"Is public-key cryptography dead?" No. Should we consider it could soon be? Yes - but only a tad bit and no more. Let me explain. Reading Matthew Green’s recent tweet about potentially losing public-key cryptography, even with his later clarification, left me thinking about risk management. We just saw a top expert share what I think was a gut punch, felt deeply. He likely saw how fast things are moving, with 50-100 years of Fields Medals worth of findings released from OpenAI - and went online to share. Three years ago, I would have said “meh” and moved on. Today, I’m less comfortable assuming the very basis of what I rely on won’t shift faster than I can respond. And, I refuse to miss the opportunity to check my processes. Am I able to move faster now, than I did on Mythos or on Hugging Face. Our bias toward what is fully proven, instead of what I call trajectory-based assessments, is our undoing in the AI age when considering risk management. When Heather Adkins and I discussed democratizing vulnerability discovery and shortening time to exploitation alongside Bruce Schneier a little over a year ago, the entire industry dismissed us as spreading FUD. We ended up right, but the trajectory we saw was based on direct experience. The distinction matters here. OpenAI’s huge mathematical releases show a trajectory in the speed and ability to work on math. They do not yet establish a trajectory toward breaking cryptography. Given how much we depend on cryptography, and how unprepared we would be for a major break, that uncertainty deserves some limited attention and resources. Consider how much we already spent on quantum-ready, and tell me we shouldn't actually prepare for this. I won’t argue with the math or pretend we know the probability has increased. But the pace of change introduces uncertainty into how I must plan when it comes to my dependencies. Questions to ask: 1. What would our technology stack look like if we couldn't rely on RSA cryptography any longer? 2. How would my business be affected by this shift? 3. How would we handle it if that happens? 4. What could I do today to *minimally* prepare? 5. Have we put all our people on agents yet, so we are all faster all around? Have we taken care of the agents’ security? We can't spend on every little issue, can we? We have limited focus and resources. That's why I say - spend a little. And, most importantly, treat this as a case study for moving fast, or faster, with a changing landscape.