Harvest now, decrypt later: quantum risk starts today

An unreadable message can still be a valuable target

For an attacker, a confidential message does not have to be readable today to be worth collecting. If the cryptography protecting it is vulnerable to a sufficiently capable future quantum computer, intercepted communications can be stored for decryption later. This is the logic of 'harvest now, decrypt later': collection can happen before the machine needed to exploit it exists.

That changes the security question from whether a message is safe today to whether it can remain confidential for its entire useful life. A payment instruction may be executed in seconds, but the customer's financial history, a confidential negotiation, or a defense design may need protection for years. The transaction can be complete while the confidentiality obligation continues.

The relevant timeline combines the time needed to migrate with the years information must remain secret. Waiting for certainty about quantum hardware can therefore leave too little time. A future upgrade can improve protection for new communications, but it cannot retrieve copies that an adversary has already intercepted.

Which parts of encryption are actually exposed?

Quantum computing does not make every cipher easy to break. The sharpest structural threat concerns widely deployed public-key cryptography: RSA and elliptic-curve schemes used for key establishment and digital signatures. Shor's algorithm could defeat their underlying mathematical assumptions on a sufficiently large, fault-tolerant quantum computer.

Symmetric encryption such as AES has a different risk profile. Grover's algorithm offers a theoretical quadratic improvement in exhaustive search, with substantial practical constraints. Guidance from the US National Institute of Standards and Technology (NIST) allows continued use of AES and distinguishes this issue from replacing quantum-vulnerable public-key algorithms. The claim that all encryption suddenly becomes worthless obscures where migration is needed.

Confidentiality is only half the picture. Digital signatures underpin software updates, trusted identities, transaction authorization, and device authentication. A transition that upgrades data encryption while leaving the mechanisms that establish trust untouched would remain incomplete.

Research is changing the resource assumptions

Public research illustrates why a security plan should not depend on a fixed qubit threshold. Craig Gidney's 2025 study estimated that RSA-2048 could be factored in under a week using fewer than one million noisy physical qubits, under specified error-correction and control assumptions. This was a resource estimate, not a demonstration of a working attack.

In March 2026, Google researchers reported a separate estimate for the 256-bit elliptic-curve discrete logarithm problem: fewer than 500,000 physical qubits and a runtime of minutes under their assumed hardware model. The two studies target different mathematical problems; their figures are not interchangeable. Neither establishes that today's available machines can perform those attacks.

The decision-relevant lesson is that advances in algorithms and error correction can reduce the hardware required for an attack. Hardware roadmaps alone are consequently a weak basis for deciding how long existing cryptography will remain adequate.

The replacement algorithms are already available

Post-quantum cryptography, or PQC, runs on classical computing infrastructure. It uses mathematical constructions designed to resist known classical and quantum attacks. Organizations do not need to acquire a quantum computer to start implementing it, and PQC should not be confused with quantum key distribution, which requires a different communications architecture.

NIST published three initial standards in August 2024: ML-KEM in FIPS 203 for establishing shared secret keys, and ML-DSA and SLH-DSA in FIPS 204 and 205 for digital signatures. A key-encapsulation mechanism helps establish a key; it does not replace the symmetric cipher that subsequently encrypts a data stream.

Having a standard changes the investment question. The obstacle is no longer simply whether a resistant algorithm can be developed. It is whether an institution can integrate appropriate implementations across protocols, certificates, hardware, suppliers, and operating procedures without creating new weaknesses.

Finance, communications, AI, and defense share a trust dependency

In banking, the issue includes confidential records, signed payment messages, interbank connectivity, and the systems that authorize transfers. Operational continuity matters as much as the cryptographic mathematics: a stronger signature scheme that overwhelms a processing path is not yet a successful deployment.

Telecom and digital infrastructure depend on authenticated devices, network management, secure software delivery, and protected links between operators and service providers. Replacing a browser handshake does not automatically upgrade the equipment, management channels, and trust roots behind it.

AI expands the number of valuable data flows: proprietary training material, model artifacts, prompts, and sensitive outputs cross organizational boundaries. Quantum risk attaches to the cryptographic protection of those flows and their infrastructure. It does not mean every AI model becomes vulnerable to a new mathematical attack merely because it uses AI.

Defense, aerospace, government, and research institutions face an additional timing problem. Sensitive information and deployed platforms may have long lifetimes, while hardware roots of trust can be expensive or impossible to replace remotely. Their migration priorities should reflect those lifetimes rather than a generic technology adoption calendar.

The implementation gap is already measurable

The Bank for International Settlements (BIS) Project Leap phase 2 report, published in December 2025, described experiments that replaced traditional signatures with post-quantum signatures while sending liquidity transfers in an existing payment system. The successful tests demonstrated feasibility and exposed performance and interoperability work that still needed to be addressed. They were experiments, not evidence that the financial system had completed migration.

Cloudflare's October 2025 report showed post-quantum protection on over half of human-initiated traffic reaching its network, while only 3.7% of the origins it connected to supported post-quantum key agreement. These figures describe different populations and that reporting period, not an Internet-wide readiness score or proof that every connection to a supporting server was protected.

Our reading of these findings is that adoption at one boundary can coexist with significant exposure elsewhere. A protected browser-to-edge connection does not establish post-quantum protection on the edge-to-origin connection, let alone on internal services or digital signatures. An enterprise needs a map of the complete trust path, not a single 'quantum-safe' badge.

Domestic capability is a sovereignty requirement

Every country has a strategic interest in being able to understand and control this transition. That requires domestic cryptographic research, implementation expertise, independent evaluation, security engineering, and the institutions that can turn findings into procurement and operational practice. For countries with limited specialist resources, trusted regional cooperation can help build that capability.

A national algorithm developed behind closed doors is not automatically safer than an international standard. NIST's standards emerged from international submissions and public scrutiny. Domestic teams should contribute to that scrutiny, challenge assumptions, and develop auditable implementations rather than substitute secrecy for assurance.

The practical sovereignty questions are who controls the keys, who can inspect the cryptographic components, who can replace a supplier, and who can maintain critical systems during a transition. A country may adopt internationally standardized mathematics while developing strong domestic control over its implementation, key custody, testing, and lifecycle management.

This is an argument for sustained capability development: universities, national laboratories, telecom operators, banks, defense companies, and qualified local suppliers working to interoperable standards. Buying a product can provide functionality. Building the expertise to evaluate and change it provides strategic freedom.

Resilience requires the ability to change again

Quantum-resistant does not mean permanently immune to all future discoveries. In its July 2026 update, NIST recorded the withdrawal of HAWK, a candidate signature scheme, following a reported vulnerability. NIST explicitly stated that the finding did not affect its finalized PQC standards. A candidate being rejected and an adopted standard being broken are materially different events.

The wider lesson is cryptographic agility: knowing where algorithms are used and being able to replace them under controlled conditions. Strong mathematics also needs correct implementations, reliable randomness, protected keys, side-channel resistance, and tested failure behavior. An algorithm name on a procurement document proves very little about those properties.

A sensible transition should evaluate vetted hybrid approaches where appropriate, test the effect of larger keys and signatures, and check that compatibility mechanisms do not silently restore vulnerable behavior. The objective is a system that remains governable as the evidence changes.

Migration dates are planning targets, not quantum forecasts

The UK's National Cyber Security Centre (NCSC) recommends discovery and initial planning by 2028, priority migration by 2031, and completion by 2035. The EU's coordinated roadmap recommends that Member States begin transition by the end of 2026 and address high-risk uses as soon as possible, no later than the end of 2030. These are jurisdiction-specific planning frameworks, not a universal legal deadline or a prediction of when an attack-capable quantum computer will arrive.

The convergence is nevertheless significant. Public authorities are treating migration as a multi-year infrastructure task. Boards should ask for an inventory of cryptographic dependencies, owners for the most sensitive data and systems, evidence from supplier roadmaps, and staged implementation budgets. Progress should be measured by exposure removed and trust paths verified, rather than the number of quantum-labelled pilots launched.

The machine can arrive later. The decision cannot.

Harvest now, decrypt later makes the cost of waiting asymmetric. An organization can postpone a migration decision; an adversary collecting vulnerable encrypted communications does not have to postpone collection. Information that needs years of confidentiality cannot be protected by a promise to upgrade later.

No precise quantum arrival date is needed to start identifying long-lived secrets, mapping cryptographic dependencies, testing interoperable replacements, and developing domestic expertise. Countries and companies need the ability to verify and change the foundations of digital trust. The decisive question is not when the machine will arrive, but which information they cannot afford to expose before it does.