Encrypted data captured today could be read once a capable quantum computer exists. The deciding question is which of your data must stay secret beyond that point.
Most security risks begin when an attacker acts against a live system. Harvest now, decrypt later is different. The damage is done in two stages that may be years apart: encrypted data is collected today, then read once a quantum computer powerful enough to break today’s public-key cryptography exists.
That gap changes how leaders should think about quantum risk. The question is not only when such a machine arrives. It is which of your data must still be secret when it does, and how long your organisation will need to move that data onto quantum-resistant protection.
What is harvest now, decrypt later?
In a joint quantum-readiness factsheet, CISA, the NSA and NIST warn that “cyber threat actors could be targeting data today that would still require protection in the future (or in other words, has a long secrecy lifetime), using a catch now, break later or harvest now, decrypt later operation.” The same attack is also described as store now, decrypt later.
The attack works because much of today’s confidentiality rests on public-key algorithms used to agree or exchange keys. The factsheet names RSA, ECDH and ECDSA among the algorithms that will need to be replaced. Traffic protected by these schemes can be recorded and kept. Nothing about it looks unusual at the time, and nothing has to be broken until the attacker has the means to do so.
Why the timing debate is the wrong place to start
Much of the public conversation about quantum risk focuses on predicting Q-day, the point at which a cryptographically relevant quantum computer exists. The NSA is direct about the limits of that exercise. Its CNSA 2.0 FAQ states: “NSA does not know when there will be a CRQC. Expert assessments disagree significantly about timing.”
A more useful framing appears in NIST’s initial draft of IR 8547, which sets out Mosca’s theorem. If X is the number of years your data must stay secure, Y is the time your migration will take, and Z is the time until a cryptographically relevant quantum computer exists, then you are already exposed whenever X plus Y is greater than Z. You cannot control Z. You can measure X and shorten Y.
NIST’s announcement of the final IR 8547 in October 2026 describes harvest now, decrypt later as “one of the main reasons why the transition to PQC is urgent”. NIST’s draft also notes that previous cryptographic migrations have taken more than a decade. For data that must stay confidential for ten years or more, waiting for certainty about Z is itself a decision to accept risk.
What it threatens, and what it does not
Harvest now, decrypt later is a threat to confidentiality. It matters most where key establishment protects data with a long secrecy lifetime: customer and patient records, financial and legal archives, intellectual property, defence and government material, and credentials or keys that will still be valid years from now.
Digital signatures face a different risk. NIST’s draft explains that authentication is not exposed to harvest now, decrypt later in the same way, because a signature check only needs the algorithm to be secure at the time it is performed. That does not make signatures a later problem. Systems with long service lives, firmware roots of trust and signing keys, including on-chain signing keys, must be migrated before a quantum computer can forge signatures, and the NSA flags firmware signing as an urgent priority. But for the specific harvest now, decrypt later threat, the first question is where long-lived secrets cross networks or sit in storage protected by quantum-vulnerable key exchange.
This is why NIST suggests that organisations might prioritise moving key establishment to FIPS 203 (ML-KEM) for long-lived sensitive data, often in a hybrid configuration that combines a classical and a post-quantum algorithm. NIST likens this to fitting two padlocks to the same door: an attacker has to defeat both.
How to prioritise systems when Q-day is unknowable
The UK NCSC’s PQC migration timelines guidance is clear that discovery comes first, and that it should include “a record of the data you hold (including its expected lifetime and its value to an adversary)”. The following steps turn that principle into a working priority list.
Record data lifetime and value. For each major data set, estimate how many years it must stay confidential and how much harm its disclosure would cause. This is the X in Mosca’s theorem, and it is usually a business judgement as much as a technical one.
Map where that data travels and rests. Follow long-lived data through TLS connections, VPNs, SSH, messaging, APIs, backups, archives and partner links, in both on-chain and off-chain infrastructure. Harvesting happens wherever encrypted traffic or stored ciphertext can be captured.
Identify the cryptography protecting it. Record the algorithms, key sizes, libraries, certificates, protocols and hardware in each path. The CISA, NSA and NIST factsheet recommends asking vendors for lists of the cryptography embedded in their products and for their post-quantum roadmaps.
Estimate migration effort. For each system, judge how long a move to post-quantum key establishment would take, including testing, supplier dependencies and change windows. This is the Y in the equation, and it is often longer than teams expect.
Rank by exposure. Systems where long-lived, high-value data is protected by quantum-vulnerable key exchange, and where migration will be slow, go to the top of the list. Short-lived data on systems that are easy to change can follow.
Migrate, test and keep evidence. Start with hybrid key establishment where it is supported, and build in cryptographic agility so algorithms can be changed again. The NCSC recommends testing that systems are not quietly falling back to traditional cryptography. Keep a record of what changed and when.
The NCSC also cautions that large organisations should expect discovery and planning alone to take two to three years. That is a strong argument for starting with the highest-value data rather than waiting for a complete inventory before acting.
The milestones already on the calendar
Even without a firm date for Q-day, regulators and standards bodies have set dates of their own. These are the ones most often cited in board discussions:
NCSC: complete discovery and build an initial migration plan by 2028, complete the highest-priority migrations by 2031, and complete migration by 2035 (NCSC).
NSA CNSA 2.0: from 1 January 2027, new national security system acquisitions must support CNSA 2.0, equipment that cannot support CNSA 2.0 to be phased out by 31 December 2030, and CNSA 2.0 mandated by 31 December 2031 (NSA).
NIST: the initial draft of IR 8547 proposed deprecating quantum-vulnerable algorithms after 2030 and disallowing them after 2035 (NIST IR 8547 draft).
Financial sector: the G7 Cyber Expert Group has published a statement on advancing a coordinated roadmap for the transition to post-quantum cryptography in the financial sector (HM Treasury).
QuantSec tracks these and other deadlines, with links to every primary source, on our regulatory clock.
Where QuantSec fits
QuantSec is a quantum security firm. We help organisations find the cryptography in their systems that a quantum computer could break, decide what to fix first, and prove the work has been done.
Our vulnerability mode scans on-chain and off-chain infrastructure, code and dependencies for quantum-vulnerable cryptography and classifies each finding by severity and exposure. The result is a digitally signed quantum security report with a migration plan and attack-surface analytics, so security teams, executives and boards are working from the same evidence. Anyone can check that a report has not been altered, because its digital signature must match its content.
Where teams need hands-on support, our quantum migration as a service team remediates agreed findings, tests the changes and returns the release for signing. You can read more about how we work with regulated institutions and enterprises, or about who we are.
A practical first step
Harvest now, decrypt later rewards early action because the data being collected today cannot be protected retrospectively. Start by naming an owner, listing the data sets that must stay confidential for the longest, and tracing the cryptography that protects them in transit. That short list is the foundation for everything else.
If you would like help scoping that first assessment, contact our team. Pricing is available on request.
Sources
CISA, NSA and NIST: Quantum-Readiness: Migration to Post-Quantum Cryptography
NIST: NIST report provides guidelines for transition to post-quantum cryptography (October 2026)
NIST IR 8547 initial public draft: Transition to Post-Quantum Cryptography Standards
NIST: NIST releases first 3 finalized post-quantum encryption standards
HM Treasury: G7 Cyber Expert Group statement on a coordinated PQC roadmap for the financial sector
Find out what a quantum computer could break in your estate
QuantSec scans your on-chain and off-chain systems for cryptography a quantum computer could break, then delivers a digitally signed report with a prioritised migration plan. When you are ready to act, our team can carry out the post-quantum migration with you.
