You Don’t Need to Be a Cryptographer to Start Preparing for Post Quantum Security

An AI assistant connected to internal data starts returning information it shouldn’t reveal. What does the incident responder collect first? Traditional evidence still matters, but the investigation may also require prompts, model outputs, retrieval sources, system instructions, access permissions and records of actions taken through connected tools. Disabling an endpoint won’t necessarily answer what the model accessed or what information it produced. Recent workforce data suggests many teams haven’t rehearsed that situation. ISACA’s 2026 State of Cybersecurity research, based on more than 1,800 cybersecurity professionals globally, found that only 8% of organizations regularly conduct AI specific response exercises. The same research found that 45% see LLM SecOps as a skills gap, up 12 percentage points from 2025 and 21 points from 2024. ISACA [https://www.isaca.org/about-us/newsroom/press-releases/2026/only-8-percent-of-organizations-global-enterprises-conduct-regular-ai-specific-response-exercises?utm_source=chatgpt.com] AI security is becoming operational work rather quickly. AI CHANGES THE EVIDENCE NIST convened an AI Incident Management Workshop in May because a new class of incidents is emerging as AI systems become embedded in critical infrastructure, cybersecurity and other operational environments. Its work covers incident definitions, lifecycles, taxonomies, existing playbooks

Imagine two SOC analysts who both list incident response as a skill. One can follow a documented investigation procedure, collect evidence and escalate a suspicious event. The other can investigate an unfamiliar attack, correlate evidence across systems, challenge the initial hypothesis and guide colleagues through containment. Both legitimately have incident response skills. They clearly shouldn’t be described as having the same level of capability. ENISA is addressing exactly this problem in its ongoing revision of the European Cybersecurity Skills Framework. The current ECSF organizes cybersecurity work into 12 professional role profiles, covering responsibilities, skills, knowledge and relationships between roles. The revised framework will add proficiency levels to support workforce assessment, career development and training pathways. ENISA [https://www.enisa.europa.eu/press-office/press-and-media/european-cybersecurity-skills-framework-ecsf?utm_source=chatgpt.com] That seemingly small addition could change how organizations think about the skills gap. A SKILL LIST TELLS YOU WHAT. A LEVEL TELLS YOU HOW FAR. Consider penetration testing. A beginner might understand reconnaissance, use established testing methods and reproduce common vulnerabilities in a controlled environment. Someone further along should be able to choose an appropriate methodology, adapt testing to

Indonesia needs more cybersecurity professionals. That part is obvious. What is becoming less obvious is whether the real problem is still about numbers. The 2026 SANS | GIAC Cybersecurity Workforce Research Report found that 60% of surveyed organizations said their teams lacked the right skills to defend against current threats. More concerning, 27% reported breaches directly linked to capability gaps. That changes the conversation. A company can have a security team, a dashboard full of alerts and a stack of expensive tools. The harder question is whether the people behind them know what to do when something unusual happens. CYBERSECURITY WORK IS MOVING FAST Artificial intelligence is making that question harder. AI can already help with alert analysis, vulnerability prioritization and repetitive investigation tasks. Attackers can use the same technology to make attacks faster and easier to scale. In August 2026, Vice Minister of Communication and Digital Affairs Nezar Patria warned that agentic AI could allow cyberattacks to operate with less direct human involvement. He also highlighted threats such as harvest