Hackers can steal your encrypted data today. Quantum could unlock it tomorrow.

Imagine discovering in the 2030s that confidential information transmitted by your organisation a decade earlier can now be read by an attacker. The data was encrypted when it was sent. Your organisation had implemented recognised security controls. Its systems passed security assessments, and there was no evidence at the time that the encryption had been broken. Yet an attacker had quietly collected copies of encrypted communications years earlier. They did not need to decrypt the information immediately. They only needed to store it until sufficiently advanced quantum computing technology became available. This scenario illustrates a cyber security risk known as Harvest Now, Decrypt Later.

The concept is straightforward: attackers collect information protected by certain encryption methods today, hoping to overcome those protections with future technology. When quantum computers will become capable of breaking widely deployed public-key cryptography at scale remains uncertain. However, the uncertainty surrounding the arrival of that capability does not eliminate the business risk. For organisations handling sensitive information that must remain confidential for years or decades, the exposure may already be developing.

The question for business leaders is no longer limited to whether information is secure today. It is whether that protection will remain effective throughout the information’s useful life.

Quantum computing promises significant advances across industries, from scientific research to financial modelling. However, it also presents a long-term challenge to the technology’s organisations rely on to protect confidential information.

Many digital services use encryption and related cryptographic mechanisms to secure customer information, financial transactions, and sensitive business communications. Some of these protections could become vulnerable when sufficiently powerful quantum computers become available. The concern is not that all encrypted information will suddenly become accessible. Rather, certain widely used cryptographic methods could be compromised, potentially exposing information that attackers have already collected and stored.

For executive leadership, the question is not how quantum computing breaks encryption. It is what the organisation stands to lose if sensitive information becomes accessible in the future.

Consider the information your organisation holds or exchanges:

The financial and operational consequences will vary depending on the nature of the information, how it was obtained, and whether it remains valuable when disclosed.

The key concern is that some confidential information remains sensitive long after it has been transmitted or used. Medical records, intellectual property, and certain government information may require protection for decades. If attackers collect this information in encrypted form today and successfully decrypt it in the future, its disclosure could still result in significant business, legal, or reputational consequences.

This makes protecting the long-term confidentiality of information a business risk management responsibility, not simply a technical security issue.

Organisations typically prioritise cyber security investment based on the likelihood and potential impact of threats they face today. While this approach makes sense for many operational risks, Harvest Now, Decrypt Later introduces a challenge that is easy to overlook: attackers may be collecting sensitive, encrypted information years before they have the technology needed to read it.

Consider what this means for an organisation that decides to delay preparing for quantum-resistant security. They may eventually upgrade their encryption technologies, only to discover that attackers had already captured years of confidential communications. Although the new protections could secure future communications, they cannot necessarily protect historical information that has already been collected.

The challenge goes beyond protecting past information. Most organisations have encryption embedded throughout their networks, business applications, cloud services, identity systems, and supplier platforms. Changing these cryptographic foundations is rarely straightforward, particularly for large enterprises with complex technology environments.

A successful transition may require software upgrades, infrastructure changes, supplier negotiations, compatibility testing, and coordination across multiple business and technology teams. Depending on the organisation's size and existing dependencies, completing this work could take several years and require significant investment.

This raises an important question for executive leadership: is it better to understand the organisation's exposure now and plan the transition over time, or wait until the available options become more limited and potentially more expensive? The decision is not simply about purchasing new security technology. It is about giving the organisation enough time to understand its risks, prioritise critical systems, allocate investment, and manage the transition without unnecessary disruption. Delaying the assessment may postpone the immediate expenditure, but it could also reduce the organisation's ability to plan, prioritise, and control the eventual cost of migration.

There may also be a competitive dimension. Organisations that can demonstrate credible quantum-readiness may be better placed to win contracts that require supply-chain security assurances, avoid premium-priced late migration, and reassure investors and regulators that long-term risks are being managed.

The UK’s National Cyber Security Centre (NCSC) official guidance sets out three key milestones for organisations to transition to quantum-resistant encryption, with 2035 as the target for full completion.

The roadmap identifies three significant milestones:

For leadership teams, the immediate question is: Do we have a credible plan, accountable ownership, and sufficient visibility to meet these milestones?

Executive leadership needs assurance that the organisation understands its exposure to quantum related security risks, has established clear accountability, and is making informed decisions about how those risks should be managed.

The following five priorities provide a practical starting point for assessing exposure, planning investment, managing supplier dependencies, and demonstrating measurable progress.

Understanding the organisation's exposure to future quantum threats should begin with the business, because identifying which information needs long-term protection requires more than technical expertise. Business and data owners should work with security, IT, legal, compliance, and risk management teams to identify sensitive information, establish how long it must remain confidential, and assess the consequences if it becomes accessible in the future.

For example, some operational information may lose its sensitivity within months, while medical records, intellectual property, and certain government information may require protection for decades. Understanding these differences helps the organisation identify where future disclosure could create significant financial, legal, operational, or reputational consequences.

The CISO and CIO can then use these business requirements to assess how sensitive information is currently protected, identify where existing encryption and related security technologies could become vulnerable to future quantum attacks, and determine which systems should be prioritised for further assessment or migration.

The objective is to establish a business led understanding of which information is most at risk, why its confidentiality matters, and where protection should be prioritised.

Once the organisation understands which information requires long-term protection, the next step is determining whether its existing cryptographic technologies can provide that protection. This assessment should examine critical applications, infrastructure, external communications, and outsourced technology services to identify dependencies on cryptography that may become vulnerable to future quantum attacks. The findings should help leadership understand the scale of the exposure, the systems requiring attention, and the dependencies that could complicate migration.

Management should also explain the limitations of its cryptographic risk assessment, particularly gaps in information about legacy systems or third-party suppliers.

Once the major dependencies and risks have been identified, management should develop a prioritised migration strategy that aligns with the organisation's technology investment and resilience plans.

Not every system needs immediate replacement. Instead, priorities should reflect business criticality, information sensitivity, technology lifecycles, supplier readiness, and operational constraints. Integrating post-quantum migration with planned infrastructure modernisation and application upgrades can help organisations manage costs and reduce unnecessary disruption. The goal is to invest where the business risk justifies action while maintaining a clear roadmap for the remaining systems.

Many organisations depend on third parties for the cryptographic technologies protecting their information. Cloud providers, software vendors, telecommunications providers, and managed service partners can therefore influence how quickly and effectively an organisation transitions to post-quantum cryptography.

Executive leadership should expect management to understand which critical suppliers are responsible for delivering quantum-resistant capabilities and how their migration plans affect the organisation's own readiness.

Supplier roadmaps, contractual commitments, and procurement requirements should reflect these dependencies. Where vendors claim their products are quantum-ready, management should seek supporting evidence showing which capabilities are available, what has been implemented, and when outstanding dependencies will be addressed.

Quantum readiness should become part of established cyber security governance rather than an isolated technical initiative.

Relevant Board reporting could include:

These measures should be supported by evidence and reviewed through the organisation’s existing risk and assurance arrangements.

The Board should be able to distinguish a programme that is merely producing plans from one that is demonstrably reducing material exposure.

Although post-quantum migration involves technical changes, accountability for protecting sensitive business information extends beyond security and IT teams.

Business and data owners are responsible for identifying the information that is critical to the organisation and explaining the consequences of its disclosure. The CISO should assess the associated cyber security risks and advise on appropriate security requirements, while the CIO and CTO should ensure that those requirements are reflected in technology strategy, architecture, and delivery plans.

Legal, compliance, and risk management functions also have important roles in assessing confidentiality obligations, regulatory exposure, and risk treatment decisions. Where migration requires material investment, the CFO should help evaluate funding priorities and financial implications.

Executive leadership and relevant governance committees should oversee whether the organisation's response is proportionate to its business risk.

Completing technical upgrades does not necessarily mean that the organisation has reduced its most significant business risks. For example, an organisation could migrate numerous systems to post-quantum cryptography while leaving critical services that handle sensitive information dependent on vulnerable technologies.

Executive leadership should therefore look beyond the number of systems upgraded and seek evidence that the organisation's most sensitive information is receiving appropriate protection. This provides a clearer picture of whether the migration programme is genuinely reducing business exposure.

Executive assurance must focus on the protection of critical business information, not simply the number of systems upgraded.

A leadership discussion about quantum readiness does not need to begin with the technical details of quantum computing. Instead, it can focus on the decisions required to protect the organisation's long-term interests.

1. Which of our information assets would cause material harm if they became readable ten years from now? This helps establish the organisation's business exposure and identify information that requires long-term confidentiality.

2. Do we understand which critical systems and suppliers depend on cryptography that will need to be replaced? This establishes whether management has sufficient visibility into the technology dependencies that could affect migration.

3. Who is accountable for our migration strategy, and what evidence demonstrates that the most significant risks are being addressed? This connects the risk to ownership, investment decisions, delivery priorities, and assurance.

An inability to answer these questions does not automatically mean the organisation is insecure. However, it indicates that further assessment may be required before leadership can make well-informed decisions about its exposure.

Quantum computing may take years to reach the capability required to challenge today's widely deployed public-key cryptography, and the precise timing remains uncertain. What is clearer is that changing the cryptographic foundations of an organisation requires significant planning, investment, and coordination across business and technology functions.

For executive leadership, the appropriate response is not to react to every emerging technology with immediate large-scale expenditure. It is to understand which information requires long-term protection, identify where existing technology may create exposure, and establish a proportionate migration strategy supported by accountability and measurable evidence.

The greatest leadership risk may not be failing to predict exactly when quantum computing becomes capable of breaking today's cryptography. It may be waiting until that capability exists before discovering that sensitive information collected years earlier was never adequately protected for the long term. Your organisation's data may be encrypted today. Will it still be confidential when tomorrow's technology arrives?

Is your organisation prepared for the transition to post-quantum cryptography?

If you're assessing your organisation's exposure, reviewing your security architecture, or developing a strategy to address emerging cyber risks, I'd welcome the opportunity to connect and exchange perspectives.

Get in touch: [email protected]

Follow Security Architecture Review: www.review.xeekye.com for insights on cyber risk, security architecture, and emerging security challenges.