They Already Have It
The encryption protecting your data is probably being collected right now by adversaries who cannot read it yet. When quantum computers arrive, they will be able to.
It leaves no trace. No alerts fire. No systems misbehave. The attack, if it is happening, looks identical to normal network traffic. The adversary captures encrypted data — patient records, financial transactions, strategic communications, diplomatic cables — and stores it. Then they wait. They wait for a quantum computer capable of breaking the encryption to exist. When it does, they decrypt everything they collected. The breach happened years earlier. The victim had no idea.
This is called harvest now, decrypt later. It is not a theoretical future scenario. The US Department of Homeland Security, the UK’s National Cyber Security Centre, the European Union Agency for Cybersecurity, and the Australian Cyber Security Centre have all issued official guidance stating that adversaries are already doing this. State actors and advanced persistent threat groups are collecting encrypted data at scale, banking on quantum decryption becoming available within the next decade or two.
The good news, and there genuinely is good news, is that the solution exists and has been standardised. In August 2024, after an eight-year international evaluation process, the National Institute of Standards and Technology (NIST) published three post-quantum cryptography standards that organisations can implement today to protect their systems against quantum attacks. The standards are ready. The algorithms are tested and approved. The path is clear.
The bad news is that most organisations have not yet completed, or in many cases begun, their cryptographic inventories.
Why current encryption breaks
Almost all public-key cryptography — the kind that secures your bank login, your email, your medical records, and the connections between servers that underpin the internet — relies on the difficulty of certain mathematical problems. RSA encryption, which is used to protect the majority of internet traffic, depends on the fact that factoring the product of two very large prime numbers is computationally infeasible for classical computers. The numbers are so large, and the factoring process so slow, that it would take longer than the age of the universe for a classical machine to break a properly implemented RSA key. The security is not derived from complexity of design. It is derived from the limits of classical computation.
A quantum computer running an algorithm called Shor’s algorithm — published by Peter Shor in 1994 (SIAM Journal 1997), thirty years before any machine existed that could run it at useful scale — can factor large numbers exponentially faster than any classical approach. What takes a classical computer millions of years takes a quantum computer, at sufficient scale, hours. RSA breaks. Elliptic curve cryptography, which is used in everything from TLS web security to blockchain transactions, breaks. Diffie-Hellman key exchange, used to establish secure connections, breaks. The mathematical foundations that the entire architecture of digital security is built on become vulnerable.
The security of RSA encryption is not derived from complexity of design. It is derived from the limits of classical computation. A quantum computer changes those limits. When it does, the encryption breaks.
The timeline for when a quantum computer capable of doing this will exist is genuinely uncertain. The most optimistic estimates suggest the early 2030s. More cautious assessments say the mid-to-late 2030s. Some researchers place it later still. What is not uncertain is that quantum computing is advancing rapidly, that the below-threshold error correction result demonstrated by Google in December 2024 validates the theoretical path, and that once a cryptographically relevant quantum computer exists, breaking encryption will be a matter of running software, not of further hardware development.
The harvest now, decrypt later threat means this uncertainty is beside the point for data that needs to remain confidential for more than a decade. A diplomatic communication encrypted today that must remain secret for twenty years is already at risk — because if an adversary captures and stores it now, they do not need to decrypt it today. They need to decrypt it before the twenty years are up. Medical records, legal correspondence, intellectual property, strategic financial plans, national security communications — all of these have lifespans that could extend into the quantum era. The relevant question is not when quantum computers arrive. It is how long your data needs to remain protected.
The standards are ready. The migration is not.
NIST’s three finalised post-quantum cryptography standards — ML-KEM (for key encapsulation), ML-DSA (for digital signatures), and SLH-DSA (a hash-based signature scheme) — are built on mathematical problems that quantum computers cannot efficiently solve. They have undergone eight years of rigorous international evaluation, involving hundreds of cryptographers across academia, industry and government. They are not experimental. They are ready to implement.
The transition timeline is clear. NIST’s guidance calls for quantum-vulnerable algorithms to be deprecated and ultimately removed from its standards by 2035, with high-risk systems expected to migrate considerably earlier. The NSA’s Commercial National Security Algorithm Suite 2.0 framework requires quantum-safe algorithms for all new US national security systems by January 2027, full application migration by 2030, and complete infrastructure migration by 2035 — with compliance cascading through defence contractors, federal agencies and regulated industries. The UK’s NCSC has published equivalent guidance with target dates for migration activities. The European and Australian cybersecurity agencies have done the same.
The post-quantum cryptography landscape in 2026:
NIST standards published: August 2024 — ML-KEM (FIPS 203), ML-DSA (FIPS 204), SLH-DSA (FIPS 205)
Fourth standard: HQC selected March 2025; FIPS 206 (FALCON) in development
NSA CNSA 2.0: New national security systems quantum-safe by Jan 2027; full migration by 2035
NIST goal: Widespread PQC adoption and deprecated classical algorithms by 2035
UK NCSC: Migration roadmap published March 2025; three-phase timeline to 2035
Harvest now, decrypt later: Active threat — DHS, NCSC, ENISA, ACSC all confirm adversaries collecting now
PQC market size: Projected to reach $2.84bn by 2030 (MarketsandMarkets)
Most at risk: Data with long confidentiality lifespans — healthcare, legal, financial, national security, defence
The problem is execution. Identifying where quantum-vulnerable algorithms are used across an enterprise turns out to be surprisingly difficult. Cryptography is embedded in operating systems, in hardware, in libraries, in protocols, in custom-built applications, in supplier systems, in legacy infrastructure that predates anyone currently working at the organisation. The protocols most at risk — TLS, which secures most internet traffic; IKE, used in VPNs; S/MIME, used in email; code signing — depend on public-key cryptography and will all need to be migrated. Some of these migrations are straightforward software updates. Others require hardware replacement, which takes years and significant capital expenditure.
The complexity is compounded by interdependency. The first step in any migration is a cryptographic inventory: a complete map of every system, protocol and library that uses cryptography. Most organisations do not have one. Building it requires examining every layer of the technology stack, including components provided by third parties who may themselves not yet have assessed their quantum exposure. The Federal Reserve’s research division published analysis in 2025 examining the harvest now, decrypt later threat to distributed ledger networks, finding that blockchain transactions committed today cannot be retroactively re-encrypted — making the permanence that gives blockchains their value also their greatest vulnerability to quantum attack.
There is also a practical distinction about symmetric encryption. AES-256 and the SHA-3 family of hash functions are not broken by quantum computers — or rather, they are weakened but not broken, in a way that is addressed simply by using larger key sizes that are already standard practice. The algorithms that break catastrophically under quantum attack are the asymmetric, public-key schemes. Organisations that have already moved to AES-256 throughout are not in as exposed a position as those still running older symmetric standards. But the public-key infrastructure that secures their communications, authenticates their users and signs their code is still vulnerable.
The standards to protect against quantum attacks were finalised in August 2024. The first step is a cryptographic inventory — a complete map of every system using quantum-vulnerable algorithms. Most organisations do not have one.
The new post-quantum algorithms come with larger key sizes and signature sizes than their classical predecessors, and some introduce performance overhead. Migrating to ML-KEM and ML-DSA is not a drop-in replacement for RSA everywhere — it requires careful implementation, particularly in constrained environments like embedded firmware, Internet of Things devices, and legacy systems with limited processing capacity. The industry’s guidance is to begin with hybrid deployments where possible: running the new post-quantum algorithms alongside existing classical schemes, so that security is maintained against classical attacks during the transition and gradually shifted to quantum-resistant-only. This is more complex than a clean cutover, but it is the responsible approach for systems that cannot afford any gap in protection.
What is actually at risk
The data categories most exposed to the harvest now, decrypt later threat share one characteristic: they need to remain confidential for a long time. Government and military communications — diplomatic cables, intelligence assessments, operational plans — are the most frequently cited category, because state actors with the capability to harvest at scale are the most likely harvesters, and national security data has the longest confidentiality requirements. The exposure is direct and serious.
Healthcare data carries similar risks. Medical records are retained for decades and contain some of the most personal information people generate. A patient’s HIV status, mental health history, genetic conditions, reproductive choices — all encrypted in hospital systems today, all potentially sitting in an adversary’s storage waiting for the tools to read them. The same applies to legal communications protected by attorney-client privilege, to research data underpinning pharmaceutical competitive advantage, to financial records containing the kind of material non-public information that could move markets if exposed years later.
The most alarming aspect of harvest now, decrypt later attacks is that they leave no visible signs. No files are corrupted. No systems are disrupted. No ransom note arrives. The breach is silent, and the damage is deferred. An organisation can be entirely unaware that its most sensitive communications from the past decade have been collected and are sitting in an archive waiting for decryption. By the time the damage becomes visible — when a quantum computer makes the archive readable — it is too late to protect the data that was already taken.
This is not a risk profile that fits the usual mental model of a cyber attack. Most security investment, most incident response planning, most board-level conversation about cyber risk is oriented around attacks that are visible and immediate. Harvest now, decrypt later is invisible and patient. The discipline it requires is different: not reactive, but anticipatory. The investment it requires must be made before any damage occurs, against a threat whose timing is uncertain, for a payoff that consists of nothing happening.
Who gets left exposed
What is not yet clear is who gets there first, and who is left last. The largest technology companies, banks and government agencies are already in the process of migration. What is not yet certain is whether the organisations that hold the most sensitive data about ordinary people — healthcare providers, legal systems, social service agencies — have the resources, the expertise, and the urgency to migrate before the threat becomes critical. A well-resourced adversary harvesting encrypted data at scale is not particularly interested in the records of major academic medical centres, which will likely be early adopters. It is interested in the records of district hospitals, GP practices and national health registries, which may be last.
Mosca’s Theorem, named after cryptographer Michele Mosca of the University of Waterloo’s Institute for Quantum Computing, states the problem precisely: if X is the number of years your data must remain secure, Y is the time required to complete your migration, and Z is the time before a cryptographically relevant quantum computer exists, then you must start migrating before X + Y exceeds Z. Every year of delay reduces the margin. For organisations with long-lived sensitive data, the margin may already be thin.
An organisation that has not yet begun its cryptographic inventory does not know which of its systems are most exposed. That inventory — a complete map of every system, protocol and library that uses cryptography — is the first step NIST, the NCSC, and every cybersecurity agency has now recommended. Identify the systems. Assess which data has the longest confidentiality requirement. Prioritise in order of exposure and sensitivity. Do not wait for a quantum computer to exist before beginning.
My Opinion
Every organisation has a security budget. What priority it receives depends on the nature of the business, the regulatory environment, the threats faced, and how many incidents have already landed. That calculus has always been reactive — weighted toward visible risks with measurable consequences. Post-quantum cryptography breaks that model completely. There is no incident to detect, no alert to fire, no visible breach to respond to. The only way to know you were compromised may be a ransom demand arriving a decade from now, or a disclosure you will never see. Cyber security needs a new conversation in the PQC world, and it needs to start with the organisations that cannot afford to have it — because those are exactly the ones holding the data that is most worth stealing.
Before the computers arrive
Does the organisation you work for, or depend on, have a cryptographic inventory — a complete map of every system using quantum-vulnerable encryption? If not, does it have a plan to produce one, and a timeline for when that will be done?
What data held by organisations you interact with — your bank, your GP, your employer, your government — has a confidentiality requirement that extends ten, fifteen, or twenty years into the future? Is any of it still protected by RSA or elliptic curve cryptography?
The harvest now, decrypt later attack leaves no visible trace. How would your organisation know if it had already happened? What would the discovery process look like, and is there a version of it that is not simply ‘when the quantum computer arrives and someone tells us’?
he organisations most likely to complete PQC migration early are the ones with the largest security budgets. The organisations holding the most sensitive data about the most people are often not those organisations. What does an equitable migration strategy look like — one that protects not just well-resourced institutions but the full range of data that needs protecting?
The breach that hasn’t happened yet does not have to happen at all.
Sources & References
Standards and official guidance
NIST Post-Quantum Cryptography Standards (August 2024): ML-KEM (FIPS 203), ML-DSA (FIPS 204), SLH-DSA (FIPS 205) https://csrc.nist.gov/projects/post-quantum-cryptography
NIST — HQC selected as fifth algorithm (March 2025): https://www.nist.gov/news-events/news/2025/03/nist-selects-hqc-fifth-algorithm-post-quantum-encryption
NIST IR 8547 (Initial Public Draft, November 2024): Transition to Post-Quantum Cryptography Standards — deprecation timeline to 2035 https://csrc.nist.gov/pubs/ir/8547/ipd
NSA — Commercial National Security Algorithm Suite 2.0 (CNSA 2.0): Quantum-safe deadlines for national security systems; January 2027 procurement gate https://media.defense.gov/2022/Sep/07/2003071836/-1/-1/0/CSICNSA_2.0_FAQ.PDF
UK National Cyber Security Centre — Timelines for migration to post-quantum cryptography (March 2025):Three-phase roadmap: assessment by 2028; prioritised upgrades 2028–2031; full migration by 2035 https://www.ncsc.gov.uk/guidance/pqc-migration-timelines
US Department of Homeland Security — Post-Quantum Cryptography: Official DHS guidance including harvest now, decrypt later threat confirmation https://www.dhs.gov/quantum
ENISA — Post-Quantum Cryptography: Current State and Quantum Mitigation: EU Agency for Cybersecurity guidance; EU coordinated roadmap targets high-risk systems by 2030, full transition by 2035 https://www.enisa.europa.eu/publications/post-quantum-cryptography-current-state-and-quantum-mitigation
Australian Cyber Security Centre — Post-Quantum Cryptography: Official ACSC guidance on harvest now, decrypt later threat https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/post-quantum-cryptography
Research and primary sources
Shor, P. (1994 / 1997) — Polynomial-Time Algorithms for Prime Factorization and Discrete Logarithms on a Quantum Computer: Note: first presented at FOCS 1994 (the date used in the article); the formal journal paper was published in SIAM Journal on Computing, 1997. https://arxiv.org/abs/quant-ph/9508027 SIAM Journal version: https://epubs.siam.org/doi/10.1137/S0097539795293172
Google Quantum AI — Willow processor announcement (December 2024): Below-threshold error correction result — first quantum chip to demonstrate error rates that improve as qubit count scales https://blog.google/innovation-and-ai/technology/research/google-willow-quantum-chip/
Federal Reserve Finance and Economics Discussion Series 2025-093: “Harvest Now, Decrypt Later” — analysis of harvest threat to distributed ledger networks; blockchain immutability as a specific vulnerability https://www.federalreserve.gov/econres/feds/files/2025093pap.pdf
Michele Mosca — Mosca’s Theorem: Co-founder and Deputy Director, Institute for Quantum Computing, University of Waterloo https://uwaterloo.ca/institute-for-quantum-computing/
Market data
MarketsandMarkets — Post-Quantum Cryptography Market (2025): PQC market projected to reach $2.84bn by 2030, CAGR 46.2% https://www.marketsandmarkets.com/PressReleases/post-quantum-cryptography.asp
You’re reading The Next Evolution by Neil Catton, articles that explore the human world and the intersection of technology, they try and ask difficult questions - not to scare - but to inform. If someone forwarded this to you, you can subscribe free at neilcatton.substack.com.
Neil Catton is the author of The Next Evolution, The Cognitive Crucible and The Shadow System - available on Amazon, and writes at the intersection of technology, ethics, and human purpose.