The computer in a locked room
Imagine a computer disconnected from every network, sealed in a room and powered off. It would be difficult to hack remotely. It would also be of limited use, and someone with physical access might still take it apart. Now connect it, let people log in and ask it to do valuable work. Each useful capability creates another route by which mistakes or attackers may reach it.
“Unhackable” sounds like a technical specification, but it hides a question: secure against whom, doing what, for how long? Protecting a photo from a casual thief differs from protecting a hospital system against a determined criminal group. Meaningful security begins with a threat model, not a promise of absolute invulnerability. NIST's Cybersecurity Framework treats security as ongoing risk management rather than a final state.¹
Encryption is strong, but only in its lane
Modern encryption can make intercepted data practically unreadable without a key. It is one of computing's great successes. Yet encryption protects information under particular conditions. If a user is tricked into revealing a password, the attacker may enter through the front door. If malware runs on a computer before the message is encrypted or after it is decrypted, it can read the plain text. The mathematical lock may remain intact while the surrounding room is compromised.
Authentication addresses a different problem: is the person or device requesting access really who it claims to be? Multi-factor authentication can make stolen passwords less useful, but methods vary and users can be deceived into approving a request. Access controls, updates and backups tackle further parts of the problem. None can substitute for the others.
A secure design therefore tries to contain failure. A user account should not have more power than it needs. A damaged application should be separated from more sensitive data. Logs and monitoring can reveal unusual behaviour. Backups allow recovery after a destructive attack. NIST's framework explicitly groups work around governing, identifying, protecting, detecting, responding and recovering.¹ A system that can recover well may be safer in practice than one that claims never to be breached.
The machine beneath the software
Computers are physical devices. Their processors, memory, storage and peripheral components can contain design flaws or be manipulated by someone with access. Firmware can be a target before an operating system starts. Side-channel attacks can infer information from timing, power use or other physical effects. Even a carefully audited application rests on layers it did not write.
Software adds its own uncertainty. Large programs contain errors, and attackers look for combinations of mistakes that developers did not anticipate. Patches close known openings while new features create new code to examine. Complexity is not proof of insecurity, but it makes a universal claim about the absence of all vulnerabilities exceptionally hard to establish. Supply chains broaden the boundary still further. A device may rely on parts, libraries or update services supplied by other organisations. If one of those is compromised, the user's own code can be flawless and the system still be exposed. Careful purchasing, testing and update controls reduce this risk; they cannot erase dependence on others.
The human layer is equally real. A convincing message may persuade an employee to approve a payment or share a code. A malicious insider may already have legitimate access. Training helps people recognise risks, but good system design assumes that someone will occasionally make a mistake and limits what that mistake can expose.
Would quantum technology change the answer?
Quantum computers are often cast as both the ultimate hacking tool and the ultimate defence. Neither description is right. A sufficiently capable future quantum computer could threaten some widely used public-key cryptography. NIST has approved standards for post-quantum key establishment and digital signatures designed to resist such attacks.² Organisations will still need to deploy them correctly and replace vulnerable systems over time.
Quantum key distribution uses physical properties of light to distribute key material and can reveal certain forms of eavesdropping. It does not authenticate the sender by itself or secure the devices at either end. The US National Security Agency warns that real deployments depend on engineering and trusted infrastructure, not on a magical guarantee from physics.³ A perfectly distributed key is little help if a compromised laptop displays the secret to an attacker.
A computer with no external access and a narrowly defined task can approach a very high level of assurance against some threats. But access, power, updates, supply chains and eventual disposal still have to be managed. The scope of the claim matters: “resistant to this class of remote attack under these assumptions” is a meaningful statement; “unhackable” is not.
What security can honestly promise
A sound security plan asks what matters most and what failure would cost. It uses well-tested encryption, strong authentication, timely maintenance and limited permissions. It watches for incidents, rehearses responses and maintains recoverable copies of important data. The goal is to make attacks harder, less rewarding and less damaging, while allowing legitimate work to continue.
This approach also changes how a breach is judged. A stolen password should not automatically unlock everything; a compromised device should not destroy the only copy of a record. Layers of protection and recovery make failure survivable, which is a more demanding design task than choosing an impressive lock.
That may sound less satisfying than an invincible computer. It is also more useful. Security is an activity that must survive new attackers, new technologies and ordinary human fallibility. A system earns trust by explaining its limits and improving when tested, not by declaring that no one will ever get in.