "Wow, that's a lot of people a lot of people. Yeah. A lot of people. I don't even know, I haven't asked them what the number is now. Yeah. Yeah. And well, hopefully people are keeping their certification up. and, and more importantly, keeping the learning up, Mm-hmm. Which is what, for me, it's what this conference is all about. So if you haven't figured it out, Sean Martin here. We're live from, from Denver, the ISC2 Security Congress. And, if you watched the other episodes, you know this is my first one. I've n- I've not been to a congress before- Oh after all these decades of, being a member and, Whatnot. But it's it's a very good conference. A lot of good people here. They made some good decisions on speakers. You did the afternoon keynote today, and, I presume it went very well. I got a lot of good feedback. There you go. I think that's great. Yeah. They said you had a trail of fans following you over to- Just a couple people... on your way over... who was by. Maybe, maybe, a few words on, Some of the things you've worked on. Rapid7 was probably a big part of what you're involved with, but I'm sure there are other interesting things there that, Yeah... folks should know. So, I, started like, the-- I mean, I've been working in information security a very long time, and, France Telecom- KPN...uh, also Verizon.
[00:03:47] But my first CISO job was with KPN in 2012. after they were, Hacked, they were searching for a new CISO, so I became, The CISO at KPN. It meant, you know, really getting security back to where it should be at this incumbent national operator. And I went from there to Avast after seven years...uh, because I just wanted to find bad guys, you know. disrupt malware operators and, hunt APTs. And the week before I started at Avast, they were hacked by the Chinese state. so interesting times-... as one says. And then from there, I went, from, Avast to Rapid7. Nice. So for two years, so, Which was wonderful because they're such an amazing organization. and they have such great people So you know, and also, like, there were really, also folks who do really amazing things in terms of research, and they had Metasploit and Velociraptor, The really great tools as well. And from there, My former CEO, W- who I worked with at Avast, he had just done the post-merger integration 'cause we sold Avast to Norton, and he called and said, "Hey, I wanna do a startup." Mm-hmm. And I was like, "Oh, my God. that's so much fun. You know. let's do this together." And it was myself and him and one other co-founder. We started AISLE, Right... In 2024, and after a year we came out of stealth, With our product. And then a year later we've been acquired by an AI company called Cohere-... In Canada. Okay. So it's super exciting, Yeah. and that's literally just a few weeks ago we made the announcement, so actually October 16th. So for- Yeah. Yeah. There you go. Yeah. This is- Yeah... not that long ago. No. I was gonna... I hadn't heard that news. I'm sorry. That's all right. It's good. Yeah, we've had a few, uh-... few folks on from your team to talk about what you're up to. So a great journey. Obviously, AI a big part of what you're focused on now. Yes. But your talk also, Covers quantum- Yes... which I think, I'm starting to see the topic come up quite a bit. Yeah. And I'm just wondering how... W- what's the state of the union there? Let's start with the quantum piece first. Yeah, sure. What's the state of the union with that? Well, so I've been talking about quantum for ages. Yeah. I think the earliest talks I did on quantum, Tho- they go all the way back to DEF CON 13 when I was talking about lawful interception. And really, it's, it started for me back then because this notion was, you know, if it's on the line, we can intercept it, and subsequently, if there is any encryption applied, it's a challenge for the authorities to try to figure out how decryption would occur. And so I was challenged, After one of these talks that I gave in Switzerland saying, "But what if it cannot be intercepted and cannot be decrypted?" I was like, "Well, that's not true." I mean, eventually there is a mechanism. It doesn't have to actually break the cryptography itself, but there's an alternative mechanism which could actually allow you to do both the interception and the decryption. And I was introduced after that talk, it was at the Geneva Press Club, to ID Quantique, which was a Swiss company Mm actually setting up quantum key distribution, Network links, and at the time they were still running out of the university, and it became a significant player in this realm. so This is so far back. This is like we're talking pre-2006, you know, so I don't even know, maybe it was 2004 or something like that, or 2003. That, that's how long- Right...I've been thinking about quantum and its implications. And it started for me really with this quantum communication story and quantum key distribution, and then really understanding the evolution of what that meant for quantum computing- Mm and the challenges to factoring, RSA. it goes way back. Right. Yeah. And really like, If you really look at the timeline, folks have been busy with this- Right...for a very long time. And one of the biggest detractors that people will say about quantum is that the computer is coming every time like, in another decade, Right. you know? Like, there's always a decade r- round, like push to, yeah, in the next decade. Right. But I actually don't think it's 100% fair because if you look, there's just such amazing things being built Mm...and accomplished now already, If you also look not just in quantum computing, but also in what people are building in sensors and metrology. Mm-hmm. There's also an entire industry there. So I really think we need to con- consider quantum technologies in its entirety Mm and not just focus on computing, By itself. And I've been so lucky to have been part of the EU Quantum Flagship, which is covering all of these pillars, and I did that for many years. We also built the first quantum key distribution link in the Netherlands between, The Hague and Rotterdam. Yeah. Two different data centers. Mm-hmm. And it was just before they set up the Quantum High Level Steering Committee to determine this Quantum Flagship of a billion euros. So it's just been very privileged, very lucky Yeah...to work on this. And we also built, back in the day, the first post-quantum VPN on WireGuard. There you go. Yeah. There you go. You've been doing this for a while. For a while. For a while. Can you, can you paint... You mentioned pillars, and you kinda said the, all the elements of quantum, not just compute. I'll put you on the spot. Sure. Can you maybe describe that for folks so they have a- Yeah... have a sense of what that is? Yeah. Excuse me. It's okay. It's great. When we talk about quantum, we talk about really this notion that it's quantum technologies. The first quantum revolution happened with Niels Bohr, you know, and this understanding of what these subatomic particles are, the interactions between them, how do we define them, how do we talk about the interactions? And really we talk about the, Solvay Conference that happened with Bohr and Einstein and Curie and all kinds of other amazing folk. But I feel like we're at the cusp of the next quantum revolution where we actually see some of this i- in applied science, Mm. and we actually are looking at things like entanglement at potentially scale and trying to understand how these interactions can be better explained and observed and also be used for meaningful things like computation. And, what's really interesting is if we look at, for example, the EU Quantum Flagship, they've done a really good organization of how we should look at quantum technologies, and they've done that by creating four pillars of work. The first pillar is quantum compute, Mm. so quantum computation, you know, all of the things building around a quantum computer. Then there is, quantum communication, Mm. so basically building networks that have quantum properties between these nodes and through, like, conne- basically connect also- Mm-hmm quantum computers to each other, but also traditional, Network Technologies to each other, And then, you have this area of quantum simulation, so simulating quantum processes. And then you have the final area of sensing and metrology, which is developing, uh- It new tools that will allow us to measure things- Mm In a more accurate way using quantum properties. So everything from quantum clocks, but also gravity meters to measure specific gravity. So there's all different types of sensor tech happening here. Mm. And, this is also fascinating- Yeah work. It is And I think that if we think about those four pillars, they have to be supported by both fundamental research... So There's a lot of things that we're building that we don't actually 100% understand, like, how it works. It just does. Mm-hmm. So observationally, we see things happening. but We don't really know like, the underlying effects, why it's happening, how it's happening. Yeah. So there's this area of fundamental research and, you know, like to actually build some of this stuff, there's quite a bit of engineering ingenuity, stuff that's still being discovered as we're building it. So we're building it, Right...but you have to kind of overcome all these engineering challenges Mm... to build it. So there's that as well. and They go kind of horizontal across all of these Vertical pillars. It reminds me a little bit of How I feel working with AI, and then I'm gonna use this as a segue to connect AI to what you're, what you're talking about, and, Perhaps what you talked about in the in the keynote as well. 'Cause I feel that as I'm doing things, it's learning. Mm-hmm. Becoming smarter, and I'm learning and becoming smarter, and it's kind of progressing. Yes. I'm becoming faster, it's becoming faster, more proficient, more proficient. Mm-hmm. New, clever ways of doing things. And I'm just wondering the connection to... I don't- Does quantum have that same property. Um- And/or the... what does a connection-... of AI in the quantum sphere? So I mentioned it a little bit in my talk. Uh-huh. I think the ability to merge some things in quantum with AI is genuinely a beneficial and interesting merge. For sure. But the question is, to do what? And I think what you saw from an evidence point of view is that, for example, Microsoft used AI to build a better chip- Mm-hmm...for Majorana. And that is a really interesting thing if a- actually we can use AI to help us distill some of these challenges and propose new solutions. From an engineering perspective, I think that's an amazing accomplishment, just that But you see that there's much more of this, Quantum AI co-mingling, and it could be that eventually the hardware on which more advanced AI systems will run in the future will be one that is inherently a quantum...architecture. potentially. but the... there is definitely much more cross-mingling between quantum and AI, and I think the leading research are places like Google and Microsoft and IBM, Who are way more actively- ...doing this. My only worry here too is because we know that this is a race, like so many other things, that maybe some of the most fundamental breakthroughs are not those that are shared in the open domain. Mm-hmm. So we might not know what- No... what's what yet. No. . Yeah. Yeah. Interesting. fair to say you're a researcher at heart? I mean, I love to learn. Yeah. I think at heart I'm just continuously asking questions and wanting to learn, Yeah. and I don't think that'll stop anytime soon. Do You see yourself as a futurist? you know, I think I'm just like a... I feel like I know a thing- Mm...and I feel like it's never enough, and I always am con- conscious of how much I don't know. And so I think I'm just an insecure, curious person. So I think I'm just so conscious. Well, that makes sense. There's so much to learn, there's so much to know, Yeah. and I know so little about all of these things. And so I just, like I see the enormous amounts of stuff I wanna learn, and I just keep thinking there's not enough time. So I asked those two questions, To lead to the catalyst for the keynote today? ' Cause some keynotes are big-picture futurist. Here's, here's all the big philosophical things you need to care about, and then there's a lot of research. Of course, there's stuff in between, too, but I feel the keynotes usually tackle
[00:15:47] one end or the other. So I'm wondering how, what the catalyst was for you for AI and quantum and this particular community and the talk that you gave today. So I find it difficult sometimes to not talk about things that are lived experience. Mm. I find it difficult to do that. So of course I can research and talk about things that are slightly adjacent, To what I'm working on, but usually I don't. Usually I prefer the safe ground of talking about things that I actually know something about. It just feels like safe territory, especially if you are getting asked questions about those things. I think you should be able to have, like, solid, well-thought-out answers. So I think I did a little bit of both of those things. Mm. try to present big picture but also very narrow information on what to do next about those things. I weaved in and out between futurist to a more narrow researcher. And, again, I really feel
[00:16:47] compelled to say one of the biggest dilemmas we have is our field is moving incredibly fast. And cybersecurity is one of these transversal themes across- Mm... quantum, across AI, across the next wave of, you know, future technologies that we will be embracing. I feel somehow though, as we have these, these tidal waves of technology that keep lashing at us- Mm... we have, For some reason, a sort of amnesia collectively in our community that we don't remember the lessons that we just learned from the previous tidal wave I wonder what that is. Is it we get s- we get distracted by the shiny, or- Or the new... or the n- I think the new presents itself- Yeah... in such a way that we think everything- Is it a Generational thing? is different now. Perhaps. Yeah. Potentially. But there is that notion of those who do not remember their history are doomed to repeat it. Exactly. You see that happening Yeah. Yeah. So what was the what was the main objective with today's conversation? Well, I wanted to have that kind of notion of we know what to do, now we just need to get it done. Mm-hmm. Very much embedded in the AI question as well as the quantum question. And with the quantum question, because it does seem less imminent to a lot of people that I speak to urge them on the side of caution and to keep marching forward, and potentially at a faster clip, because AI is an accelerant to a potential break of RSA, or either from a mathematical perspective. So really, like the point was, don't wait for a quantum computer or Q day- Right...as we call it. We sh- stop fixating on these numbers and these artificial boundaries and genuinely think like how quickly can we understand And be prepared. Mm-hmm. and not say, "Oh, I have until 2029." You know, there is this, um- 'Cause we all like what's going on with PHP, right? Let's just- For example... yeah, let's just, yeah. Yeah. I have plenty- On a big scale, yeah...of backlog to... Exactly. I have plenty of old stuff to take care of. My CMDB isn't up to date. I'm sure it isn't. Yeah. It won't necessarily be up more up to date if you ignore these things too. We tend to prioritize things that are urgent Mm-hmm over those things that are important. We do it over and over again, and this is like that tidal wave thing. It's so dumb. I don't understand why we do it. Like, we know that that next important thing is gonna be the next urgent thing, Mm...so why not just get it done? So yeah, it's like talking to my 14-year-old. How many? 4,000 of them- Yeah.... sitting in, -sitting in the audience. Um- What... I'm sure if they followed you over, I'm sure they, Came to you on the stage. Yeah. What kind of questions, did people ask? Yeah. well, to be honest, like, the questions that I got over here were a lot of people just kind of telling me their thor- thoughts on the issue. Mm-hmm. There was- Everybody has an, everybody has a thought? Yeah, I think they wanted to convey, like how they were seeing it. Mm-hmm. and I think that's useful. I mean, I think people are still processing what they really think, and sometimes it helps to talk about it. I do think we need to have A lessening of the boundary conditions in which people can engage in this kind of conversation 'cause you see that traditional cybersecurity folks are kind of wary of the AI safety portion of this and about what they don't or do know there. So I would encourage us to do a lot more of that talking, because it certainly isn't the case that you're gonna learn it without either, A, doing it and experimenting on your own or talking about it with someone who has already done that. And there is a bridge to gap. Right. Like, I don't think we can-- Like, I, yes, we do know for a large part what we need to do from a cybersecurity perspective, but you can't arbitrarily apply everything one-to-one- Mm-hmm...from an AI safety- one. Does a lack of understanding... There we go. They really like our conversation over here. Quantum is hard to grasp. Mm-hmm. AI potentially maybe less so now, I don't know. is the lack of understanding an excuse for inaction? Is there a way to get around n- not knowing what it is and still do something meaningful? Look, there's a certain degree of keep calm and carry on that I think would apply for if you kn- know. But I actually don't think there's an excuse for us not to know. You'd have to have a remarkable ostrich- Mm-hmm... buried head in sand practice to not know. There's, there's awareness- Yeah... but then enough to- Yeah... actually do something. Again, most CISOs or security people are Yeah...working, you know, at the behest of their boards, And I'm sure their boards and their C-level And everyone else is asking them about what to do about frontier LLMs- Yeah which kind of things they should adopt, you know, token maxing
[00:21:47] potentially. Yeah. And So we really need to have a more appropriate response than just, This brand-new shiny object- Right... and then we shall make new rule. Like, so I really think we do need some level of adeptness with it and Appetite for change. How do we get that? Yeah. So I really think it starts with, okay, if I am, you know, playing with an open-weight model, how do I actually have security protections in place? If I'm using a frontier LLM, how do I know what it's authorized to do? If I, hunt for, like my intellectual property, let's make sure about the shadow AI usage You know, there is an ISO certification for AI that you could also theoretically also achieve if you're doing or building with AI. I think those are real ways to make sure you have an i-- an asset register for AI, and you know what you're doing, and you understand the supply chain of those AI systems, know what third-party components you're using. And also, the traditional TPRM partners we've always had are also using AI. We just have no idea how. Right. So I think that, you know, as long as we're allowing them to process critical information from us, we better know. Mm. Like, this is not new. W- We've, always managed third-party vendors in this way. We just don't manage them effectively when it comes to AI. Mm. We should. I often used to ask the question will government save us? I don't, I don't know that that's- I think there's a speed- Yeah...challenge there So- I think waiting for governments to save us will be too little too late. Right. So I think if we don't step up... And again, this goes back, this is like a lesson from history. Like a lot of the challenges that we had with early internet and how we fixed internet governance- Mm wasn't done by any government. Right. It was done by like-minded individuals Mm...who understood the challenges ahead and potential solutions, Right...and figured out we need to work
[00:23:47] together to do this. and which led me to, well, if the government isn't gonna save us, who will? And I always, my next one was the telcos, funny enough- Right 'cause you were a tel- Yeah... and they, obviously a lot of those were involved with- Yeah... securing the internet, so. I don't think there are singular parties, and I think there's no... Okay. Yeah. And I think also here with AI, we see a lot of business drivers, which we've always seen, by the way, also not new, right? Mm-hmm. That propel AI communities to move in a particular direction, whether it's Frontier Labs being worry of open- Mm... Weight model providers, And saying, "Hmm, " Should you really want, like, your stuff going to these other model prov-" So I think that there is a lot of geopolitical tension as well as, competitive landscape business tension when it comes to the AI debate. And that's not, it's not easy then for- Right... government intervention to happen as easily as it could if it wasn't there. So I'll close with this, and feel free if I didn't touch on something
[00:24:47] you wanna, you wanna say, you can do that of course. Mm-hmm. is there one big thing you're looking toward either you're participating or you're leading some activity I don't know, at an international level or from a commercial- Yeah perspective, whatever, that you think What's the next big thing, I guess, that you're working on that you think is gonna have a meaningful impact? So again, like I... During my talk, I talked about the fact that we have sometimes really weird things happening with this AI debate from the anthropomorphism- Mm that we do with AI systems to some of the emerging discussions about sentience and consciousness and They're genuinely interesting, but I think that our biggest challenge as a community is better understanding the systems that we already have and deploy. So the observability- Mm... around these AI systems is one that I don't think we're done with yet, especially when we see things where there's a divergence from our goals to versus to what the AI- Mm actually does, this misalignment that's there. You know, a lot of cynics will say misalignment is just a term folks use when they don't take the responsibility to control their AI models. I would disagree. There is actually genuinely something happening there that we don't fully understand. Mm. And I would love for us to have the tooling in place in order to be able to understand and potentially correct when something does not do what we think it's gonna do. Be able to peek in the black box. Yes. Mm. Very cool. Very cool. Well, I want to chat for hours, but we don't have hours. Yeah. No, thank you. It was a pleasure. So good to meet you and chat with you, and, Yeah, I'll be following all the fun stuff you're working on, and, And congratulations on the acquisition and the keynote today. Yeah. Thank you. And thanks everybody for, listening and watching. Lots more coming to you here from ISC2 Security Congress in Denver. Mm-hmm. stay tuned itspmagazine.com. Thank you all Thank you Thank you so much That was very relaxed chill. Chill. Hopefully- Sorry... hopefully fun. Nah, I'm all right. It's all good. I can-... I can do those edits, no problem. Let's grab, ... Did We didn't get a selfie yesterday, I don't think. Mm-mm.