Arvind Krishna & Nikesh Arora: Quantum Threat, Open vs Frontier AI, AI Cyber Warfare & SaaS Collapse
Summary
- Krishna’s quantum timeline makes cryptographic migration a current spending decision. He puts the debate over a working quantum computer at 2028, 2029 or 2033, uses 2030 as a midpoint, and says it would break current cryptography. An encrypted drive stolen today could be kept for five years and then broken; Arora warns companies waiting until 2029–30 that “we’re already late.”
- Krishna expects open-weight models to capture 75%–90% of token use. His economics: roughly $20–$50 per million tokens versus $1–$2 on owned GPUs after optimization, for a model doing 95% of the work. Cost, intellectual property and control lead him to expect enterprises to say, “I need to run the models myself.”
- Arora sees frontier intelligence earning its price in emergencies, while routine security needs cheaper models. Endpoint inspection costs roughly $20–$40 annually; a breach can threaten billions, justifying frontier models and agent swarms. For ordinary tasks, “you don’t need a Ferrari for every task.” He favors open-weight models trained on proprietary data for many business uses, with managed weights offering auditability and explainability.
- AI improves vulnerability discovery without removing the attacker’s structural advantage. Arora says Mythos hallucinated 30% of the time, but attackers need only one real vulnerability while defenders must find and patch them all. Krishna says agents write roughly half his organization’s code and improve it through evaluations, while “we’re only finding the bugs we know how to find.”
- Compute access—not simply a have-and-have-not divide—is a key concern. Arora says he does not expect a straightforward have-and-have-not scenario, but worries that compute access may concentrate around two major countries because of cost and supply constraints. Krishna says that if 30 states restrict data centers, the remaining 20 could be “rubbing their hands together with glee.”
- Vertical integration offers profit flexibility and can lock customers in through context. IBM’s 65-year mainframe history illustrates retaining value across a stack; Arora sees personal agents accumulating memory, APIs and connectivity that make switching harder. The commercial unit could become “cost per action,” with distribution a major battleground.
- The host flags uncertain software terminal values; Krishna expects consolidation amid fragmented spending. The host expects major SaaS disruption as AI changes product-market fit. Krishna sees enterprises with 500–5,000 vendors moving toward 5–10 core platforms; consolidation could take “six months or six years.” He says highly reliable transaction systems will be harder to replace easily with AI-generated software. On M&A valuations, he says they were attractive at the start of the year, but less so a month ago.
Deep dive
1. Quantum migration must precede the machine
Krishna says the debate is whether a working quantum computer arrives in 2028, 2029 or 2033; using 2030 as a midpoint, he says it will break current cryptography. DARPA’s Quantum Benchmarking Initiative has narrowed roughly 200 companies to about 13. An encrypted drive stolen today could be kept for five years and then broken.
His milestones are demonstrating error correction or mitigation on working hardware—not a simulation—and then scaling gate operations. He expects claims “next year,” with one or two making progress by 2027. Gate operations are near 10,000 today; adding a zero annually could reach 10 million by 2029. Physical qubits alone can mislead: 10,000 physical qubits might mean about 200 logical qubits after error correction.
Post-quantum cryptography is understood and the code exists, Krishna says, although its assurance rests on complexity assumptions rather than theorem-level proof. Arora urges replacing the IT stack with quantum-safe infrastructure now and using post-quantum keys around traffic as an interim measure. He guesses that 50% of the few hundred million dollars of IT spending people in the room have earmarked for this year is on infrastructure that is not quantum-secure.
The host raises the possibility that AI could find a classical arithmetic route to cracking codes, perhaps through prime-number theory. Krishna says AI could discover a quantum algorithm, but running it efficiently requires quantum hardware; otherwise it could be slower by a factor of 1,000 or 10,000. He concedes a different classical route is possible. Timing decides practicality: taking 10 years to crack one key is “not a practical answer.”
2. Experiment with frontier models, then price the task
Arora says his 20,000-person organization has only discovered AI in the last 12–18 months, and it is not fully integrated. In this experimentation phase, he wants teams to “Use the best model you can find, the simplest way to use it” to validate possible efficiency, revenue and product-development benefits. Making adoption harder slows that learning.
Routine endpoint defense has different economics from a breach response. Arora says machine learning inspects hundreds of megabytes of traffic per endpoint, running on endpoint compute and a 20–40 MB payload, for roughly $20–$40 per year. Sending all that traffic through token-priced frontier models is not practical. His alternative is a compressed, task-specific small language model trained until it reaches 99.9% accuracy: “you don’t need a Ferrari for every task.”
If a breach threatens billions, Arora says customers will authorize whatever model is needed to stop it, including swarms of agents and a state-of-the-art LLM. He expects frontier models to be used in one-off cases where the business value justifies the cost. For many business uses, including defense models in peacetime, he expects open-weight models trained on proprietary data; managing the weights can provide auditability, explainability and an open system for explaining outcomes.
Krishna compares roughly $20 per million tokens for “generation minus one,” or $50 at the extreme, with $1–$2 using owned GPUs and about a week of optimization. His example is a Chinese open-weight Kimi K2 model with something like 800 billion parameters, which he says could do 95% of the work at much lower cost. He adds that captured, registered and audited chains of thought could give away intellectual property. He sees little danger in running Chinese models in an isolated environment, distinguishes that from cloud hosting, and expects comparable Western open-weight models within a year or two; he puts the capability gap at 6–12 months.
Those economics and control concerns lead Krishna to put 75%–90% of token use in open-weight models. He jokes that developers are lazy and will use the most expensive answer unless checked. Arora says moving to a cheaper model for production may be fine if experimentation has already proven it works, but he is skeptical of doing so for production use except in a small number of cases.
3. AI defense needs coordination and verification
The host asks whether model providers might encroach on cybersecurity businesses and raises questions about ZDR, data retention and synthetic data. Arora says many coding-agent users do not have ZDR and are comfortable with cloud-based code training models. Teaching a model what good code looks like can also help it recognize bad code. Mythos hallucinated 30% of the time, he says, but attackers need only one vulnerability while defenders must find and patch them all.
The host proposes that trusted partners pool vulnerabilities, develop patches and distribute them broadly. Krishna answers with three lessons from warfare: powerful alliances, making defense less costly relative to attack, and technological superiority. The goal, he says, is to find and patch vulnerabilities and make it very expensive for attackers to find a way through.
Krishna says coding agents write probably half the code in his environment and that it is better than before because agents evaluate it and fix what they can find before release. But “we’re only finding the bugs we know how to find.” Full verification is currently computationally infeasible; limited inputs might make verification possible, while arbitrary inputs remain difficult.
Krishna also guesses that people in the room would judge roughly 60%–80% of models’ vulnerability findings real and 20%–40% hallucinations. He says models are good at identifying vulnerabilities, but he would not use Claude Code to patch one without retesting it.
4. Regulation can move investment without stopping development
Arora says nobody is slowing down the push for better, faster models. He argues that companies remain responsible for products they release; claiming an agent wrote the software does not remove corporate responsibility. He says existing regulations can hold companies accountable, and that there may already be too many.
The host recounts a senior congressman’s prediction of data-center bans in all 50 states by the fourth quarter, while noting that this is unlikely. Krishna says AI regulation and data-center politics are driven by populism, balanced against concern for long-term economic advantage. He says all 50 states banning data centers has no chance, but 30 is possible; the other 20 would be “rubbing their hands together with glee.”
On global access, Arora says he does not expect a simple have-and-have-not scenario and believes protection can be made affordable. His larger concern is that computing development and access may not be evenly distributed: compute is expensive and difficult to obtain at scale, particularly away from the two major countries advancing it. He cites possible access constraints for a European company, whether from economics or supply.
Krishna frames the shift as another labor-capital trade-off, saying capital-intensive adopters tended to win in the previous seven or eight cycles. The host, not Krishna, argues that societies should accept job displacement if it can lead to better jobs, rather than insisting every existing job must be protected.
5. Vertical stacks retain profits and accumulate context
Krishna’s IBM example spans 65 years of mainframes. The company once sourced sand, made wafers and chips, and built the metal around the machine; today, manufacturing is the part it does not do in-house, while chip and engineering design, resilience and most software remain internal. The host’s Nvidia comparison adds the argument that controlling a stack lets a company move profits between layers when competitors commoditize one.
Arora reframes open versus closed models as open versus closed stacks. Reasoning, memory and context become increasingly intertwined; an open router that only moves reasoning tokens may become impractical. A personal agent containing someone’s context, APIs and connectivity creates switching friction. He expects applications to integrate software, reasoning, memory and context, with pricing tending toward “cost per action.”
Arora says distribution will also be a major contest in enterprise and consumer markets. He expects cutting-edge labs to push the MCP concept hard in the next three months; he says they tried it nine months earlier without success, but Facebook has shown how it can work. He expects APIs and says every iPhone app will have to become headless.
6. Software consolidation meets uncertain terminal values
Arora’s cybersecurity case starts with customers having to buy and bundle 40 solutions they may not understand. His Fidelity experience offers an analogy: 23 systems collectively performed what would now be called CRM, before the work consolidated into platforms. He wants best-in-class security capabilities integrated so customers need not assemble them themselves. The host—not Arora—says cybersecurity valuations have improved amid AI enthusiasm and expects that to rationalize over time.
The host says it is difficult to understand software’s terminal value over the next 5–8 years as AI changes product-market fit, and predicts major SaaS disruption. Asked about M&A valuations, Krishna says they were attractive at the beginning of the year, but not so much a month ago, and that he will wait to see how the next few months go.
Krishna sees enterprises using 500–5,000 software vendors and asks whether they could replace 490 with smaller AI capabilities, returning to 5–10 core platforms. If software value falls, he says, companies cannot afford separate distribution for every product. He expects consolidation, whether it takes six months or six years.
Krishna distinguishes interaction-heavy software, which AI can replace more readily, from systems that need reliability of 10⁻¹⁵, such as database lookups in retail banking or closing the books. He says those will be difficult to replace easily with AI-generated software. The host says a digital twin would be needed for years before switching and that there would then be no cost advantage; Krishna agrees.