The Quantum Threat Isn't Just in the Future. It's Already a Risk Today.

As I've been spending more time learning about quantum computing, one concept keeps standing out: Harvest Now, Decrypt Later (HNDL).

It changed the way I think about cybersecurity.

The idea is simple but powerful. An attacker doesn't need a quantum computer today to create damage tomorrow. They can steal encrypted data now, store it for years, and wait until quantum technology is capable of breaking the cryptography protecting it.

In other words, the attack may happen today. The decryption just happens later.

For organizations in financial services, this is particularly important. Customer data, insurance records, investment strategies, trading algorithms, contracts, and intellectual property often need to remain confidential for decades, not months.

What I've realized is that the conversation shouldn't start with:

"Do we need quantum-safe encryption?"

Instead, it should start with:

"What data do we have that must remain confidential long enough for quantum computing to become a threat?" That's a very different discussion.

My view is that organizations should focus on a few practical steps:

• Understand where cryptography is used across applications, infrastructure, cloud platforms, and third-party integrations.
• Identify data with long confidentiality requirements.
• Plan the migration from vulnerable public-key cryptography such as RSA and ECC to NIST-approved post-quantum algorithms.
• Build crypto agility so systems can evolve without major rewrites.
• Reduce today's risk through stronger controls, data minimization, and better protection of high-value assets.

What excites me most is the role AI can play in this journey.

AI can help organizations create a Cryptographic Bill of Materials (CBOM) by analyzing code, certificates, APIs, configurations, and infrastructure to identify where vulnerable cryptography exists and prioritize remediation efforts. Rather than trying to quantum-proof everything at once, organizations can focus on what matters most.

I often tell clients that the goal isn't to prepare for the arrival of quantum computing overnight.

The goal is to make sure that when quantum capability arrives, you're not discovering your exposure at the same time.

The future quantum threat may feel distant, but the data it could affect is already sitting in databases, backups, archives, and cloud environments today.

And that's why I believe the time to start preparing is now.

What are your thoughts? Is post-quantum cryptography already on your organization's roadmap, or does it still feel like a future problem?

#QuantumComputing #PostQuantumCryptography #CyberSecurity #FinancialServices #AI #Innovation #RiskManagement #DigitalTransformation