Imagine being able to solve in hours what would take our most powerful classical computers decades — not because of a faster chip, but because the rules of computation have changed. That’s the promise of quantum computing. It’s why governments, universities, and the private sector are racing to be first in reaching the next set of breakthroughs toward achieving quantum supremacy. We don’t need to predict an exact “Q-Day” when quantum computers become powerful enough to break public key encryption that secures our global internet and financial systems to understand the massive implications. Advancements in quantum computing have been uneven but steady, and they bring to light problems that are critical to national – even global – competitiveness and security.
For security leaders, the uncomfortable reality is that quantum risk doesn’t begin the day quantum machines go live. Risk begins earlier — the day attackers decide it’s worth collecting encrypted data and storing it for later. That day is now.
The strategy already has a name: harvest now, decrypt later (HNDL).
The HNDL Threat in One Sentence
Attackers capture encrypted traffic or steal encrypted files today, hold onto them for years, and decrypt them in the future when quantum capabilities make it feasible.
As a Nixon Peabody Intellectual Property partner puts it:
“In many instances, malicious actors are already capturing data encrypted with conventional techniques and holding onto it in anticipation of quantum computing systems that can easily reverse those encryption methods, making confidential customer information available to them.”
— Jamie Cooke, Nixon Peabody
Palo Alto Networks summarizes the urgency even more bluntly:
“Once a quantum computer reaches the threshold to break RSA or elliptic-curve encryption, it will already be too late to protect the data that was stolen years earlier.”
This statement goes to the heart of why quantum computing is a “prepare now” topic: some data must remain confidential for decades. If an organization handles information with a 10–30 year secrecy requirement — customer identities, transaction histories, contracts, IP, healthcare records, sensitive government communications — the risk clock starts when that data can be captured, not when it can be decrypted.