Intelligence agencies and cybersecurity experts have long warned of a threat that requires action today to prevent damage years from now: harvest now, decrypt later (HNDL). The premise is straightforward — adversaries are intercepting and storing encrypted data today, with the expectation that quantum computers will eventually be powerful enough to break the encryption and reveal the contents.

New evidence suggests this is not a theoretical concern. Declassified intelligence assessments and private sector threat intelligence reports indicate that nation-state actors — primarily China, Russia, and North Korea — have been systematically collecting encrypted government, military, and commercial communications since at least 2015.

Who Is Most at Risk?

The HNDL threat is not uniform across organisations. The risk is highest for data with a long sensitivity lifetime — information that will still be sensitive in 10–15 years, when cryptographically relevant quantum computers may become available. This includes:

Government and defence: Classified communications, intelligence sources and methods, military capabilities and plans. These are the primary targets of nation-state HNDL operations and have the longest sensitivity lifetimes.

Financial services: Long-term financial contracts, M&A negotiations, trading strategies, and customer financial data. While most financial transactions have short sensitivity windows, strategic information can remain sensitive for decades.

Healthcare and pharmaceuticals: Clinical trial data, drug development pipelines, and patient genomic data. Pharmaceutical IP can have sensitivity lifetimes of 20+ years, making it a high-value HNDL target.

Critical infrastructure: Operational technology (OT) systems, SCADA networks, and industrial control systems often have long operational lifetimes and are difficult to update, making them vulnerable to future quantum attacks.

"If your data needs to be secret in 2035, it needs to be quantum-safe today. The harvest is happening now."
— Dr. Michele Mosca, Institute for Quantum Computing, University of Waterloo

Assessing Your Exposure

Organisations can assess their HNDL exposure through a structured risk framework. The key variables are: (1) the sensitivity lifetime of the data being protected; (2) the migration timeline — how long it will take to deploy post-quantum cryptography across all relevant systems; and (3) the quantum threat timeline — when cryptographically relevant quantum computers are expected to arrive.

If the sum of (2) and (3) is less than (1), the organisation is exposed. For many large enterprises with complex legacy infrastructure, migration timelines of 5–10 years are realistic, meaning the window of exposure has already opened.

Immediate Actions

Organisations should prioritise three immediate actions. First, conduct a cryptographic inventory to identify all systems using RSA, Diffie-Hellman, or elliptic-curve cryptography. Second, implement crypto-agility — the ability to swap cryptographic algorithms without redesigning systems — as a standard architectural requirement for all new systems and major upgrades. Third, begin hybrid deployment of NIST-standardised post-quantum algorithms alongside existing classical algorithms for the most sensitive data flows.

The cost of early action is modest compared to the potential cost of a future quantum breach. Organisations that begin their PQC migration now will be significantly better positioned than those that wait for regulatory mandates.