One of the biggest misconceptions about quantum cybersecurity is:
“We can wait until quantum computers become powerful enough to break encryption.”
That overlooks a very different type of risk.
An attacker may not need to decrypt sensitive information today.
They may simply need to steal and store it.
NIST describes this scenario as Harvest Now, Decrypt Later, or HNDL: an adversary captures encrypted information today with the expectation that future quantum computing capability may allow it to be decrypted later. NIST
This changes the timeline for quantum security.
For some organizations, the confidentiality risk has already started.
Not All Data Ages at the Same Rate
Consider two encrypted files.
File A
A restaurant reservation confirmation.
In five years, its confidentiality value is likely minimal.
File B
Sensitive medical information.
Five or ten years later, it may still be highly sensitive.
Now consider:
- intellectual property
- government communications
- acquisition strategy
- legal documents
- genomic information
- long-term research
- defense information
Some data has a long confidentiality lifetime.
That makes it more relevant to HNDL risk.
How HNDL Works
A simplified scenario:
Today
An adversary intercepts encrypted traffic or steals an encrypted dataset.
They cannot currently decrypt it.
So they store it.
Later
Cryptographically relevant quantum computing becomes available.
Algorithms protecting the captured information may become vulnerable.
The attacker decrypts the historical dataset.
The compromise effectively occurred years earlier.
The disclosure occurs later.
Why Healthcare Should Pay Particular Attention
Healthcare provides a useful example.
Protected health information can remain sensitive for decades.
Medical history does not necessarily lose value after a password rotation.
Information may include:
- diagnoses
- genetic information
- treatment history
- behavioral health data
- reproductive-health information
- identity information
That means protecting only future healthcare records with PQC may eventually be insufficient.
Organizations need to think about data being generated and transmitted today.
Intellectual Property Has Similar Characteristics
Organizations investing in:
- pharmaceutical research
- semiconductor design
- aerospace
- manufacturing
- artificial intelligence
- defense
- advanced materials
may possess information whose value persists for many years.
An adversary may not need immediate access.
The information may still create strategic value later.
Start With Data Classification
HNDL (harvest now decrypt later) prioritization begins with a simple question:
How long must this information remain confidential?
Organizations should consider adding confidentiality lifetime to data classification.
For example:
| Data type | Required confidentiality |
|---|---|
| Public marketing | Minimal |
| Routine operational | Short-term |
| Customer financial | Multi-year |
| PHI | Long-term |
| Trade secrets | Potentially decades |
| National-security information | Very long-term |
The exact classifications will differ.
The principle does not.
Then Map Data to Cryptography
Once long-lived data is identified, determine:
How is it protected?
Look at:
- TLS
- VPNs
- storage encryption
- PKI
- email encryption
- file transfer
- APIs
- backups
Then identify where quantum-vulnerable public-key cryptography participates in that protection.
HNDL Is a Prioritization Tool
Organizations do not necessarily need to migrate every system first.
HNDL (harvest now decrypt later) helps identify which systems deserve earlier attention.
A practical priority model might consider:
Data sensitivity × confidentiality lifetime × cryptographic exposure × adversary interest
This produces a much more defensible migration roadmap than treating every system equally.
Think Beyond Stored Data
HNDL is frequently discussed as a storage problem.
It is also a communications problem.
Sensitive information transmitted today may be captured in transit.
That makes relevant controls include:
- TLS
- VPN
- secure messaging
- email encryption
- application-to-application traffic
- API communication
Cryptographic discovery therefore needs to understand data flows, not just databases.
The Key Question
Security leaders should ask:
If an adversary captured this encrypted information today and decrypted it ten years from now, would we still care?
If the answer is yes, that workload deserves attention in PQC planning.
HNDL Makes Quantum Risk a Present-Day Issue
Quantum computers capable of attacking modern public-key cryptography do not need to exist today for quantum risk to influence today’s decisions.
For organizations with long-lived sensitive data:
collection can happen now.
decryption can happen later.
That is why migration planning should begin before the cryptographic breaking point arrives.
Velocis Quantum Risk Assessment
Velocis helps organizations identify:
- long-lived sensitive information
- vulnerable cryptographic dependencies
- machine identities
- certificates
- data flows
- migration priorities
CTA
Which of your data would still matter ten years from now?