Harvest Now, Decrypt Later: Why Your Cryptographic Inventory Can't Wait Until 2030

 

Attackers can copy encrypted data today and keep it until a quantum computer is powerful enough to break the public-key algorithms that protect it. That is "harvest now, decrypt later", and it is why the EU's post-quantum roadmap puts the first steps, including an inventory of where cryptography is used, at the end of 2026 rather than 2030.

If your data has to stay confidential for ten years or more, the risk already applies to you.

Key Facts

·       The EU's Coordinated Implementation Roadmap for the transition to post-quantum cryptography (PQC) was published in June 2025 by the NIS Cooperation Group.

·       By the end of 2026, first steps should be under way, including inventories of cryptographic assets.

·       By the end of 2030, high-risk use cases should be quantum-safe; the roadmap says quantum-vulnerable public-key mechanisms should not be used on their own after that.

·       By the end of 2035, the transition should cover as many systems as feasible.

·       NIST published the first PQC standards, FIPS 203, 204 and 205, in August 2024.

 

What does "harvest now, decrypt later" mean for your data?

It means the confidentiality of data you send today depends on cryptography that may be broken tomorrow. The question is not when quantum computers arrive, but how long your data must stay secret. Contracts, health records, intellectual property and customer data often need protection for a decade or longer, so they are exposed now if they travel over quantum-vulnerable connections.

Why start with a cryptographic inventory?

You cannot migrate what you cannot see. Cryptography sits in TLS connections, VPNs, certificates, code signing, databases, backups, cloud services and connected devices, and much of it comes from suppliers.

A useful inventory records, for each use: the algorithm and key length, where it runs, who owns it, what data it protects, how long that data must stay confidential, and which supplier controls the change.

How do you build one without stalling the business?

1.     Start with the data that must stay secret longest, and trace the systems and connections it passes through.

2.     Automate discovery of certificates, TLS configurations and libraries instead of relying on spreadsheets alone.

3.     Ask suppliers for their PQC plans and add them to your third-party risk management reviews.

4.     Prioritise migration work by data lifetime and exposure, and design for crypto-agility so algorithms can be swapped without rebuilding systems.

We help organisations map and classify sensitive information through data discovery and classification and broader data protection work, which gives the inventory its starting point.

Frequently asked questions

Can quantum computers break today's encryption yet?

No quantum computer capable of breaking widely used public-key cryptography is publicly known to exist. The concern is data stolen now and decrypted later.

Is AES encryption also at risk?

The main risk is to public-key algorithms such as RSA and elliptic-curve cryptography. Symmetric encryption with sufficiently long keys, such as AES-256, is considered far less exposed.

What are FIPS 203, 204 and 205?

They are NIST's first post-quantum standards: ML-KEM for key establishment, and ML-DSA and SLH-DSA for digital signatures.

What to do next

2030 sounds far away, but inventories, supplier changes and testing take years. Starting the inventory now gives you a realistic migration plan instead of a rushed one. Talk to us about a cybersecurity risk assessment that includes your cryptographic exposure.


Comments

Post a Comment

Popular posts from this blog

Beyond Models: How AI Systems and Autonomous Agents Are Transforming Business

Image
  Chances are, you’re already using automation in your business in the form of scheduled emails or chatbots that follow set replies. They do save time, but you’ve likely noticed their limits. The moment something unexpected happens, those systems struggle. They follow fixed rules, so you end up stepping in to fix issues or keep them updated. With artificial intelligence systems and autonomous agents, you can do more and further reduce manual work. Instead of following a script, they look at what’s happening around them and think through a goal before deciding what to do next. That means they can handle multi-step tasks and adjust when things change. Your AI systems and autonomous agents can even learn from the results and get better over time. And with a clear artificial intelligence roadmap, you can start building systems that support your business long term. Here’s how artificial intelligence systems and autonomous agents can deliver measurable value to your business. ...
Read more

Trust as a Cybersecurity Strategy: Building Resilient Digital Systems

Image
  As the cybersecurity landscape evolves, your organisation needs powerful, adaptive solutions to combat increasingly sophisticated threats. Security Information and Event Management (SIEM), combined with Zero Trust security models, can become indispensable tools to safeguard your data and systems. With SIEM and cybersecurity strategies, you gain comprehensive visibility and robust security protocols. You can even combine them with Zero Trust policies so your business stays proactive in addressing modern cybersecurity challenges. Understanding SIEM SIEM collects data from different parts of your network, such as your devices and users, and then brings everything into one place. From there, it analyses that data so you can spot issues early and act fast. With SIEM cybersecurity, you can: ·      Detect threats as they happen instead of after the fact ·      Keep track of compliance requirements through reporting and audits ·  ...
Read more

AI Strategy and Roadmap Is Not a 60 Metre Sprint

Image
  Opportunity: Unlocking Long-Term Value with AI AI delivers durable value when treated as a capability, not a series of disconnected pilots. Organisations that govern AI and embed it into operations see measurable ROI — faster decisions, improved efficiency and new product capabilities. The prize is long‑term, repeatable value rather than one‑off wins. The challenge Tool sprawl — teams adopt overlapping models and tools without a central inventory or oversight. Data quality gaps — abundant data does not equal usable data; inconsistent or poorly structured inputs produce unreliable outputs. Model drift and ownership gaps — pilots degrade in production when no one monitors performance, bias or security. Regulatory and ethical exposure — ungoverned pilots accumulate compliance debt under rules like the EU AI Act and GDPR. How to Turn AI Strategy into Action Define value first. Prioritise use cases b...
Read more