Guide 04
Post-quantum security: what boards need to know
The quantum threat to encryption is not a future problem. Data stolen today can be decrypted once quantum computers are powerful enough, so the deadline for sensitive, long-lived data has effectively already started.
By Eva Galant · Updated October 19, 2026
What is harvest now, decrypt later?
Attackers copy encrypted data today and store it until a quantum computer can break it. Marc Kaplan of VeriQloud says it is happening right now and that waiting is the riskiest move (Harvest now, decrypt later). The data most exposed is the data that must stay secret for a long time: health records, state secrets, intellectual property, financial and identity data.
When could quantum computers break today's encryption?
MITRE's public report puts the breaking of RSA-2048 in 2055–2060, built from trend lines of companies' own published metrics, explains Dr. Yaakov Weinstein (Someone is stealing your data now to decrypt it later). A distant date does not mean waiting: if your data must stay confidential for 30 years, it is already in scope. And as GQI's Joe Spencer argues, Q-Day is not a single day (Q-Day already happened and nobody noticed).
Post-quantum cryptography or quantum key distribution?
| Post-quantum cryptography (PQC) | Quantum key distribution (QKD) | |
|---|---|---|
| Based on | New mathematical problems | Laws of physics |
| Runs in | Software, on existing hardware | Optical fibre and dedicated hardware |
| Best for | Most organizations and systems | High-value links: banks, grids, hospitals, government |
| Hear more | Eleni Diamanti | Francesco Raffaelli |
Eleni Diamanti sums up the difference as math versus physics. Francesco Raffaelli of KETS expects post-quantum cryptography to cover most of the world, with critical infrastructure adding a hardware layer underneath: "Quantum computers attack software. QKD lives in optical fibres." The two are complements, not rivals.
What should boards ask for in the next 12 months?
- A cryptographic inventory: where encryption is used, by which systems and vendors.
- A data-lifetime map: which data must stay confidential for 10+ years, and so is exposed to harvest now, decrypt later today.
- A migration plan to post-quantum standards, starting with the most sensitive, longest-lived data. NIST published its first post-quantum cryptography standards in 2024.
- Vendor commitments: ask key suppliers and cloud providers for their post-quantum roadmaps; Marc Kaplan explains why trusting the cloud provider alone isn't enough.
- A decision on hardware protection (QKD) for the few links where the stakes justify it.
Related: Reza Nejabati on quantum networking and post-quantum cryptography · All quantum security episodes