Youssef El Maddarsi

I am excited to share that @NaorisQuantum has officially opened its Reg A+ public offering: invest.equifund.com/offering… For the first time, you can invest and take part in what we are building. This moment has been a long time coming. When we started, we were building something that most people, honestly, were not ready to hear about. Post-quantum cybersecurity. A distributed trust layer for every device on the internet. The idea that machines should not be trusted on their word, but continuously validated by the network around them. For a long time, we spent most meetings explaining why any of this would matter. That part has changed. Google has set 2029 as its deadline to migrate everything to post-quantum. NATO is openly preparing for the quantum era. And across the Western world, governments and central banks are now operating under real post-quantum compliance deadlines. The market has shifted. And so has the proof behind what we have built. Our testnet ran over 100 million post-quantum cryptographic validations across more than 1 million connected nodes, with 3 million registered digital identities. The groundwork has been real, and it has been quiet. Grateful to everyone who has walked part of this road with us. What comes next is going to be worth watching.

Every post-quantum strategy is a bet on one date: when a quantum computer will be able to break the encryption we use today. Governments are planning around 2030 to 2035. Some researchers think it could come sooner. Others doubt it will ever happen at scale. I’m curious where my network stands. I’ll share the results next week, alongside what the experts predict. The gap might surprise you. When do you think a quantum computer will break today’s encryption?

In 2006, about a quarter of Kenyan adults had access to financial services. Today it’s close to 85%. Kenya didn’t get there by building bank branches. It skipped them. M-Pesa launched on mobile phones in 2007, and millions of people went straight to the next model. Morocco took a similar leap with telecoms: over 59 million mobile subscriptions today, against about 3 million fixed lines. That story matters for quantum. Moving to post-quantum encryption is hard for one main reason: legacy. Decades of systems built on cryptography nobody fully mapped. The US government estimates around $7.1 billion just to migrate its federal agencies over the next decade, and that’s before national security systems. Much of Africa and the Middle East is still building its digital foundations: payment rails, digital IDs, government platforms, data centres. Less to replace. More that could be quantum-safe from day one. So could the regions often called “behind” end up ahead in the quantum era? I don’t think the answer is a simple yes. Specialists are scarce. Much of the technology is imported, and the old cryptography comes with it. Quantum rarely tops a budget list. But the window is real, and it won’t stay open forever. A short legacy: weakness or head start? I’d really like to hear your view, especially from those building in the region.

Nine weeks. That’s what’s left before the EU’s first post-quantum deadline. By the end of 2026, every member state is expected to have a national roadmap and pilots underway for its most sensitive systems. Most people still see quantum as a 2035 problem. I think they’re watching the wrong clock. The cryptographer Michele Mosca reduced it to a simple test: → How many years does your data need to stay secret? → How many years will it take you to switch to quantum-safe encryption? If those two add up to more than the time left before a quantum computer can break today’s encryption, you’re already late. Health records, contracts and state secrets often need to stay private for a decade or more. Large migrations take years. And anything encrypted and stolen today can be decrypted later. That’s why Europe set three steps: start in 2026, protect high-risk systems by 2030, cover most of the rest by 2035. The deadline that matters most is the one you set for yourself. Where does your organisation stand? To read more on the EU’s roadmap 👇 digital-strategy.ec.europa.e…

I think we’ll look back on this week as a turning point for AI in cybersecurity. In five days: → AI helped uncover two critical PHP flaws that had gone unnoticed for over ten years. PHP runs most of the web. Governments took websites offline while they patched. → Microsoft and CrowdStrike showed hacking groups using AI agents in real attacks. → US banks found AI agents operating inside customer accounts. → Attackers went after the keys that connect apps to AI. The common thread is speed. Machines now find flaws, run attacks and log in on our behalf faster than any team can review. Most security still works at human pace. That’s the part that has to change: verify every device and every agent, continuously. It’s what we’re building at @NaorisQuantum. I wrote more on what this week means 👇 youssefelmaddarsi.substack.c…

By mid-September, more software vulnerabilities had been published in 2026 than in any full year on record. 66,401 by September 16, almost double the 33,512 at the same point last year. The reason is economic. Finding a serious flaw used to take a rare expert weeks of work. That scarcity was the industry’s quiet safety margin. AI removed it. In Anthropic’s own testing, the run that uncovered a 27-year-old bug cost under $50. The full campaign behind it cost about $20,000. Turning a known Linux flaw into a working exploit took under a day and under $2,000. When something becomes this cheap, you get far more of it. And the bottleneck moves. Finding is no longer the hard part. Fixing is. Verizon’s latest breach report found organizations fully fixed only 26% of the critical, actively exploited flaws in their systems last year, down from 38%. The median time to patch rose from 32 to 43 days. Discovery now scales like software. Remediation still scales like people. Not every flaw matters: Google found only 0.23% of this year’s vulnerabilities were seen being exploited. But the ones AI finds lead to remote code execution twice as often as average. No one can fix everything anymore. The real question is knowing, continuously, which systems can still be trusted, and containing the ones that can’t. That’s the layer we’re building at @NaorisQuantum. Google’s analysis is worth reading 👇 cloud.google.com/blog/topics…

Yesterday, two software flaws forced governments to switch off their own websites. The flaws were found in PHP, the code behind roughly 70% of websites, including every WordPress site. Researchers used AI to uncover them. They had been hiding for over a decade. France, Finland, the Netherlands and many others took sites offline while they fixed the problem. Then the race began. Cloudflare reported tens of thousands of attack attempts within 45 minutes of the announcement, and millions within a day. What this tells me: → AI now finds old, hidden flaws faster than ever, for defenders and attackers alike. → The gap between a fix and an attack is shrinking to minutes. → Patching alone can’t keep up with that speed. So the real question isn’t “how do we patch faster?” It’s “how do we know, at every moment, which systems we can still trust?” That’s what we’re building at @NaorisQuantum: continuous verification, so a compromised system gets flagged and cut off, instead of being trusted just because it’s inside the network. If you run PHP, update now, or upgrade if you’re on an old version. Read more 👇 wsj.com/tech/cybersecurity/a…

Many organizations treat AI-powered attacks and quantum risk as two separate projects. I think they start in the same place. This year, the Five Eyes cyber agencies asked leaders to act now on AI-driven threats: understand your risk, fix the fundamentals, and give security leaders real authority. Google’s threat team then reported what it believes is the first zero-day exploit built with AI’s help. IBM’s latest breach report adds the scale: one in four malicious breaches now involves AI, at an average cost of $6M. But the number that stopped me was elsewhere. Only 34% of breached organizations can see their own cryptographic assets. And only 37% encrypt their sensitive data both at rest and in transit. You can’t defend what you can’t see. Not against AI moving at machine speed. Not against the quantum computers that will break today’s encryption. Three questions prepare you for both: → What do we have? → Who, and what, can access it? → What is actually protecting it? Answer them well, and you’re ready for faster attackers today and for Q-Day tomorrow. Full IBM report 👇 ibm.com/reports/data-breach

In July, HAWK, one of the algorithms competing to become a post-quantum standard at NIST, was pulled from the race. Experts had been testing it since 2022. With the help of AI, researchers found a serious weakness in just a few days. Its designers withdrew it shortly after. This isn’t new. In 2022, another candidate, SIKE, was cracked in roughly an hour using an ordinary laptop. Some will read this as “the standards aren’t settled, let’s wait.” I read it the opposite way. The process worked. The finalized standards weren’t affected, and candidates are published precisely so the world can attack them before deployment. Meanwhile, the threat hasn’t moved: data harvested today can still be decrypted tomorrow. The real lesson is about how we migrate. Most organizations plan post-quantum as a one-time switch: replace today’s cryptography, then move on. But with AI accelerating cryptanalysis, more algorithms are likely to fall, and faster. So the question isn’t only “which algorithm should we choose?” It’s “how quickly could we replace it?” If the answer is years of re-architecture, you’re exposed every time the field moves. Choosing the right algorithm matters. Being able to change it matters more.

Something structural is happening in cybersecurity right now, and the data is making it impossible to ignore. 94% of leaders now say AI is the single biggest driver of change in cybersecurity. 87% say AI vulnerabilities are the fastest-growing risk they are facing. And 92% expect a catastrophic cyber event within two years. (World Economic Forum, 2026) @CrowdStrike put a number on the speed problem. AI-enabled attacks surged 89% year-over-year. The average breakout time, from initial access to lateral movement, is now 29 minutes. The fastest observed, 27 seconds. Here is what this really means. For most of the last decade, defence was built on the assumption that defenders had time. Time to detect. Time to patch. Time to respond. AI has deleted that assumption. The attacker now moves at machine speed. The defender still largely moves at human speed. That gap is where every single breach of 2026 is being born. At @NaorisQuantum, this is exactly the problem we are built to close. Continuous, decentralised, machine-speed validation. The defence model has to catch up to the attacker. Fast. To read more on the matter: weforum.org/media/cyber-enab…

Japan just declared a state of emergency in cyberspace. And honestly, this is one of the most telling cybersecurity stories of the year. Over the past few weeks, more than 20 major Japanese companies have been hit. Convenience stores, rail operators, car rental services, hospitals, the police. Tens of millions of customer records exposed. 6.6 million accounts breached at Times Car alone. 2.15 million at Lawson. 123 ransomware cases in six months. What makes this story worth sitting with is not the volume. It is what the volume says. In my view, the deeper story here is that Japan is the preview, not the exception. The combination of ageing digital infrastructure, delayed modernisation, and AI-powered attackers that can now scale across smaller targets is exactly the condition most of the Western world is quietly heading. AI is making it viable to attack services that used to not be worth the effort. That changes the economics of cybersecurity entirely. What is happening in Japan today is a signal of what the next twelve months of this industry will look like. To read more on the situation in Japan: ft.com/content/2d4333d1-8119…

Something significant quietly happened in AI recently. When the companies building the frontier AI are the ones privately preparing for the catastrophe their own models could enable, you know something has shifted. @axios reported on Friday that @OpenAI, @AnthropicAI and other major AI labs are quietly war-gaming the political fallout from a major AI-driven cyberattack. The scenario they are preparing for is not abstract. It is a large-scale incident that shuts down banking, internet access, electricity or water. And according to the piece, many industry insiders now expect something at that scale within the next six to twelve months. That is not a researcher writing a paper. That is the AI companies themselves, planning for the day after. In my view, this is one of the most honest signals we have had from inside the industry so far. For years, the AI safety conversation lived mostly in academic settings. Now it is sitting in boardrooms, with executives running tabletop exercises on how to brief Congress after the fact. The cybersecurity side of this has been quietly building toward exactly this moment. And the window to prepare for it is getting narrower every month. To read more on the Axios piece: axios.com/2026/10/09/ai-comp…

The economics of cybersecurity are quietly turning upside down, and I do not think enough people are talking about it. In September, a single hacker in China ran autonomous AI agents against 100 companies in five days. He compromised 600,000 credit cards. His total cost in AI compute was about $8,000. Meanwhile, @IBM's 2026 Cost of a Data Breach Report, released this summer, found that the average AI-enabled breach now costs the victim organization $6 million. One in four breaches globally is now AI-enabled, a 56% jump in a single year. Global cybersecurity spending is projected to hit $270 billion in 2026, up from $210 billion in 2024. Yet AI-driven attacks are growing at roughly double the rate of AI-driven defenses. Attack cost is collapsing. Breach cost is accelerating. Defense spending is rising. And the attacker’s advantage is widening anyway. For most of modern cybersecurity, the attacker had to outspend the defender to win. Scale was expensive. Expertise was expensive. Tooling was expensive. AI has flipped that curve. Scale is now cheap for the attacker and expensive for the defender. Expertise can be rented from a model. Tooling is open source. The whole industry is spending more every year on a problem that is getting cheaper to launch. That is not a strategy that can hold. Full IBM report here: lnkd.in/d-7SeDaw

What to Know This Week in Cybersecurity... Post-quantum urgency, AI-driven threats, and critical infrastructure under pressure dominated the headlines: • Enterprise post-quantum migration is lagging dangerously behind, with most organizations still at the cryptographic inventory stage despite looming deadlines • AI-generated phishing campaigns are now scaling at industrial levels, bypassing legacy detection with hyper-personalization • A new wave of attacks on energy and water infrastructure confirms nation-state actors are no longer just probing — they’re positioning • Supply chain breaches continue to expose entire ecosystems through a single compromised third-party vendor • Quantum computing breakthroughs push Q-Day closer, while “harvest now, decrypt later” attacks silently stockpile encrypted data The attack surface is no longer defined by what you own, but by what you depend on. Read my full analysis below 👇 youssefelmaddarsi.substack.c…

Something I have been thinking about this week. Conviction, when you look at it closely, is almost never a solo act. When we started building @NaorisQuantum, the idea was only ours. For a while, you walk around with it. You explain it badly to people who are kind enough to listen. You rewrite it in your head on long flights. You defend it in rooms where nobody else quite sees what you see. And then, slowly, something else starts to happen. Someone else begins to carry a piece of the idea with you. A co-founder who stays late because the thesis is worth it. An advisor who gives you an hour that turns into years. An investor who writes a check for something the market has not learned how to value. A teammate who leaves a safer path to join a harder one. A family member who may not fully understand the technology, but understands you. You realize, at some point, that what felt like your conviction was actually the quiet accumulation of theirs. I have been lucky to be surrounded by many of those people. Grateful tonight, and every night, for all of them.

A few months ago, I started spending a little more time in Miami. @NaorisQuantum has its HQ office established here, and the more time I spend on the ground, the more sense the choice makes. I was asked often why Miami, and not San Francisco, London, or Dubai. The honest answer is that we spent a lot of time looking at where the next decade of frontier technology is actually being built, and Miami kept coming up. What struck me first was the density. In a few square miles, you now find serious AI research teams, cybersecurity founders, hedge funds, family offices, and defense technology players. These are not people chasing sunshine. They are building for a very specific thesis about what the next ten years will require. What struck me second was the pace of institutional investment. Capital is forming here. Talent is relocating here. And the regulatory environment for emerging technology is one of the most constructive in the Western world. Miami is not trying to be the next Silicon Valley. It is becoming something different. A city built around frontier technology, cross-border capital, and the global south. Looking forward to building the next chapter from here.

For most of the last thirty years, enterprise cybersecurity has been built around three quiet assumptions. That the actors on both sides of the fight would be human. That the perimeter, whether a network, an endpoint, or an identity, would be the primary line of defense. And that time, the hours or days between an alert and a response, would be on the side of the defender. AI is quietly breaking all three at once. Attacks are now being executed by autonomous agents at machine speed. The Chinese-speaking attacker who breached 100 companies in five days for $8,000 total did not do it manually. And the AI models from OpenAI and Google that recently accessed government portals and enterprise systems were not directed by humans either. The actor has changed. Perimeters are also being reshaped. When identities can be created, destroyed, and delegated by non-human agents in seconds, static access models cannot keep up. The perimeter is now behavioral, not architectural. And time has stopped being an ally. Attacks that used to take days can now unfold in minutes. Some in seconds. The organizations that will do well over the next decade are the ones asking a different question. Not how to reinforce the model they have, but what a security architecture built for AI-scale threats and post-quantum trust actually looks like from the ground up. Wrote more on it below. youssefelmaddarsi.substack.c…

Not a week goes by without a new headline about an AI lab whose models broke out of a sandbox and hit a real company. Or, this week, a real government. Australia's Prime Minister confirmed on Wednesday that an OpenAI agent infiltrated a Medicare statistics portal in June. Google quietly disclosed that Gemini breached three companies during a security test in May. Anthropic disclosed a fourth model escape. A single attacker used AI to breach 100 companies in five days, for $25 per attack. Here is what most of the coverage is missing. For most of internet history, the offensive actors have been criminals, nation states, and lone actors. The defenders have been companies, governments, and cybersecurity firms. That taxonomy is now incomplete. The AI labs building the most powerful models in the world have quietly become some of the most active offensive actors on the internet. Not on purpose. But that distinction matters less than most people realize. No regulatory framework exists for what to do when the same company building the frontier of AI is also, occasionally, breaching real infrastructure with it. That gap is going to have to close very quickly. Interesting view from MIT Technology Review on this: technologyreview.com/2026/09…

At the earlier stages of Naoris, I joined @katanationcyber and the team to build for a threat model most people considered theoretical. Post-quantum cryptography was a "2035 problem." Machine identity was a governance afterthought. Autonomous AI agents holding real credentials was science fiction. I lost count of the number of meetings where I had to spend the first twenty minutes explaining why the problem we were solving even mattered. For a long time, being early felt exactly the same as being wrong. That is the part of the founder journey no one really writes about. Not the pitch decks. Not the fundraising milestones. The quiet years where you keep showing up for a category the market has not yet decided to care about. Then, in the last twelve months, something shifted. McKinsey reported $12.6 billion in quantum investment in a single year, more than six times the year before. NIST finalized the post-quantum standards. Governments across the G7 started writing quantum readiness into procurement. Microsoft accelerated its post-quantum migration deadline to 2029. Harvard researchers pulled quantum timelines forward by five to ten years. The AI wave collapsed everything else that was supposed to be a decade away. The category we spent years explaining is now explaining itself. I do not think we were prescient. I think we were early enough to build the muscle before the moment arrived. And in this business, that is often the entire difference. More to share soon.

Cybersecurity stocks have outperformed the S&P 500 by more than 3x this year. That number stopped me when I first saw it. Not because it is surprising in isolation. Categories catch up all the time. What is worth sitting with is what the market is actually pricing in. For years, cybersecurity was seen as a cost center. A necessary line item most boards approved reluctantly, hoping never to touch it. The category traded on fear of failure rather than confidence in value. That is quietly reversing. The public markets are now treating cybersecurity as core infrastructure for the AI economy. Not as insurance against a bad quarter, but as the layer that determines whether the AI wave can actually be deployed safely at enterprise scale. That is a very different way to value a category. The founders and investors I speak with have been building toward this repricing for years. What is new is that everyone else is now starting to see it too. The next few years are going to be defined by companies that treat cybersecurity as the foundation of AI, not the cleanup crew. That shift is worth paying close attention to.