U.S. NIST recently released IR 8547, outlining the roadmap for transitioning to quantum-resistant standards. While the guidance is comprehensive, much of the public debate still fixates on a single threat vector: harvest now, decrypt later (HNDL).
The narrow focus: Harvest now, decrypt later
If your data's strategic shelf life is 30 days, spending millions to defend against a quantum computer in 2035 feels like a low-priority expense. And that's where the trap lies.
Nearly all popular commentary around post-quantum cryptography (PQC) focuses on a single threat: harvest now, decrypt later—the practice of adversaries capturing encrypted traffic today to decrypt it once a Cryptographically Relevant Quantum Computer (CRQC) arrives.
For organizations holding 30-year state secrets, long-term healthcare records, or core intellectual property, HNDL is a top-tier threat. But in my conversations with executives across broader commercial sectors, HNDL sometimes fails to motivate action.
If your data's commercial relevance expires in weeks or months, future decryption feels like a distant theoretical problem. Consider:
-
Media and entertainment – Much of the content being transmitted is intended for eventual public consumption, making future decryption less consequential.
-
Food service – Daily sales, ordering, and operational transactions typically have little long-term intelligence value.
-
Retail – Today's promotional campaigns, pricing strategies, and inventory data may have little value five or 10 years from now.
When leaders view quantum risk exclusively through the lens of data confidentiality, some may conclude: "This isn't our problem yet."
Digital trust collapses?
The bigger post-quantum conversation needs to extend beyond HNDL. Quantum-capable adversaries could undermine the cryptographic foundations of digital trust, creating risks that affect daily business operations, financial transactions, legal obligations, and technology supply chains.
These points may be what changes some organizations' minds about the need to build a PQC plan.
1. Authentication & identity: Forging who is accessing your network
Quantum attacks against some public-key cryptography could undermine mechanisms used to prove that a person, device, or service is who it claims to be. This may create opportunities for impersonation, credential abuse, and fraudulent access.
2. Access control & certificates: Bypassing cloud and API authorization
Digital certificates and cryptographic credentials underpin access to enterprise systems, cloud environments, APIs, and privileged resources. If the cryptographic mechanisms used to establish these identities and credentials can be forged, attackers could potentially impersonate trusted users or services and circumvent the authentication controls that enforce access policies.
3. Remote access & VPNs: Hijacking encrypted tunnels and workforce access
Remote workforce access, secure tunnels, and device-to-network authentication depend on cryptographic trust. Vulnerable key-establishment and authentication mechanisms could expose these connections to future quantum attacks, potentially allowing attackers to impersonate trusted users or infrastructure.
4. Digital signatures & legal contracts: Invalidating non-repudiation and electronic agreements
Electronic contracts, financial agreements, and legally-binding documents frequently rely on digital signatures to establish authenticity and integrity. If the underlying signature algorithms become vulnerable, attackers could potentially forge signatures or undermine confidence in the authenticity of previously signed documents. Organizations could face difficult questions about whether a document was genuinely signed, altered, or fraudulently attributed.
5. Financial & transaction integrity: Authorizing fraudulent money transfers and asset movements
Payment systems, banking infrastructure, securities transactions, and digital asset platforms use cryptography to authenticate transactions and establish trust. Compromised digital signature mechanisms could enable fraudulent transaction authorization, impersonation of financial institutions, or challenges to transaction integrity.
6. Software supply chain: Forging code-signing certificates to push malicious updates
Software publishers use digital signatures to establish that code and updates originate from trusted sources and have not been modified. If attackers can forge those signatures, they could potentially distribute malicious software that appears legitimate and bypass important security controls. Consider the implications for organizations that automatically trust and deploy digitally-signed software updates from their technology providers.
I don't think this is an exhaustive list, but it should illustrate that PQC risks are broader and shared by more than you may think.
Some challenges not often talked about
The other area I see being overlooked are some practical challenges with adopting PQC encryption to address risks mentioned above. True that roadmaps will require certificate/signature upgrades, but that isn't all. For a taste, consider:
-
Third parties – Considering the risk use cases, you'll probably notice that many of them involve a third party. What if you've fully adopted PQC algorithms but they haven't? PQC readiness cannot be achieved in isolation. Third-party dependencies, interoperability, and vendor migration plans need to be part of the strategy.
-
Implementation – Achieving PQC safety isn't just an information security task, it's an organization change management initiative. Many of the activities to achieve this safety will fall upon others, such as infrastructure to replace key encryption components or to migrate data at rest, or procurement for PQC contract provisions apply.
These are but a few challenges I highlight that I see, and I’m sure there are more. I highlight purely to illustrate that plans should be forged soon to manage the risk scenario posed here.
Where to go from here?
I personally use NIST as a primary source of information, along with relevant executive orders and government guidance. I also subscribe to Qtonic Quantum, which is a great source for staying informed about developments in this space.
I'd also recommend using these resources to begin developing an organizational PQC roadmap.
For many organizations, this will be a multi-year effort involving cryptographic discovery, risk assessment, technology upgrades, vendor coordination, and implementation.
NIST provides useful resources to help organizations understand the standards and migration requirements, and the NIST National Cybersecurity Center of Excellence (NCCoE) provides additional practical guidance.
Ultimately, the quantum transition isn't simply a technology refresh or an information security initiative. It's an enterprise-wide transition in how organizations establish and maintain digital trust.
[RELATED: McKinsey's Quantum Road Map Runs Through Q-Day]
Disclaimer
The views and opinions expressed in this article are my own and are provided for general informational and educational purposes only. They do not constitute legal, regulatory, cybersecurity, or professional advice, nor should they be relied upon as a substitute for an independent assessment of an organization's specific circumstances, risks, or obligations.
Quantum computing, post-quantum cryptography standards, and related regulatory requirements continue to evolve. While reasonable efforts have been made to ensure accuracy, no representation or warranty, express or implied, is made regarding the completeness, accuracy, or continued relevance of the information presented. Readers are responsible for conducting their own due diligence and consulting with qualified security advisors before implementing post-quantum cryptographic roadmaps or architectural changes.
