/wave, not bubble: cutting through the ai noise

Part two of a face-to-face conversation between James Carman and Sid Dutta, President and CEO of Privaclave AI. The first half was technical. This one is strategic: whether AI is a bubble or a wave, what a post-quantum encryption migration actually demands of an enterprise, why the loudest voices on AI are rarely the ones building with it, and what the layoff-and-blame-AI cycle is really about.

At a glance

Key takeaways

• A bubble is speculation. A wave is adoption. Sid separates the AI market from AI as a technology. Valuations can correct and companies can disappear without the underlying technology retreating, which is exactly what happened to the internet.
• The comparison he reaches for is the dot-com bust. "We had the internet bubble that busted, but internet won." Mobile and cloud followed the same shape: loud hype, a cooling-off, and then the thing quietly becomes how everyone works.
• AES is still considered quantum safe, and the older payment stack is not. Sid points out that a large share of point-to-point encryption in card terminals still runs on triple DES, an algorithm nobody would choose today, while the debate has moved on to whether AES-128 or AES-256 is the right floor.
• Grover's algorithm turned out to be less destructive than advertised. The original concern was that it would halve effective key strength, taking AES-128 down to 64 bits. Sid cites a more recent finding that the reduction is closer to 112 bits, which leaves AES-128 intact.
• The hard part of a post-quantum migration is the other end of the tunnel. Internal traffic is not where harvest-now-decrypt-later bites. The risk lives in encrypted tunnels leaving the enterprise, carrying billing data, settlements, and money movement, and every one of those partners has to upgrade on roughly the same schedule or the handshake quietly falls back to the weaker algorithm.
• "Our vendors are not ready" is not a reason to stand still. James raised the common excuse for deferring the investment. Sid disagreed with it flatly: vendors are commercially motivated to get there, and this is just the latest in a long line of migrations off algorithms that turned out to be breakable.
• Follow operators, not influencers. Sid's filter for AI commentary is whether the person has actually built something. He is skeptical of predictions from people with a governance background who have never configured a system, and he values posts that name a specific problem, the constraints around it, and what the tradeoff cost.
• James has a name for the underlying problem: the Kardashian effect. A phrase he coined on an earlier episode, for the way the appearance of authority has come to matter more than actually having it, and the way the platforms reward the appearance with clicks, speaking slots, and panels.
• You will not compete with AI. You will compete with people who use it. Sid frames the job question as two categories of humans rather than humans versus machines, and reaches for the ATM and the spreadsheet: tellers and accountants did not disappear, their tasks changed.

Host and guest

Frequently asked questions

Is AI a bubble?

Sid says no, and offers a distinction: bubbles are based on speculation, waves are based on adoption. He expects valuations to correct and some AI companies to disappear, and he does not expect the technology to retreat. His comparison is the dot-com bust, after which the internet kept winning.

Is AES encryption quantum safe?

Sid says AES is still considered quantum safe, including at 128-bit. The early worry was that Grover's algorithm would cut effective key strength in half, but he cites a more recent study putting the reduction at roughly 112 bits rather than 64. Most enterprises have been on AES-256 for years regardless, which he calls the safe posture.

Should we upgrade to post-quantum encryption if our partners cannot support it yet?

Yes, per the episode. The concern is that a partner who has not upgraded will force the handshake to fall back to a quantum-fragile algorithm, which is a real problem but not a reason to skip the internal work. Vendors are commercially motivated to catch up. James adds a practical note: if you are opening up the encryption layer anyway, implement crypto agility at the same time so the next migration is not another full project.

Where is the actual harvest-now-decrypt-later risk?

Not usually inside the enterprise network. It is in encrypted tunnels leaving the organization, particularly those carrying billing data, settlements, and money movement to strategic partners. That is where the episode suggests migration planning should concentrate first.

How do I tell credible AI commentary from noise?

Sid's filter is operators over influencers: follow people who are building with AI and can describe a specific problem, the constraints, and the tradeoffs they accepted on cost, security, or privacy. He is wary of confident predictions from people who are new to the field, and notes that a lot of it reads as generated content with no real-world experience behind it.

Is AI actually causing the layoffs?

Sid calls the framing oversimplified. Part of what is being labeled as AI-driven is a correction on over-hiring, and part of it is a story told to Wall Street, where cutting cost to fund AI investment reads as forward-thinking. He expects repetitive and rules-based tasks to be automated and the people doing them to move to different work, rather than a clean displacement.

Ship It or Skip It

Where to find Sid Dutta

Sid is on LinkedIn at linkedin.com/in/sid-dutta, and Privaclave AI is at privaclave.ai.

Got a topic for us?