Cyber 2040: the next wave of security
The cybersecurity you learn in 2026 will keep changing for the next fifteen years. Three shifts are already underway. First, today's public-key cryptography is being replaced, and NIST has published the first post-quantum standards. Second, AI systems and AI agents are now things we have to defend, not just tools we use to defend. Third, security has moved off the laptop and into factories, power grids, cars, satellites and the code supply chain behind all of them. This is the E: Emerging threats page of SHIELD 2040. It gives you a plain-English map of each area, the official documents, and free ways to start learning. Everything linked here is free to read or free to take. "By 2040" is our own forward-looking framing: we point to what NIST's published frameworks and timelines suggest, and we always cite them. If you are brand new, start with Security Foundations first, then come back.
What you'll be able to do
Explain post-quantum cryptography
Say in plain words why quantum computers threaten today's encryption, and name the three finished NIST standards (FIPS 203, 204, 205) and what each one is for.
Read the migration timeline
Describe the dates in the NIST IR 8547 draft (deprecate after 2030, disallow after 2035) and why "crypto-agility" is the skill that makes any deadline manageable.
Name the attacks on AI
Use NIST's adversarial machine learning taxonomy and the OWASP Top 10 lists to describe prompt injection, data poisoning and excessive agency without jargon.
Think like a defender of AI agents
Apply least privilege, identity and human approval to an AI agent that can use tools, and know where MITRE ATLAS fits in.
Understand OT, ICS and IoT
Explain why a power plant or a smart thermostat needs different security thinking from an office laptop, and where NIST SP 800-82r3 and NISTIR 8259 help.
Trace a software supply chain
Explain SBOM, SLSA and the NIST SSDF, and read a simple dependency list the way an investigator reads a receipt.
1. Post-quantum cryptography
A large, error-corrected quantum computer could break the public-key math (RSA and elliptic curves) that protects websites, software updates and digital signatures today. Attackers can also record encrypted traffic now and decrypt it later ("harvest now, decrypt later"). NIST's answer is a new family of algorithms that run on ordinary computers but resist quantum attacks. Below is the status of each, as we verified it from NIST's own pages in October 2026.
| Standard | What it does | Status (verified) |
|---|
| FIPS 203 · ML-KEM | Key establishment (agreeing on a secret key). Derived from CRYSTALS-Kyber. | Final. NIST released its principal PQC standards in August 2024. |
| FIPS 204 · ML-DSA | Digital signatures. Derived from CRYSTALS-Dilithium. | Final (August 2024). |
| FIPS 205 · SLH-DSA | Hash-based digital signatures. Derived from SPHINCS+, a backup built on different math. | Final (August 2024). |
| FIPS 206 · FN-DSA | Compact digital signatures. Derived from Falcon. | In development. NIST's standardization page lists it as "in development" and we found no published draft. Check the NIST PQC project page for updates. |
| HQC (draft FIPS 207) | A second, code-based key-establishment method, as a backup to ML-KEM. | Selected March 11, 2025. Details are in NIST IR 8545. NIST presentations call the planned standard "FIPS 207"; we did not find a published draft, so treat it as not yet final. |
The NIST IR 8547 transition timeline
NIST IR 8547, Transition to Post-Quantum Cryptography Standards is an initial public draft (November 2024; comments closed January 10, 2025). We read the tables in the PDF ourselves (the web summary page does not show the dates): quantum-vulnerable signature and key-establishment algorithms such as RSA, ECDSA, EdDSA and Diffie-Hellman at the 112-bit security level would be deprecated after 2030 and disallowed after 2035, and those at 128 bits or more would be disallowed after 2035. The draft also cites the U.S. National Security Memorandum 10 goal of mitigating quantum risk by 2035. Because it is a draft, always check NIST's page for a final version before quoting dates in a report.
Read the IR 8547 PDF
NSA CNSA 2.0 (national security systems)
The NSA's Commercial National Security Algorithm Suite 2.0 sets a staged plan for U.S. national security systems. From NSA's 2022 advisory: software and firmware signing should move to CNSA 2.0 exclusively by 2030; web browsers, servers, cloud services and operating systems by 2033; and the full transition is expected by 2035. A later policy update (CNSSP 15) requires CNSA 2.0 algorithms in new national-security acquisitions from January 1, 2027. These dates apply to national security systems, not everyone, but many vendors use them as a planning guide. NSA's PDFs block automated checks, so we confirmed these dates through search results that quote them; read the NSA post-quantum resources page for the authoritative text.
NSA PQC resources
Want the quantum side too?
To learn how quantum computers actually work, and even to program one, follow our free QUBIT Quest path. Understanding the machine makes the threat (and the defense) much easier to picture.
Open QUBIT Quest
Free certificate for post-quantum cryptography? We could not confirm a free, official PQC certificate in October 2026. Learn from the NIST and CISA documents above and try the hands-on tools below; certificate not confirmed.
2. AI security and AI agents
Securing AI has two halves: protecting the AI system itself (its data, model and tools) and using AI safely. These official, free sources give you shared vocabulary. Start with the Microsoft path if you want a guided course.
Microsoft Learn · AI security fundamentals
Provider: Microsoft Learn. You earn: a module achievement on your Microsoft Learn profile for each of the 3 modules (AI security vs traditional security, AI security controls, introduction to AI security testing). Cost: Free course · About 3 hours (estimate) · Level: Beginner
Open the learning path
Microsoft · AI Red Teaming 101
Provider: Microsoft Security. You earn: practical know-how from a 10-episode video series on prompt injection, multi-turn attacks, defenses and the open-source PyRIT tool, with slides and hands-on labs (no certificate). Cost: Free course · About 5 hours (estimate) · Level: Intermediate
Watch the series
IBM SkillsBuild · free AI courses
Provider: IBM SkillsBuild. You earn: digital badges on many courses, each with an end-of-course assessment (check each course page; we did not verify an AI-security-specific badge). Cost: Free badge · About 6-10 hours (estimate) · Level: Beginner
Browse IBM AI courses
The frameworks to know (free to read)
- NIST AI Risk Management Framework (AI RMF 1.0): the voluntary framework to govern, map, measure and manage AI risk, with the AI RMF Playbook and a Generative AI Profile.
- NIST AI 100-2 E2025, Adversarial Machine Learning: A Taxonomy and Terminology (March 2025): names the attacks on predictive and generative AI (evasion, poisoning, privacy attacks, prompt injection and more) and the mitigations. A common language for everyone.
- OWASP Top 10 for LLM Applications 2025: ten risks led by prompt injection, sensitive information disclosure and supply chain, plus excessive agency and unbounded consumption.
- OWASP Top 10 for Agentic Applications for 2026: published December 9, 2025 by the OWASP GenAI Security Project with input from more than 100 experts; it covers risks of autonomous agents that plan and use tools.
- MITRE ATLAS: a knowledge base of real-world adversary tactics and techniques against AI systems, organized like MITRE ATT&CK.
- CISA: AI Data Security best practices and principles for securely integrating AI into operational technology.
- NIST SP 800-218A: secure software development practices for generative AI and dual-use foundation models (an SSDF community profile, July 2024).
Securing AI agents: four plain rules
Our own synthesis, drawn from the sources above and from zero trust thinking (see our Zero Trust page): (1) give every agent its own identity, never a shared admin key; (2) grant the minimum tools and data it needs, and no more ("excessive agency" is on the OWASP list); (3) treat everything the agent reads as untrusted input, which is what prompt injection exploits; (4) keep a human approval step for any action that spends money, deletes data or contacts people, and log what the agent did.
3. OT and ICS security
Operational technology (OT) runs physical things: water treatment, factories, power, pipelines. There, safety and uptime come first, so a "patch tonight" habit from IT can be dangerous. The NICE Framework added an OT Cybersecurity Engineering work role and an OT Security competency area, a sign of how fast this field is growing.
CISA · ICS Virtual Learning Portal (100W, 210W series, FRE2115)
Provider: CISA and Idaho National Laboratory. You earn: knowledge on 13 on-demand video courses: OPSEC for control systems (1 hour), eleven 210W modules (1.5 hours each) from ICS components to attack methods and defense in depth, and an ICS landscape course for managers (1 hour). No certificate confirmed. Cost: Free course · About 18 (estimate) · Level: Beginner to Intermediate
See the course list Register at the portal
CISA instructor-led ICS training
CISA also offers instructor-led ICS courses (such as ICS300 and ICS401 online sessions, and in-person training at Idaho National Laboratory). Dates change, so check ICS Training Available Through CISA for the current schedule and requirements. Certificate not confirmed.
Read: NIST SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security
NIST's September 2023 guide explains OT systems, typical threats, and how to apply security controls without breaking safety or availability. Read the introduction and the section on OT overlays first.
Open SP 800-82r3
Try it: CISA CSET
The Cyber Security Evaluation Tool (CSET) is a free assessment tool from CISA that walks you through questions about an environment and compares it to recognized standards. A fine practice exercise for a pretend factory. See download and install CSET.
Get CSET
4. IoT security
Billions of small connected devices (cameras, sensors, smart locks, medical monitors) are built by makers who may never have thought about security. NIST's IoT guidance tells device makers what to build in and tells buyers what to ask for.
- NISTIR 8259, Foundational Cybersecurity Activities for IoT Device Manufacturers (May 2020).
- NISTIR 8259A, IoT Device Cybersecurity Capability Core Baseline (May 2020): six core capabilities a device should have, such as device identification, configuration, data protection, software update and logging.
- NISTIR 8259B, IoT Non-Technical Supporting Capability Core Baseline (August 2021): the support a maker should provide, such as documentation and information dissemination.
- NIST SP 800-213, IoT Device Cybersecurity Guidance for the Federal Government (November 2021).
- OWASP Internet of Things project and its IoT Security Testing Guide: free, practical checklists.
Free certificate: not confirmed for IoT security. The Cisco Networking Academy course below is a free introduction that includes devices and networks.
Cisco Networking Academy · Introduction to Cybersecurity
Provider: Cisco Networking Academy (Skills for All). You earn: a free self-paced introduction (certificate or badge not confirmed on the course page). Cost: Free course · About 6 (estimate) · Level: Beginner
Open the course
5. Software supply chain
Modern software is mostly assembled from other people's code. A supply-chain attack slips something harmful into a library, a build system or an update. The defenses are about knowing what is inside (SBOM), proving where it came from (provenance, signing) and building carefully (the SSDF).
Linux Foundation · Developing Secure Software (LFD121)
Provider: The Linux Foundation, with OpenSSF. You earn: a digital badge. Covers secure design, handling reused open source code, input validation, static and dynamic analysis, threat modeling and cryptography; includes quizzes, labs and a final exam (no exam fee listed). Cost: Free course · About 16-20 (estimate) · Level: Beginner (some programming experience needed)
Open LFD121
Linux Foundation · Securing Your Software Supply Chain with Sigstore (LFS182)
Provider: The Linux Foundation, with OpenSSF. You earn: a digital badge. Introduces SLSA, SBOM and Sigstore signing. The page lists the level as Beginner but expects intermediate cloud and DevOps knowledge. Cost: Free course · About 8 (estimate) · Level: Intermediate
Open LFS182 More OpenSSF courses
6. Cloud security
Most organizations now run on someone else's computers, so a core skill is the "shared responsibility" idea: the provider secures the building, you secure what you put in it. NICE lists Cloud Security as its own competency area.
Microsoft Learn · Security, compliance and identity concepts
Provider: Microsoft Learn. You earn: free learning modules that prepare you for the SC-900 fundamentals exam (the exam itself is paid; check Microsoft for the current price). Cost: Free course · About 10 (estimate) · Level: Beginner
Open the path SC-900 exam details (paid)
AWS Skill Builder (free digital training)
Amazon offers many free, self-paced cloud courses, including security topics. Certificate or badge for any specific security course not confirmed; browse the free digital catalog and filter for security.
Browse AWS Skill Builder
7. Space and critical infrastructure
Satellites provide navigation, weather data and communications that other infrastructure depends on. Space security is a young field with real openings, and NIST has already published starter guides.
Free certificate for space security: not confirmed. These are reading and self-study resources.
The 2040 lens: where the frameworks point
This section is our own synthesis. NIST does not set a "2040 skills list." We looked at what NIST's published frameworks and timelines emphasize today and asked which skills a newcomer should build to still be useful in the 2030s. Each point cites its source so you can check our reasoning.
Cryptographic inventory and agility
NIST IR 8547 (draft) sets 2030 and 2035 milestones, and CNSA 2.0 sets earlier dates for some systems. Skills: finding where crypto lives, planning migrations, testing hybrid approaches. NICE v2.2.0 already lists a Cryptography competency area. Sources: IR 8547, NICE competency areas.
AI assurance and red teaming
AI RMF and AI 100-2 give a shared language for risk and attacks; NICE v2.2.0 has an AI Security competency area. Skills: testing models, reading threat taxonomies, writing AI usage policy. Sources: AI RMF, AI 100-2.
Identity for people, services and agents
Zero trust (SP 800-207) puts identity at the center, and OWASP's agentic list shows agents add new identity and permission problems. Skills: least privilege, strong authentication, workload identity. Sources: SP 800-207, OWASP agentic top 10.
IT and OT working together
NICE v2.2.0 includes an OT Cybersecurity Engineering work role and an OT Security competency area; SP 800-82r3 guides the practice. Skills: safety-first risk thinking, network segmentation, asset visibility. Sources: SP 800-82r3.
Provenance and software supply chain
SSDF, SLSA and SBOM all aim at knowing what is in software and how it was built; NICE has a Supply Chain Security competency area and a DevSecOps area. Sources: SSDF, SLSA.
Resilience and governance
NIST CSF 2.0 added a Govern function, and NICE lists Cyber Resiliency as a competency area. Skills: planning for failure, recovery drills, explaining risk to leaders. Sources: CSF 2.0, our NIST frameworks page.
Free training at a glance
| Area | Best free starting points | What you earn |
|---|
| Post-quantum | NIST FIPS 203/204/205, NIST IR 8547, CISA quantum hub, our QUBIT Quest | Knowledge; free certificate not confirmed |
| AI security | Microsoft AI security fundamentals; AI Red Teaming 101; OWASP LLM and agentic lists; MITRE ATLAS | Microsoft Learn module achievements |
| OT and ICS | CISA ICS Virtual Learning Portal (13 courses); NIST SP 800-82r3; CSET | Knowledge; certificate not confirmed |
| IoT | NISTIR 8259 series; OWASP IoT project; Cisco Intro to Cybersecurity | Knowledge |
| Supply chain | Linux Foundation LFD121 and LFS182; SLSA; CISA SBOM | Free digital badges |
| Cloud | Microsoft security concepts path; AWS Skill Builder; CISA cloud reference architecture | Learn free; SC-900 exam is paid |
| Space and infrastructure | NIST IR 8270 and IR 8401; CISA sectors | Knowledge |
Hands-on: free labs, playgrounds and games
Learning sticks when you poke at real things. All of these are free to start; some have paid upgrades, so stay on the free tier.
Is your browser quantum-safe?
Cloudflare's post-quantum test page shows whether your browser negotiates a post-quantum key exchange. A one-minute, real-world demo.
Try post-quantum code
The Open Quantum Safe project publishes open-source libraries and demos so you can experiment with ML-KEM and friends. Best for learners who already write code.
Trick an AI: Gandalf
Gandalf by Lakera is a free game where you try to get a chatbot to reveal a password. A fun, safe introduction to prompt injection.
Capture the flag
picoCTF (Carnegie Mellon) is a free hacking game for beginners, popular with schools. OWASP Juice Shop is a deliberately vulnerable web app to practice on legally.
Assess a pretend factory
Download CISA CSET (above) and answer its questions for a made-up plant. Then compare your result with the NIST SP 800-82r3 guidance.
Write a mini SBOM
Pick a small open-source project, list its direct dependencies by hand, then compare with an SPDX or CycloneDX example from cyclonedx.org.
More labs live on our Hands-On Defense page.
For Curiosity Coaches
Discussion prompts
- "If someone records your messages today and can read them in 2035, which of your secrets still matter then?"
- "Why might a fast patch be a bad idea on a hospital machine or a water pump?"
- "If an AI agent can send email for you, what is the worst thing it could do by mistake? What one rule would stop that?"
- "Who should be responsible when a hidden library causes a breach?"
A 4-week plan (one 45-minute session per week)
Week 1: post-quantum story, run the Cloudflare browser test, read the timeline table together. Week 2: AI security: one Microsoft module, then play Gandalf and map what happened to the OWASP LLM list. Week 3: OT and IoT: watch one 210W video or read the 8259A baseline, then pick a device and list its six capabilities. Week 4: supply chain and the 2040 lens: build a mini SBOM, then have the learner write their own three "skills for 2040" with citations.
Age and level fit
Ages 11-14: Gandalf, picoCTF beginner puzzles, the quantum-safe browser test, simple "what is an SBOM" cooking-ingredients analogy. Ages 15-18: Microsoft AI security path, OWASP Juice Shop, NIST IoT baselines. Adults and career-changers: add CISA ICS courses or LFD121, and read the NIST documents directly. Please keep all hacking practice inside the games and labs named here.
Free resource library
Related on this site: Defend the Future: Cyber Careers with the NICE Framework and QUBIT Quest.