Information Security Research CenterBuilding a Comprehensive and Forward-Looking Cybersecurity System for the Quantum and AI Era

In 1994, the advent of Shor's algorithm theoretically demonstrated that once large-scale quantum computers become available, existing public-key cryptosystems will face severe risks. The danger lies not in human error but in the fact that the fundamental mathematical problems underpinning public-key cryptography could be completely cracked.

More importantly, migrating the current public-key systems to post-quantum cryptography will inevitably require substantial time and resources, including the selection of post-quantum standards, system upgrades, and software/hardware deployment. This represents a costly and time-intensive transformation.

Therefore, even as quantum computer hardware and algorithms continue to evolve, research in post-quantum cryptography has already become a global priority to prepare for future cybersecurity threats and migration costs.

Cybersecurity Defense in the Quantum Era

To counter cybersecurity threats posed by quantum computers, the industry is pursuing two main defense strategies.

First, quantum cryptography.

Based on the unique properties of quantum mechanics, the most well-known example is Quantum Key Distribution (QKD). Quantum cryptography offers extremely high security but remains difficult to implement primarily due to cost, technology, and equipment constraints.

Second, post-quantum cryptography (PQC).

Building on traditional cryptographic approaches, PQC targets mathematical problems that are difficult for quantum computers to solve, using them as the foundation for new cryptosystems. While quantum computers are powerful, they are not omnipotent; they excel only at certain problems, and PQC leverages this limitation to establish robust defenses.

Post-Quantum Cryptography as a Critical Discipline

The timeline for the emergence of large-scale quantum computers remains uncertain,but the cybersecurity threats they pose are already foreseeable. The global cybersecurity community has therefore turned to developing quantum-resistant cryptography, giving rise to PQC.

Faced with emerging threats, the U.S. federal government has stated that existing public-key cryptosystems, such as RSA and ECC, should begin to be deprecated by 2030 and disallowed after 2035, making PQC research and deployment an urgent priority.

To address the quantum threat, the National Institute of Standards and Technology (NIST) has launched a standardization process for PQC and has already selected multiple algorithms for inclusion in the Federal Information Processing Standards (FIPS).

The Information Security Research Center (ISRC) has actively participated in the Post-Quantum Cryptography competition organized by NIST. Its research was officially published by NIST in July 2023, signaling NIST's recognition of ISRI's contributions. In 2024, the ISRC achieved a key milestone by implementing FIPS 203 (ML-KEM) on microcontrollers (MCUs) and validating the correctness of key exchange operations, demonstrating its mastery of PQC.

However, while PQC algorithms are resistant to quantum attacks, they often lag behind current RSA and ECC standards in computational efficiency, public key size, and signature specifications. As a result, the ISRC has prioritized efforts to optimize PQC implementation for integration into existing hardware, ensuring smooth enterprise migration to quantum-resistant systems.

Cybersecurity Challenges and Strategies in the AI Era

As AI technology matures, enterprise operations are becoming smarter and more efficient. However, AI is also reshaping the cybersecurity landscape in three critical ways:

First, hackers are using AI to accelerate, refine, and customize attacks against specific targets. Second, cybersecurity defenses must adapt AI to enable dynamic learning and real-time adaptation, overcoming the limits of static, rule-based detection. Lastly, AI itself carries inherent risks. If training data is maliciously corrupted, models may be implanted with backdoors, introducing new security threats. Clearly, AI is not only a driver of industrial innovation but also a decisive factor in cybersecurity.

To counter these risks, ISRC is developing AI-powered dynamic defense systems. These technologies strengthen static detection while enabling continuous learning and adaptation to new attack methods. In addition, the technology also integrates ISRC's AI threat detection model with the global Cyber Threat Intelligence (CTI) database, drawing on worldwide data to convert threat intelligence into actionable model insights.

The results show a substantial improvement in detecting previously unknown attacks, with related findings published in leading international journals. This means that enterprise networks and connected production-line devices will be fortified with more resilient, proactive defenses, capable of responding to threats before they materialize and mitigating the risk of major financial and operational losses.

Yet the challenges do not end there. Another hidden risk lies in the training of AI large language models.

During large-scale training, models may inadvertently absorb unsafe or harmful behavioral patterns that can be triggered under specific conditions, resulting in latent security risks. To address this issue, ISRC has developed an algorithm to precisely pinpoint parameters associated with “toxic speech” and apply weight subtraction techniques to significantly suppress unsafe behaviors while retaining the model's full functionality and performance.

This research has been accepted by top-tier international conferences and recognized by peer reviewers. Looking ahead, the technique can be applied in customer service, education, and healthcare, and it can suppress model parameters linked to toxic behavior to help AI “forget” unsafe patterns. This approach reduces risks of malicious manipulation, ensures more stable and trustworthy outputs, and promotes public trust in AI applications across industries such as customer service, education, and healthcare.

The breakthroughs in real-time defense and risk removal have established a new foundation for AI cybersecurity. Moving forward, ISRC will continue to advance model safety, explainability, and output verification, collaborating with industry and academia to accelerate deployment. Industry provides real-world validation, while academia contributes frontier theory and techniques. Together, they accelerate the evolution of AI-powered cybersecurity. The ultimate goal is an adaptive cybersecurity network capable of real-time learning and response to safeguard enterprises and users across the digital battlefield.

Building a Resilient Cybersecurity Defense

Hon Hai Technology Group's cybersecurity governance aims to establish a comprehensive and robust cybersecurity system that extends from top-level commitment to daily operations. This top-down approach fosters a strong cybersecurity culture, supported by planning and investments consistent with the Group's specific needs. In addition, collaboration across workgroups ensures policies are effectively implemented.

At the heart of these efforts is the Cybersecurity Governance Committee, chaired by Hon Hai Chairman Young Liu. Committee members include top executives from key subsidiaries, chief information and network officers, and the ISRC director, with senior leaders from finance, HR, legal, and audit departments participating on a project basis as needed.

A Secretariat supports strategy planning and convenes regular committee meetings to report progress and strategic direction to senior leadership, reinforcing organizational resilience and protecting customer privacy and assets.

The Committee also oversees two working groups. The Cybersecurity Governance Working Group develops cybersecurity strategies, policies, and standards to ensure regulatory compliance. The Cybersecurity Operations Working Group implements and maintains security architecture, devices, and risk management mechanisms to ensure operational effectiveness.

According to Wei-Bin Lee, ISRC Chief Executive Officer and Director, the Committee's work is defined by two key features.

First, establishing common standards and language. Hon Hai Technology Group spans a wide array of business units, each of which defined, assessed, and reported cybersecurity incidents differently. The Committee has therefore unified incident classification principles and reporting levels across the Group, enabling consistent communication and resilience across business units.

Second, the committee has built a comprehensive defense framework centered on ransomware that spans prevention, detection, and recovery. The initiative begins with the establishment of Emergency Response Centers at both the central and subsidiary levels, which coordinate group-wide response teams to enhance resilience.

Cybersecurity governance and regional joint defense form the core strategy. Central management coordinates subsidiaries and affiliates to form joint defense teams, establishing threat intelligence sharing and collaboration mechanisms for timely communication and experience sharing.

In addition, by establishing a centralized Security Operations Center (SOC) and SIEM platform with AI-powered monitoring and collaborative reporting, threat intelligence can flow seamlessly across the organization, enabling early detection and prevention to ensure stable operations. In the event of an incident, resources are swiftly integrated to form an Emergency Response Center, creating a comprehensive defense system of detection, reporting, and coordinated response against increasingly complex and diverse cyber threats.

This strategy has earned international recognition. In 2024, the Group received the Information Security Leadership Award at the Taiwan Corporate Sustainability Awards (TCSA), highlighting its emphasis on cybersecurity resilience and joint defense.

In the face of quantum threats and AI-driven disruption, only proactive investment and upgraded governance can secure the future. In a rapidly changing era, trust must take precedence over compliance, with active risk identification and forward-looking deployment. Cybersecurity is not just defense; it is a source of competitive advantage.