MWC Barcelona 2026 | Mark Hughes, IBM

Clips
More from MWC Barcelona 2026

Mark Hughes

Global Managing Partner Cybersecurity Services

IBM

play_circle_outline Quantum Computing: A New Multi-Dimensional Compute Spectrum Alongside CPU and GPU

play_circle_outline By 2029–2030 Quantum Computing Goes Mainstream: A Lower-Energy Alternative to GPU Farms

play_circle_outline Quantum threatens asymmetric cryptography via Shor’s algorithm

play_circle_outline Executive Action: Inventory Organizational Cryptography Now — IBM Tooling Discovers Crypto and Four Quantum-Resistant Algorithms

play_circle_outline Migration strategies: replace crypto, encapsulate legacy, work with partners

play_circle_outline Quantum will expand both defensive and adversarial attack surfaces

Info
Transcript

Mark Hughes, IBM

Mark Hughes

Global Managing Partner Cybersecurity Services IBM

In this interview from MWC Barcelona 2026, Mark Hughes, global managing partner for cybersecurity services at IBM, joins theCUBE’s Dave Vellante to discuss the looming disruption of quantum computing and its intersection with enterprise security. Hughes unpacks the reality of quantum mechanics, detailing how it will join CPUs and GPUs to revolutionize algorithmic problem-solving while offering incredible energy efficiency compared to modern AI factories. A major focus of the conversation is "quantum-readiness." Hughes explains how Shor’s algorithm will eventu... Read more

explore Keep Exploring

What should people know about quantum computing and how it will fit alongside CPUs and GPUs in the future of computing? add

What are the energy and infrastructure (data-center and latency) implications of using quantum computing versus GPU-based computing for AI, and when is mainstream quantum capability expected to be available? add

How might quantum computing threaten or render today’s asymmetric (public-key) cryptography vulnerable? add

What steps should an organization take to discover its cryptographic assets and prepare or migrate them to resist the threats posed by quantum computing? add

How can a technology executive apply quantum‑resistant algorithms deep in the technology stack (including hardware or storage)? Should they work with partners or encapsulate existing cryptography to protect those hidden encryptions? add

How will quantum computing (and advances like AI) be applied in cybersecurity, and what impact will increased compute power have on defenses and the attack surface? add

bolt Powered by CUBE AI

Mark Hughes, IBM

search

Dave Vellante

>> Hi, everybody, good morning and welcome to Barcelona to MWC. This is theCUBE's live coverage. My name is Dave Vellante and I'm here with John Furrier and the whole CUBE crew. This is day three of our wall-to-wall coverage, our fifth year here at MWC. Used to be called Mobile World Congress, but it's expanded much beyond telco. I mean, telco's still the core, but beyond telco, beyond mobile, really into AI. And also, really for the first year, we're hearing a lot more about quantum. And I'm really excited to have Mark Hughes here. He's the global managing partner for cybersecurity services at IBM. Mark, good to see you. Welcome.

>> Good to see you, Dave. Thank you for having me.

Dave Vellante

>> You're very welcome. So, we walk into Hall two,

Mark Hughes

>> and boom, there's the IBM booth and you have this gorgeous, like golden chandelier and it's a quantum chandelier.

Mark Hughes

>> Indeed. - It's actually a lot of the cooling of

Dave Vellante

>> that quantum chandelier-

>> Exactly, in fact, it's just a little chipset at the

Mark Hughes

>> bottom, which is where the magic happens. The rest of it is the infrastructure that you need with the cooling around it.

Dave Vellante

>> Yeah. So, we're going to go over there a little later on and we'll do a hit right there. So, we'll post that so you guys can see it. So, I hosted, with Luq Niazi, a roundtable with a number of executives on Monday, about 23 executives from all over the globe, very senior level audience. And we were talking about the intersection between AI and quantum and hybrid and sovereign. So, I want to set that up. What is the thinking around quantum? What should executives know about quantum, the sequence of when it's coming? Where should they be focused right now? Because they're drowning in AI, but quantum looms, and you guys are making some great progress there. What should they know?

Mark Hughes

>> Well, what they should know firstly is that quantum's going to revolutionize computing as we know it today. In the same way, to a certain extent, how GPU computing has really changed the face of CPU computing over the last couple of years. So, we see, really, in IBM a spectrum of computing emerging where we have traditional CPU compute, which is going to be there for a long time yet, and has unbelievable utility and is extremely useful. GPU compute, which we've seen now emerging, which obviously is really powering the AI revolution. And then, now we enter with quantum computing. And quantum computing is all about basically how compute is now going to work not in a binary way, but in a way in which we embrace quantum mechanics to be able to compute in multiple dimensions at once, if that makes sense.

Dave Vellante

>> Yeah. It's not just one or zero, it is.

Mark Hughes

>> There we go. - Okay. And that kind

Dave Vellante

>> of twists people's minds.

Mark Hughes

>> Exactly. It twists my mind, but it absolutely opens up incredible opportunities, but that is within that spectrum of compute. So, one of the things that we're really focused on in IBM is that opens up a lot of possibilities for organizations. In things like just straight algorithmic computing is going to be revolutionized by the power that quantum computing will be able to give. So, solving those complex algorithms, for example, but also doing much more complex search, which is something that actually traditional computing, GPU and CPU isn't that good at. So, quantum's going to be amazing at that. And then, one of the other key areas that we see emerging is about mimicking life sciences. So, really, now the application of being able to mimic nature and what quantum really unlocks for us to be able to do that. So, it's going to be very, very good at broad categories that I've outlined, but that works in conjunction with GPU and CPU compute, so we create that spectrum of computing. So, two real things, Dave. One is the quantum compute capability itself. And then, secondly, at IBM, we're thinking hard about how we're going to be able to enable organizations to embrace that within that spectrum of compute and orchestrate their workloads into whichever bit of compute is relevant for them.

Dave Vellante

>> I think the other thing the audience should know is we talk about all the power and energy needed to run these AI factories. And that's really one of the big constraints now to develop all these tokens and the intelligence. Quantum doesn't take a lot of energy.

Mark Hughes

>> Not in the same way. So, that is one of the big advantages when you compare it to some of the GPU computing as well. So, that's a key consideration. Still, we need to have areas, data centers, obviously, where we have that quantum compute capability to enable organizations to have access to it, lots of considerations around latency and the like will be very prevalent as quantum comes online. And really, where we are now in our genesis of that, we see quantum really utility... There's some early adoption now, but really around '29, '30 is when we see real mainstream capability being able to be available and used in those areas that I talked about and perhaps many other areas that we haven't thought about yet.

Dave Vellante

>> I saw my friends in the crypto world and all my friends who don't own crypto say to me, "Wait till quantum computing comes out, you're going to lose all that crypto. " So, people are fearful of quantum. So, you hear this term like quantum- safe and quantum-readiness. So, what is that? What's the truth about quantum and what it is capable of doing and how organizations can protect themselves against attackers?

Mark Hughes

>> Well, that's a great question, Dave. So, look, within quantum computing, as I said earlier, there is this area where we're going to be able to solve complex algorithms in a way in which traditional computing can do, but it takes a very long time, months, if not years, to solve for. And the specific area is around the factoring that goes into cryptography that we use today, all day, every day. So, of course, the security team come up with one of the downside use cases of quantum straight off. And what that is that that compute capability is now going to be able to solve a thing called Shor's algorithm. And what that means is it's going to render asymmetric encryption vulnerable. So, in other words, at the moment, asymmetric encryption that we use, PKI and the like, it's extremely difficult for traditional computing to solve and essentially decrypt. It takes literally months, if not years, for that to happen. With the advent of quantum computing, one of the use cases in there is that the algorithm that can resolve, essentially break, if you want, the asymmetric crypto we use today will be able to be executed and therefore the asymmetric cryptography that we use today will become vulnerable. So, it's really less about quantum, per se. It's more about cryptography and the fact that now quantum's going to give us the ability to break asymmetric encryption.

Dave Vellante

>> So, that really is the catalyst for executives to start thinking about quantum. Let's assume it's coming. Let's assume it's coming next year, right? Which we know it's coming eventually and it'll be in production. You guys are going to show, I think 2026 is really a milestone year for IBM. But if I'm an executive say, "Okay, I want to prepare for this," what can I do today, right now?

Mark Hughes

>> So as I said before, the big thing is this is a cryptography challenge. Now, we all know cryptography. We used it for years in everything that we do. So, the first thing to do is to establish as an executive, what cryptography do you have running in your organization? And so, the initial phase, fairly straightforward, is just straight discovery exercise. So, what cryptography is there in that organization to start with? So, going through the estate, the IT environment that you're operating in, what crypt you have running? Where is it? And is it embedded in hardware? Is it software-driven? Those are key questions. So, there's a discovery exercise. Now, here at IBM, we've actually built some tools to help organizations do that. So, there is a software tool that we've built, which actually allows organizations to run that environment to discover what crypt they have in their environment. Now, this is something which every organization has lots of cryptography out there, but really understanding what it is and where it is not necessarily being as high a priority as it's going to need to become because what happens then, having discovered what crypt is available, then really the next step is, well, how vulnerable am I going to be now if that crypt is now vulnerable in the way in which I described with the advent of quantum computing? Now, we see that consideration around the time around 2029, 2030 is when the quantum compute capability is going to exist to be able to decrypt and run, as I said before, Shor's algorithm. So, that second phase is, well, knowing that now, what do I need to do as an executive, understanding where my crypt is, what action do I need to take? How do I now prepare? And there are a number of things that organizations can do. The first thing is, we at IBM have developed four quantum- resistant algorithms and they are now available. And so, there is the opportunity to replace some of that cryptography with cryptography that is quantum resistant, which is a good step. But not everything is going to necessarily need that from the get-go. There's some considerations around, for example, hardware. Can that cryptography be run in the same way that traditional cryptography is being run? The strings are longer, for example. So, there are a number of considerations that need to happen in that second phase about the strategy and the approach to cryptography migration that needs to be taken in the organization. So, relatively straightforward in the sense of discovery, then adopt and understand what the strategy and the approach should be. And then, really the third phase is then how to implement and make the changes necessary. Implement the quantum-resistant cryptography, work out where there may be existing cryptography that you want to encapsulate, for example. So, there are different approaches that we can do and we can work with our clients to help them get right.

Dave Vellante

>> So, Mark, a lot of the encryption is invisible to me because it's, like you said, in my hardware, maybe down to the storage device or the silicon. And you've got the discovery, the tooling, you've got these four quantum-resistant algorithms. How do I apply those deep into the stack? Do you work with partners to do that or do I create a shell around it? Explain how, as a technology executive, I can protect myself with those hidden encryptions.

>> Yeah, it's a great question.

Mark Hughes

>> So, firstly, we do work very extensively with partners. Obviously, there's a lot of crypt providers around, and so we work very closely with them to help them understand. And they have access now to those post quantum- resistant algorithms as well that we've developed here at IBM. So, it all really comes back to, well, what is that crypt doing? So, it's understanding the context within which that crypt is running in your organization, and that will determine what you actually do. So, in some cases, it will be, let's take a quantum resistant algorithm and replace that. So, that will be one area. As you said before, there is the opportunity to encapsulate existing cryptography to allow a service to run, because there's got to be a handshake, obviously, when we have public keys and the like, in the whole crypt ecosystem if you want, and really to then encapsulate that, so we can perhaps continue to run existing crypt within a quantum- resistant resistant shell. So, that's another approach that can be taken. And then, the other thing is, of course, working with partners is to say, look, you need to address this because your crypt is going to become vulnerable, so you need to do that. And therefore, in some cases, we see organizations where their partners need to really take the lead to ensure that they address it at the outset where perhaps that organization is a consumer of that cryptography.

Dave Vellante

>> So, let's assume we've plugged that threat. Is there another dimension, I'm sure there is, of quantum that can now protect me against attackers.

Mark Hughes

>> Yeah. - Can you explain that angle?

Mark Hughes

>> Yeah. So, that's really where we see the application

Dave Vellante

>> of quantum computing in a security space, like we're seeing, for example, the application of AI in the security space. So, in security overall, we've been pretty good over the years because of the challenge in computing in cybersecurity is how do you take vast amounts of signals and work out and detect where there is something that looks wrong going on. And so, the machine learning that we've built for over many years to enable that to happen now, we're really embracing AI to really now use that to really speed up and become more accurate in cybersecurity. And of course, quantum now brings yet another advent of our ability to be able to detect at speed and then deliver accuracy that we haven't been able to do and we will be able to do now when that advent comes out. Compute power is going to give us the ability to solve those complex algorithms that we often see in cybersecurity that we'll be able to now apply and help us defend better. Now, of course, that also has the other impact that just straightforwardly with that embroadening spectrum of compute, the attack surface is going to increase. Now, we're coming up to RSA, David, the big cybersecurity conference in San Francisco in a few weeks. And I really do feel that that's going to be a big topic of conversation beyond that crypt conversation as well, which is how do we not just embrace AI, but how do we ready ourselves for how that attack service is going to expand as we see the advent of quantum computing as well?

Dave Vellante

>> Okay. So, you got to shore up Shor's algorithm threats and then you can then protect yourself using quantum against the attackers. AI is ubiquitous. In fact, the attackers probably have better access or as good access to AI as the defenders, and they're probably as effective and capable of using AI. Will quantum be similar or different, in that will it be harder for the attackers to get access to that quantum technology, or do you expect that it will be as ubiquitous as AI is?

Mark Hughes

>> No, I think it's going to take time, right? So, at the moment, we see the only very early use cases, very early adoption of some exploratory work with quantum. I think there's some time yet before it becomes mainstream. Obviously, in the context of quantum-safe, as I was saying, it's a pretty binary thing. Once Shor's algorithm can be executed, well, in theory, therefore crypt is vulnerable. So, it's a binary thing. Large-scale adoption of quantum will come over time. And the ability for everyone, including threat actors, to use that capability, I think is going to emerge over time. But let's not forget, quantum is on that spectrum of compute and just the way in which threat actors use and power their ability with AI-driven capability and with traditional compute capability, yes, I can see certainly that they'll be embracing that as it becomes more mainstream and available.

Dave Vellante

>> Because essentially, it will be quantum-as-a-service that anybody can have access to, right?

>> Exactly. We see that happening in the future

Mark Hughes

>> because it will power so many, new things that we'll be able to do, which we're currently not able to do at the moment. That said, quantum won't be brilliant at everything. There's very big space for traditional and GPU compute, that will continue to exist for some time yet.

Dave Vellante

>> Well, I think you made that point early on, and that's an important point to stress is we have classical von Neumann computing and traditional CPUs. We have now extreme parallel processing with GPUs, quantum sits beside those and opens up new applications and use cases. Okay, you brought up RSA. I want to talk about AI a little bit. Ironically, our John Olsick wrote a post, a preview to RSA, and it said, "Ironically, the theme of RSA this year is collaboration. And yet, one of the main topics is going to be agents, machines, humans collaborating, but it's really going to be agents talking to each other. " So, that brings new threats.

Mark Hughes

>> It does. - Give us your point of view on the multi-

Dave Vellante

>> agent threat, what protecting AI means from IBM's perspective.

>> Well, I want to start actually with the other way around,

Mark Hughes

>> because we think about this in how do we embrace AI to protect ourselves? So, of course in cybersecurity and in IBM, we've been right at the forefront of being able to embrace and embed and build agentic AI into our security services, which is what we have now. And of course, that ability to be able to now run and leverage and use AI to defend better gives us that insight to understand how we can apply and how AI is being applied more broadly. Now, with that comes a lot of the considerations that we know, how have we thought about governance? Where does trust and how do we trust the AI and the language models that we've built and how do we have trust and essentially apply zero-trust principles to how now the agents work as well? So, we've done a lot of that thinking and the reality is what really is important when thinking about a trustworthy approach to AI and at IBM, that's what we're really all about is how do we establish and create trust in all of those great services is how do you start with understanding how you're deploying your AI into the enterprise, into the organization? And what I see many organizations perhaps struggling with is they have to think about how they're applying AI into the organization in a systematic way and not in a piecemeal, let's just do some early adoption over here and early adoption over there without the ability to then grasp the enormity of what the AI is going to offer for an organization, marshal that in a coordinated way across the organization. We're seeing a lot of early-stage adoption, a lot of experimentation, not necessarily seeing the benefits that we thought we'd see. And I think a lot of that is because we're not thinking about that comprehensively enough. Now, with that, Dave, coming to a question then comes, well, what are the security considerations we need to put around that? And that is something that I see many organizations not having thought about well enough yet. And the core thing around that is what data is being used? And actually, we know that pretty well. We've been working with data security for many years. So, what is the underlying data that is being ingested into the models? A lot of the enterprise use cases are based on small language models, which they're general purpose AI, small language models that are built. So, where's the data coming from? How's that being ingested? What's the security around that? Now, that's something we understand pretty well and we can do, but it needs to be thought of carefully. Then, you then have your agents that are running across that and of course, then comes that absolutely key question, which is the whole point of agents, they have agency, right? So, with that agency, how do you ensure that you have the right consideration around what levels of access they have and what levels of authority that they have to be able to then call on other agents beyond the way in which we just make a simple API call, that becomes now much more sophisticated. But it's containable in the sense that you know what models you've got, you know what agents you're building, you want them to perform various tasks, you can then have, and we developed this concept of IBM of a reflective agent, that essentially is there and built to observe to ensure that that agent is working within the parameters that it is expected to work. And so, really, that's our approach, which is to say we have our AI, our agentic AI that we've built, but we then have a series of reflective agents that look for, in a runtime context, what's actually going on and are they performing in a way in which we'd expect them to, and are they operating with the level of authority that they should be or not? So, it's not a human identity. It's not a service account if we think about it in that way. It's a new concept of identity which we now are really embracing, where we use AI itself to ensure that we can control the level of access that those agents have.

>> So, there's a couple of threads I want to pull on there

Dave Vellante

>> because humans have been the weak link in terms of cyber-defense. And Nir Zuk from Palo Alto, a founder of Palo Alto Networks a couple of RSAs ago, I think put it really well. It was profound in my view. He said, "Look, AI changes everything. Previously, we could stop 99% of the attacks, that 1% was left to the humans and the humans could do their best to keep up and generally, did a pretty good job. AI wipes that away because the humans can't now keep up with the machines to protect that 1%. So, you need machine intelligence to defend. " Okay. So, with that as the premise and the do over in cybersecurity, the second mega trend, and this is something that Nikesh Arora categorized, he coined the term platformization, tools consolidation. Now, when you talk to practitioners, they struggle, and you've touched on this before, all the complexity that they have, it's just another shiny new tool. So, we're starting to see a little bit of evidence that those tools can be consolidated, but then something comes along like MCP and multiple agents, so some new tool comes out. So, do you see that agents will allow you to reduce that complexity, so that humans can focus on the strategy and cleaning up that complexity as opposed to fighting fires?

Mark Hughes

>> Yeah, it's a great question. And yes, is the answer, right? Absolutely, it is. There are now those key platforms emerging. Palo Alto is one of them, we see others in the market as well. At IBM, we work extremely closely with Palo Alto and we are really seeing now less focus on the tools, which has often been the case. Let's think about it. We recently talked to over 1,000 of our clients, and on average they're running 80 tools from 34 different vendors. I mean, just when you're in a world where you have to speed up and become more accurate, because as you said before, the attackers now have the AI and they're using it to speed up themselves, that complexity just drives slowness and slowness of response, which is just not an option now. So, absolutely we're seeing less emphasis on specific tools, much more emphasis on buying into a platform approach, which allows you to be speedier. But also how agents now, the AI agents that we're building, which are highly-context aware, cannot just use those tools, but use other sources as well to now really give much more context to allow now those platformized tools to actually do a better job of what they are needing and we've always needed them to do. So, I think it's a combination of platformization on consolidation in the security space and you see, for example, Palo Alto is just recently in the process of acquiring CyberArk, and we've seen other consolidations happening as well. Palo Alto's also recently announced that they're acquiring CloudSphere as well. So, some really interesting consolidations and almost growth of that platform approach to encompass many different areas. So, that's one part of it, which we see a massive trend around that, but also then how do you deploy the agents across that? Because what we need is we have lots of different agents appearing in lots of these different solutions, but what we find at IBM with our clients is how do you orchestrate all those different things? Because obviously, it's not a one-size- fits-all, rip-and-replace. There's a transition period to get there and also agents with that context of where approach that they have, how do you orchestrate those agents in the context of the risk that is in that particular organization? So, I think it's both platformization, agents being deployed with that orchestration layer that's really going to supercharge cybersecurity in the coming months, really.

>> And that's really IBM's real deep value add is the how,

Dave Vellante

>> the how you apply this, what the timeline is, how you do it without breaking the bank, getting from point A to point B, what is possible and then how to get there. All right. Last question. We mentioned RSA, we talked about it a little bit. What are we going to see there from IBM? Set it up. Give us a plug.

Mark Hughes

>> Oh, it's going to be amazing. So, that orchestration piece, last year we talked about our autonomous threat operations machine, which is really where, in the SOC environment, we launched a load of agents that were working agentically. And I have to say the response, Dave, was astonishing. And everyone looked at it and went, "Really? Everyone else is talking about this. IBM, you're doing it. " And we are, and we've now deployed that to over 200 of our clients and we see some unbelievable outcomes there in terms of some of the traditional security operations space, really revolutionary. Much faster, much more accurate using those agents. When you think about how the human interaction used to be in the past, that's really done some great stuff. But now, we take it to the next level. Now, we talk about how do we now look at a much broader view of security and how do we take agents that are now very context aware. And not only are they context aware from the broader IT estate, so we're looking at how we ingest data from things like Sentinel Lake, which we've worked very closely with Microsoft on, but how do we now apply a much broader set of agents across that? And then, how do they themselves orchestrate outcomes in the broader IT environment? So, what you're going to see, at IBM, is we're going to be launching the next generation of our AI approach to cybersecurity and how we now can really orchestrate outcomes across an enterprise environment. As opposed to making security better, we're now looking at how we can make that application across the whole estate much better. And that's, Dave, what we're coining as ambient AI, so that's the next phase.

>> Oh, I love it. I love the term.

Dave Vellante

>> Mark, super informative session. I really appreciate it. So, RSA is coming up end of this month, the week of the 23rd, I believe in San Francisco, so we'll see you there.

Mark Hughes

>> Thanks so much, Dave. - Thanks so much for

Dave Vellante

>> coming to theCUBE, appreciate it.

>> Yeah. - And thank you for watching.

Dave Vellante

>> This is Dave Vellante for John Furrier.

Mark Hughes

>> We'll be right back at MWC in Barcelona, right after this short break.