Harvest now, decrypt later explained.

An attacker does not need a capable quantum computer today to create a quantum-era risk. They can collect encrypted information now, preserve it, and attempt to decrypt it when the technology exists.

The breach and the decryption happen at different times.

Definition · Harvest now, decrypt later

A strategy in which an adversary captures encrypted data today and stores it in the hope that future quantum capabilities will make decryption possible.

t + 0

Now

Encrypted traffic or files are collected.

t + 1

Stored

The ciphertext is retained while it remains useful.

t + 2

Later

A future capability is used to attack vulnerable public-key protection.

CISA, NSA and NIST also use the phrase “catch now, break later.” The timing of a cryptographically relevant quantum computer remains uncertain. The planning question is whether data collected now would still matter when decryption becomes feasible.

Long-lived secrets deserve attention first.

HNDL does not give every byte the same urgency. Risk rises when sensitive data has a long required secrecy lifetime. Health records, intellectual property, source code, financial information, legal agreements, identity records and national-security information may retain value for years or decades.

Short-lived operational data may be lower priority. The correct response is classification, not panic: connect each data type to its confidentiality period, the cryptography protecting it and the systems through which it travels.

Use the data lifetime to set the clock.

A useful planning model compares three periods: how long the data must stay secret, how long migration will take, and the uncertain time until a capable quantum computer exists. If the first two together extend beyond the third, the organization has a reason to act before that computer arrives.

Risk lens

Secrecy lifetime + migration time > time to quantum capability

This is a prioritization model, not a prediction of a specific quantum date.

Reduce future exposure with work that helps today.

01
Classify durable data
Identify information that must remain confidential for years and document why.
02
Trace protection
Map where that data moves and which public-key systems protect it.
03
Reduce retention
Avoid collecting or keeping sensitive information longer than the business requires.
04
Plan PQC migration
Test standards-based replacements and require credible roadmaps from suppliers.