Quantum readiness starts with data exposure, not just encryption

At a glance

What this is: This is a quantum-readiness analysis that says the main problem is not encryption alone but visibility into where sensitive data, keys, and exposure exist.

Why it matters: It matters to IAM and security teams because data exposure, key governance, and access scope determine which records are actually vulnerable if future decryption becomes possible.

Context

Quantum readiness is a governance problem before it is a cryptography migration problem. The core issue is that organisations often know they use encryption, but not where it applies, what it protects, or which data would become exposed if that protection fails.

That gap touches both data security and identity governance because encrypted data is only as defensible as the keys, secrets, and access paths around it. In practice, this means visibility into data stores, cryptographic assets, and entitlement scope becomes a prerequisite for any risk-based quantum plan.

Key questions

Q: What breaks when organisations treat quantum-safe encryption as a future problem?

A: Long-retention data remains vulnerable to harvest-now, decrypt-later collection, because attackers can store encrypted traffic today and wait for quantum capability to catch up. That makes delayed migration a confidentiality risk for intellectual property, financial records, health records, and government information.

Q: Why do keys and secrets matter so much for quantum risk?

A: Because encryption is only protective when the surrounding key and access governance is tight. If keys, tokens, or secrets are widely distributed, embedded in code, or reachable by too many identities, the security boundary weakens long before any quantum threat matures. The real issue is control of the assets that unlock the data.

Q: How do security teams decide which encrypted data to protect first?

A: Prioritise by sensitivity, retention, and downstream use. Long-lived customer, financial, regulated, and intellectual property datasets should rise to the top, especially where they feed analytics or AI workflows. That approach focuses remediation on records that would cause the most harm if current encryption became ineffective.

Q: What should organisations do when encrypted data and keys are spread across many systems?

A: They should build a single exposure view that ties datasets to keys, secrets, and owners. That makes it possible to see where broad access, data sprawl, or weak cryptographic governance creates avoidable future risk. Without that linkage, quantum planning stays theoretical and remediation stays unfocused.

Technical breakdown

Why encryption visibility matters before post-quantum migration

Post-quantum cryptography addresses future algorithmic weakness, but it does not answer a more basic question: what data is at risk if current encryption fails? Encryption deployments can exist across cloud, SaaS, on-prem, and AI pipelines without any unified view of sensitivity, ownership, or business impact. That leaves teams unable to prioritise remediation because they see controls, not exposure. A data-centric approach links cryptographic use to the records it protects and the consequences of compromise. Practical implication: map encryption to specific datasets before treating migration as a pure standards exercise.

Practical implication: Map encryption to specific datasets before treating migration as a pure standards exercise.

How keys, secrets, and access paths create quantum exposure

Encryption depends on more than algorithms. Keys, secrets, tokens, and credentials determine who can use, recover, or misuse protected data, and they are often scattered across systems, code, and pipelines. When those assets are overexposed or poorly managed, the security boundary shifts from the cipher to the surrounding identity and access controls. That is why quantum readiness overlaps with IAM, secrets management, and workload access governance. Practical implication: inventory cryptographic assets and reduce the number of identities and services that can reach them.

Practical implication: Inventory cryptographic assets and reduce the number of identities and services that can reach them.

Data exposure becomes a risk-ranking problem, not a binary control question

Not all encrypted data carries equal future risk. PII, PHI, financial records, and intellectual property have different exposure consequences, so readiness should be driven by the value and shelf life of the data, not by blanket encryption status. That logic is especially important in environments where data feeds analytics or AI systems, because exposure can propagate beyond storage into downstream workflows. Practical implication: rank encrypted assets by sensitivity, retention, and downstream use so the highest-impact data gets attention first.

Practical implication: Rank encrypted assets by sensitivity, retention, and downstream use so the highest-impact data gets attention first.

Threat narrative

Attacker objective: The attacker wants to preserve encrypted data until decryption becomes feasible, then convert that stored material into readable sensitive information.

1. Entry begins with adversaries collecting encrypted data now, even when they cannot decrypt it yet, because they expect future quantum capability to break current protections.
2. Credential and key exposure compound the risk when encryption keys, secrets, or broad access paths are stored or distributed too widely across environments.
3. Impact arrives later when previously harvested data becomes readable, turning today’s apparently safe records into a delayed breach event.

Breaches seen in the wild

• DeepSeek database exposure 2025: An unauthenticated DeepSeek ClickHouse database exposed over a million log lines with plaintext chat history and API keys in 2025.
• Gravity SMTP CVE-2026-4020 API Keys Exposure: CVE-2026-4020 in Gravity SMTP exposes API keys via single HTTP request across 100,000 WordPress sites.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Quantum readiness debt: organisations that treat post-quantum cryptography as the whole answer are carrying a governance gap, not just a technical migration challenge. The missing control is data exposure visibility, because you cannot prioritise what you cannot see. The practical conclusion is that readiness starts with knowing which datasets would matter if current encryption were broken.

Cryptography without asset context is incomplete: encryption status alone does not tell a security team whether risk is high or low. Keys, secrets, and access rights determine the real blast radius, which means quantum preparedness overlaps with IAM and secrets governance as much as with crypto modernization. Practitioners should treat cryptographic inventory as an access-governance problem, not a standalone engineering task.

Data shelf life is the deciding factor: harvest-now, decrypt-later only matters when the data is valuable long enough to outlast current defences. That makes retention, sensitivity, and downstream reuse the right way to rank exposure, especially where data feeds analytics and AI systems. The practitioner takeaway is to prioritise long-lived, high-value datasets first.

AI amplifies quantum exposure: once sensitive data is reused in copilots, training flows, and automated decisions, a future decryption failure has a wider operational footprint. This is where the identity and data-security intersection becomes real: more access paths mean more places where encrypted data can be copied, processed, or retained. Teams should govern data flows into AI systems as part of quantum readiness, not as a separate issue.

From our research library:

• Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
• 96% of security operations teams report critical blind spots, most commonly in cloud infrastructure (74%) and identity and access behaviour (67%).
• Read next: Ultimate Guide to NHIs — Key Challenges and Risks

What this signals

Quantum readiness debt: treating algorithm migration as the main event leaves exposure, retention, and access governance untouched. The practical shift is to rank data by shelf life and sensitivity, then target the records that would matter most if current encryption failed.

Visibility is the control plane: organisations cannot manage quantum exposure when keys, secrets, and encrypted datasets are invisible across cloud, SaaS, and on-prem systems. That is why visibility into the cryptographic estate has to come before any migration roadmap.

The broader pattern is familiar across identity security as well. When only 5.7% of organisations have full visibility into their service accounts, it is unsurprising that cryptographic assets and encrypted data are also poorly governed, according to the Ultimate Guide to NHIs.

For practitioners

• Discover encrypted data across every environment Build an inventory of encrypted data across cloud, SaaS, on-prem, structured stores, unstructured stores, and AI pipelines so exposure can be assessed before migration planning begins.
• Map keys, secrets, and credentials to their data owners Identify where encryption keys, API keys, tokens, and embedded secrets live, who can reach them, and which datasets depend on them for protection.
• Rank datasets by sensitivity and business impact Separate high-value data such as PII, PHI, financial records, and intellectual property from lower-risk encrypted assets so remediation effort follows exposure, not inventory size.
• Reduce overexposed access to cryptographic assets Review excessive service and human access to encrypted data and supporting key material, then narrow the access paths that would widen future decryption impact.

Key takeaways

• Quantum readiness fails when teams focus on future algorithms but cannot yet see where sensitive data is encrypted or which keys protect it.
• The central exposure problem is not just cryptography, but the combination of long-lived data, scattered key material, and broad access paths.
• A useful readiness programme ranks encrypted assets by sensitivity, retention, and downstream use, then reduces exposure where the business impact is highest.

Key terms

• Harvest now, decrypt later: An attacker strategy where encrypted traffic or stored data is collected today and decrypted later when better computing power becomes available. It matters to NHI governance because machine identities often protect the data paths and secrets most worth preserving over time.
• Cryptographic Asset Exposure: The condition in which keys, secrets, certificates, and related management systems are too widely accessible or poorly inventoried to provide reliable protection. In practice, the security of encrypted data depends on these assets being governed with the same discipline as identities and privileges.
• Data Centric Security: Data Centric Security protects information itself, rather than relying only on the security of systems that store or move it. It uses controls such as classification, encryption, tokenization, access policies, and usage restrictions so data remains protected wherever it travels, is copied, or is processed across cloud, endpoint, and application environments.
• Key Sprawl: The condition where keys are scattered across clouds, pipelines, applications, and local systems without central visibility. Sprawl makes it harder to know which keys are active, who owns them, and whether they are safe to keep in circulation.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps security practitioners connect identity controls to the broader access and exposure risks their programmes must govern.