Quantum Data Harvesting Risks for Cybersecurity Professionals

EY’s perspective on securing against #quantum #risks emphasizes that quantum #computing is rapidly evolving from a theoretical concern into a material cybersecurity threat that requires immediate strategic action. The core issue lies in the vulnerability of widely used cryptographic algorithms, such as RSA and elliptic curve cryptography, which could be broken by sufficiently advanced quantum computers. This creates a systemic risk to sensitive data, including financial information, intellectual property, and personal records. A central concept highlighted is the “harvest now, decrypt later” threat model, in which adversaries collect encrypted data today with the intention of decrypting it in the future as quantum capabilities mature. This makes quantum risk a present-day problem, particularly for data requiring long-term confidentiality. EY stresses that organizations must adopt a proactive and structured approach to quantum readiness. A foundational step is to conduct a comprehensive cryptographic inventory, identify sensitive #data, and map existing #encryption methods. This enables organizations to assess which systems are most exposed and prioritize remediation efforts. Transitioning to post-quantum cryptography (PQC) is a complex, multi-year transformation that requires careful planning, integration into existing #technology roadmaps, and alignment with emerging standards. Organizations are encouraged to build crypto-agility, allowing them to adapt encryption methods as technologies and standards evolve. EY also highlights the importance of #governance, #compliance, and #workforce readiness. Quantum resilience requires enterprise-wide coordination, including policy development, regulatory alignment, continuous monitoring, and personnel training. EY frames quantum cybersecurity not just as a technical upgrade but as a strategic #transformation initiative. Organizations that act early can strengthen resilience, improve cyber maturity, and gain a competitive advantage, while those that delay risk long-term exposure to data breaches, regulatory challenges, and erosion of #digital #trust.

Reading A Practitioner’s Guide to Post-Quantum Cryptography from the Cloud Security Alliance made me pause. It highlights something many organizations still underestimate very often: modern cryptography was not designed for a future with cryptographically relevant quantum computers (CRQCs). This threat is also not theoretical. The risk comes from Store Now, Decrypt Later attacks, where encrypted data can be harvested today and broken once quantum capabilities mature. Time, not just technology, becomes the critical risk factor. Key highlights from the guide • Shor’s and Grover’s quantum algorithms threaten most public-key cryptography in use today, including RSA, Diffie-Hellman, and elliptic-curve algorithms • CRQCs may emerge by the early 2030s, putting long-term-value data at risk even if systems are secure today • Data confidentiality and integrity are both impacted by Store Now, Decrypt Later attacks • NIST published post-quantum cryptography standards in 2024 (FIPS-203, FIPS-204, FIPS-205), but enterprise adoption will take time and investment • Risk assessment must begin by identifying which data assets still hold value at “Q-Day,” not by blanket cryptographic replacement Who should take note • Security leaders responsible for long-term data protection strategies • Architects managing encryption for data at rest, data in transit, and non-repudiation • Compliance and governance teams evaluating regulatory and sector-specific quantum readiness requirements • Engineering teams responsible for cryptographic libraries, TLS, VPNs, KMS, and certificate management Why this matters Unlike most cyber threats, quantum risk is driven by time. Data intercepted today may be compromised years later. If enterprises wait until CRQCs arrive, it will already be too late for data with long-term value. At the same time, mitigation is costly, complex, and not yet fully supported by mainstream products. The path forward The guide emphasizes starting with disciplined risk assessment, identifying vulnerable cryptographic functions, and mapping technology components before committing to mitigation. Enterprises should periodically reassess risk, track technology maturity, and align mitigation efforts with CSA Cloud Controls Matrix guidance rather than rushing into premature or unnecessary changes.

🔑"𝐇𝐚𝐫𝐯𝐞𝐬𝐭 𝐍𝐨𝐰, 𝐃𝐞𝐜𝐫𝐲𝐩𝐭 𝐋𝐚𝐭𝐞𝐫" (𝐇𝐍𝐃𝐋) attacks intercept RSA-2048 or ECC-encrypted files, stockpiling them for future decryption. Once a powerful quantum computer comes online, they can unlock those archives in hours, exposing years’ worth of secrets. This silent threat targets everything from personal records to diplomatic communications. 🔐 📌 HOW CAN CYBERSECURITY LEADERS AND EXECUTIVES PREPARE? 🎯🎯𝐁𝐮𝐢𝐥𝐝 𝐂𝐫𝐲𝐩𝐭𝐨𝐠𝐫𝐚𝐩𝐡𝐢𝐜 𝐀𝐠𝐢𝐥𝐢𝐭𝐲: Ensure your systems can swiftly swap out cryptographic algorithms without extensive re-engineering. 𝐂𝐫𝐲𝐩𝐭𝐨-𝐚𝐠𝐢𝐥𝐢𝐭𝐲 𝐢𝐬 𝐭𝐡𝐞 𝐚𝐛𝐢𝐥𝐢𝐭𝐲 𝐭𝐨 𝐫𝐚𝐩𝐢𝐝𝐥𝐲 𝐭𝐫𝐚𝐧𝐬𝐢𝐭𝐢𝐨𝐧 𝐭𝐨 𝐮𝐩𝐝𝐚𝐭𝐞𝐝 𝐞𝐧𝐜𝐫𝐲𝐩𝐭𝐢𝐨𝐧 𝐬𝐭𝐚𝐧𝐝𝐚𝐫𝐝𝐬 𝐚𝐬 𝐭𝐡𝐞𝐲 𝐛𝐞𝐜𝐨𝐦𝐞 𝐚𝐯𝐚𝐢𝐥𝐚𝐛𝐥𝐞. Designing for agility now will let you plug in PQC algorithms (or other replacements) with minimal disruption later. 🎯𝐈𝐦𝐩𝐥𝐞𝐦𝐞𝐧𝐭 𝐇𝐲𝐛𝐫𝐢𝐝 𝐂𝐫𝐲𝐩𝐭𝐨𝐠𝐫𝐚𝐩𝐡𝐲: Do not wait for the full PQC rollout. 👉 𝐒𝐭𝐚𝐫𝐭 𝐮𝐬𝐢𝐧𝐠 𝐡𝐲𝐛𝐫𝐢𝐝 𝐞𝐧𝐜𝐫𝐲𝐩𝐭𝐢𝐨𝐧 𝐍𝐎𝐖! Combine classic schemes like ECDH or RSA with a post-quantum algorithm (e.g. a dual key exchange using ECDH + Kyber). 🎯𝐌𝐚𝐢𝐧𝐭𝐚𝐢𝐧 𝐚 𝐂𝐫𝐲𝐩𝐭𝐨𝐠𝐫𝐚𝐩𝐡𝐢𝐜 𝐁𝐢𝐥𝐥 𝐨𝐟 𝐌𝐚𝐭𝐞𝐫𝐢𝐚𝐥𝐬 (𝐂𝐁𝐎𝐌): 👉𝐈𝐧𝐯𝐞𝐧𝐭𝐨𝐫𝐲 𝐚𝐥𝐥 𝐜𝐫𝐲𝐩𝐭𝐨𝐠𝐫𝐚𝐩𝐡𝐢𝐜 𝐚𝐬𝐬𝐞𝐭𝐬 𝐢𝐧 𝐲𝐨𝐮𝐫 𝐨𝐫𝐠𝐚𝐧𝐢𝐳𝐚𝐭𝐢𝐨𝐧: algorithms, key lengths, libraries, certificates, and protocols. A CBOM provides visibility into where vulnerable algorithms (like RSA/ECC) are used and helps prioritize what to fix. 🎯🎯𝐀𝐥𝐢𝐠𝐧 𝐰𝐢𝐭𝐡 𝐍𝐈𝐒𝐓’𝐬 𝐐𝐮𝐚𝐧𝐭𝐮𝐦 𝐌𝐢𝐠𝐫𝐚𝐭𝐢𝐨𝐧 𝐑𝐨𝐚𝐝𝐦𝐚𝐩: Follow expert guidance for a structured transition. 𝐓𝐡𝐞 𝐔.𝐒. 𝐠𝐨𝐯𝐞𝐫𝐧𝐦𝐞𝐧𝐭 (𝐂𝐈𝐒𝐀, 𝐍𝐒𝐀, 𝐚𝐧𝐝 𝐍𝐈𝐒𝐓) 𝐚𝐝𝐯𝐢𝐬𝐞𝐬 𝐞𝐬𝐭𝐚𝐛𝐥𝐢𝐬𝐡𝐢𝐧𝐠 𝐚 𝐪𝐮𝐚𝐧𝐭𝐮𝐦-𝐫𝐞𝐚𝐝𝐢𝐧𝐞𝐬𝐬 𝐫𝐨𝐚𝐝𝐦𝐚𝐩, starting with a thorough cryptographic inventory and risk assessment. Keep abreast of NIST’s PQC standards timeline and recommendations.  National Institute of Standards and Technology (NIST) #𝐇𝐍𝐃𝐋 Cyber Security Forum Initiative #CSFI 🗝️ Now is the time to future-proof your encryption! 🗝️ 𝑌𝑜𝑢 𝑠ℎ𝑜𝑢𝑙𝑑𝑛'𝑡 𝑎𝑠𝑠𝑢𝑚𝑒 𝑡ℎ𝑎𝑡 𝑦𝑜𝑢𝑟 𝑑𝑎𝑡𝑎 𝑖𝑠 𝑠𝑒𝑐𝑢𝑟𝑒 𝑗𝑢𝑠𝑡 𝑏𝑒𝑐𝑎𝑢𝑠𝑒 𝑖𝑡 𝑖𝑠 𝑒𝑛𝑐𝑟𝑦𝑝𝑡𝑒𝑑...

Three weeks ago, our Devsinc security architect, walked into my office with a chilling demonstration. Using quantum simulation software, she showed how RSA-2048 encryption – the same standard protecting billions of transactions daily – could theoretically be cracked in just 24 hours by a sufficiently powerful quantum computer. What took her classical computer billions of years to attempt, quantum algorithms could solve before tomorrow's sunrise. That moment crystallized a truth I've been grappling with: we're not just approaching a technological evolution; we're racing toward a cryptographic apocalypse. The quantum computing market tells a story of inevitable disruption, surging from $1.44 billion in 2025 to an expected $16.22 billion by 2034 – a staggering 30.88% CAGR that signals more than market enthusiasm. Research shows a 17-34% probability that cryptographically relevant quantum computers will exist by 2034, climbing to 79% by 2044. But here's what keeps me awake at night: adversaries are already employing "harvest now, decrypt later" strategies, collecting our encrypted data today to unlock tomorrow. For my fellow CTOs and CIOs: the U.S. National Security Memorandum 10 mandates full migration to post-quantum cryptography by 2035, with some agencies required to transition by 2030. This isn't optional. Ninety-five percent of cybersecurity experts rate quantum's threat to current systems as "very high," yet only 25% of organizations are actively addressing this in their risk management strategies. To the brilliant minds entering our industry: this represents the greatest cybersecurity challenge and opportunity of our generation. While quantum computing promises revolutionary advances in drug discovery, optimization, and AI, it simultaneously threatens the cryptographic foundation of our digital world. The demand for quantum-safe solutions will create entirely new career paths and industries. What moves me most is the democratizing potential of this challenge. Whether you're building solutions in Silicon Valley or Lahore, the quantum threat affects us all equally – and so does the opportunity to solve it. Post-quantum cryptography isn't just about surviving disruption; it's about architecting the secure digital infrastructure that will power humanity's next chapter. The countdown has begun. The question isn't whether quantum will break our current security – it's whether we'll be ready when it does.

What Google’s latest quantum experiment means for digital security right now Google’s new Quantum Echoes experiment confirms progress in verifying quantum behaviour using the 65-qubit Willow processor. This development has sparked many discussions about whether Q-day is now closer. Q-day refers to the moment when a quantum computer can break widely used encryption standards like RSA-2048 and ECC. The foundation for this concern comes from Shor’s algorithm, which shows that a sufficiently capable quantum system could factor large numbers faster than classical methods, undermining the mathematics behind public key encryption. Today’s quantum devices operate with only 100s of noisy qubits, far below the millions of logical qubits needed to threaten encryption. The concept of “harvest now, decrypt later” is central to security planning. This means that encrypted data gathered today could be decrypted once quantum capability reaches the threshold. Organisations must move toward quantum safe cryptography such as CRYSTALS-Kyber for encryption and Dilithium for digital signatures. These algorithms are now standardised and recommended. For banks, cloud services, government agencies, and critical infrastructure providers, this clarity is an urgent reminder to review security roadmaps. Taking early steps in post-quantum readiness will strengthen long-term data protection and maintain trust in digital systems. If your security strategy does not yet include post-quantum planning, now is the time to start defining that roadmap.

The Integrity Crisis: Trust Now, Forge Later. 🤓 In my last post, I discussed HNDL (Harvest Now, Decrypt Later)... the threat where attackers hoard encrypted data today to read it tomorrow. That is a crisis of confidentiality. (see link in comments) But there is a second, arguably more dangerous vector emerging in post-quantum security discussions. It targets integrity and authenticity. It is called TNFL: Trust Now, Forge Later. What is the basic mechanism? Current public-key signature algorithms (like RSA and ECDSA) rely on math that a Cryptographically Relevant Quantum Computer (CRQC) will break using Shor’s algorithm. The threat model is simple: ➡️ Trust Now: An attacker records a digitally signed artifact today, a firmware update, a digital identity, or a long-term contract. These are valid and trusted right now. ➡️ Forge Later: Once a quantum computer becomes available (est. 2030s), the attacker uses the public key information from those recorded artifacts to derive the private key. 🤯 The Breached Future: They can now retroactively sign new, malicious artifacts that your systems will accept as authentic. So why this is different (and dangerous)? 🤷♂️ Well... while HNDL reads your diary, TNFL hijacks your car ‼️ HNDL (Confidentiality): Exposes past secrets. The damage is informational. TNFL (Integrity): Allows active compromise. A forged signature on a firmware update in an OT (Operational Technology) environment doesn't just leak data; it could cause physical damage to critical infrastructure. We often mistakenly think signatures are ephemeral, overlooking the significant "long-tail" of trust they actually create. Examples 👩🏫 software/Firmware: Embedded devices often have lifecycles of 15–20 years. A satellite or medical device deployed today with a hard-coded root of trust could be hijacked in 2035 via a forged update. Legal & Finance: Blockchain ledgers and digital contracts signed today must remain immutable for decades. TNFL threatens to rewrite that history. The Fix: Crypto-Agility and Post Quantum Cryptography 🤩 We cannot simply wait for the quantum era to arrive. The mitigation strategy is crypto-agility: building systems today that allow us to swap out cryptographic primitives without rewriting the entire infrastructure. There are good choices of Post Quantum Cryptography already available for implementation. All around the world governments recommend implementing them. It's time to "keep secrets" and "maintain trust". Join Quantum Security Defence for continuous education, business networking and advisory, link in the comments. 💚 🔜 In my next post I will discuss evidence logs as the proof of what happened in the past. #PQC #QuantumSecurity #DigitalTrust #Cybersecurity #TNFL #Integrity #CISO #TechTrends2026 #QSECDEF #QuantumComputing

Post-Quantum Cryptography (PQC): Why We Must Prepare Before Quantum Computers Arrive What exactly is PQC? Is it a tool? An attack? A new policy? Let’s make it clear. PQC (Post-Quantum Cryptography) is not a product or software you install. It’s a new generation of cryptographic algorithms designed to protect our data from the power of future quantum computers. Every secure connection we make today from online banking to VPNs relies on mathematical problems like RSA or Elliptic Curve Cryptography (ECC). These are strong today because even the world’s fastest supercomputer would take years to break a 2048-bit RSA key. But a quantum computer doesn’t work like a traditional one. It doesn’t calculate with just 1s and 0s. Instead, it uses qubits capable of existing in multiple states at once. This means quantum computers can process massive parallel calculations that our current machines can’t. That’s where the concern begins. Algorithms like RSA and ECC can be broken in hours or days using quantum algorithms such as Shor’s algorithm. I give you example, imagine your bank’s SSL certificate that secures online transactions today. It uses RSA-2048. If a threat actor records that encrypted traffic today and in a few years gets access to a quantum computer they could decrypt that communication easily. This is called “Harvest Now, Decrypt Later”. It means attackers can steal your encrypted data now, store it and decrypt it in the future once they have quantum power. For organisations like banks, government agencies or healthcare providers this is a huge risk. Sensitive data must remain confidential for decades. So what is PQC really? PQC is the next wave of encryption standards that are resistant to quantum attacks. Instead of relying on problems like factorisation, PQC algorithms use lattice-based, code-based or hash-based methods that even a quantum computer can’t easily solve. In fact, NIST has already announced its first three official PQC standards this year a sign that the transition is already happening globally. Quantum computing will change everything. It’s not about fear it’s about readiness. PQC is our way of ensuring that even when quantum arrives, our communications, banking, healthcare and national data remain protected. The future of cybersecurity will not just be about detecting attacks, but about securing cryptography before it becomes breakable.

Headline: Quantum Threats Extend to Orbit as Space Systems Face Urgent Security Overhaul Introduction: The approaching “Q-Day,” when quantum computers can break current encryption, is no longer theoretical. Experts warn that space systems—long considered secure by distance—are now highly exposed, forcing governments and industry to accelerate a complex transition to post-quantum cryptography. Key Developments: Breaking the Illusion of Space Security Recent cyber incidents, including satellite hacks and data interceptions, prove space is not inherently secure Adversaries can already intercept and store satellite communications for future decryption Threats include spoofing, jamming, command hijacking, and denial-of-service attacks Quantum Race and Strategic Risk U.S. and China are competing to achieve quantum breakthroughs with national security implications Concerns persist that China may gain a first-mover advantage while obscuring progress Q-Day could render current encryption across space and terrestrial systems obsolete Mandated Transition to Post-Quantum Security U.S. policy requires migration to quantum-resistant cryptography under CNSA 2.0 Deadlines: quantum-secure systems by 2035, with major milestones in 2025 and 2027 NIST standardized key algorithms in 2024, enabling immediate transition efforts Operational Challenges in Space Space systems face constraints in size, weight, power, and compute capacity Post-quantum keys are larger, complicating deployment in constrained environments Satellites have long lifecycles, making hardware upgrades difficult or impossible Emerging Solutions and Industry Response Emphasis on crypto agility to enable software-based updates without hardware replacement Manufacturers are embedding post-quantum security directly into hardware and onboard systems New quantum-secure space infrastructure, including routers and communication modules, is under development Immediate Risk Factors “Harvest now, decrypt later” exposes sensitive data already in transit or storage Side-channel attacks and key extraction are already feasible in some scenarios Delay in migration increases long-term exposure and potential mission compromise Why It Matters: Space is now a contested digital domain where encryption integrity underpins national security, economic infrastructure, and military operations. The transition to post-quantum cryptography is not optional—it is a strategic imperative. Organizations that fail to act risk systemic vulnerability across satellite networks that cannot be easily repaired once deployed. The broader implication is clear: future resilience will depend on proactive architecture, crypto agility, and the ability to secure systems against threats that have not fully materialized—but are already inevitable. I share daily insights with tens of thousands followers across defense, tech, and policy. Keith King https://lnkd.in/gHPvUttw

By 2035, quantum computers could break today’s RSA/ECC, threatening everything from over-the-air updates to payments, V2X, charging, telematics, and dealer systems. And “harvest-now, decrypt-later” means data we encrypt today may be readable tomorrow. Thankfully, there’s a path forward with Post-Quantum Cryptography (PQC). So here's what we’re doing (and what I recommend): 1️⃣ Prioritize what matters: Classify apps/data by sensitivity & lifespan (vehicles, keys, firmware, contracts). Tackle the critical 10% first. 2️⃣ Start pilots now: Stand up PQC for key exchange and signatures (NIST picks: CRYSTALS-Kyber, Dilithium, plus FALCON/SPHINCS+ where appropriate). Wrap legacy with interim controls where upgrades aren’t yet feasible. 3️⃣ Engineer for the edge/IoT: Plan for constrained ECUs and long service lives; align PQC with model year cycles and sunset plans to avoid hardware rip-and-replace. 4️⃣ Educate & govern: A cross-functional council (CISO, engineering, legal, procurement) to drive roadmap, metrics, and auditability. Quantum risk isn’t a future storm; it’s a countdown. Organizations that move now will secure their platforms and earn customer trust in the next digital economy. #Cybersecurity #PQC #RiskManagement 📸: BCG