TL;DR: The real quantum risk in finance is not only cryptographic breakage but long-lived sensitive data already leaving monitored systems through normal work, creating harvest-now, decrypt-later exposure and insider-risk pressure before quantum capability arrives, according to DTEX. Boards need behavior-level visibility, not just PQC migration plans, because invisible data movement determines what becomes readable later.
At a glance
What this is: DTEX frames quantum risk in finance as a visibility problem, where long-lived sensitive data copied into unmonitored locations creates harvest-now, decrypt-later exposure.
Why it matters: That matters to identity and access teams because privileged access, third-party access, and user behavior can turn everyday data movement into a future breach even when cryptography is still intact.
Context
Quantum risk in finance is not only about future cryptographic failure. It is also about sensitive information moving into places that security teams do not monitor, where it can sit for years before being decrypted or misused. That makes the problem as much about governance of data movement and privileged access as it is about algorithms.
The article’s core issue is that long-lived data, human workflows, and unstructured repositories create a visibility gap that PQC alone does not close. In identity terms, the control weakness is not merely authentication strength but the inability to see where trusted access carries sensitive data after the initial login or API call.
Key questions
Q: How should security teams prioritise quantum readiness when budgets are limited?
A: Start with the data whose confidentiality horizon is longest and whose loss would be most damaging if decrypted years later. That means inventorying where public-key cryptography is used, then ranking long-lived data sets, privileged access paths, and unstructured copies by business impact. Migration should follow exposure reality, not technical elegance alone.
A: Because encrypted data can be captured today and stored until future quantum capabilities make decryption feasible. The risk is highest for information that must stay confidential for years, such as health records, financial data, communications, and trade secrets. In those cases, delay is not neutral. It extends the window in which an attacker can preserve data for later compromise.
Q: Where do quantum-related data exposures usually appear in enterprise workflows?
A: They usually appear where people and tools create extra copies: spreadsheets, email attachments, shared drives, offline reports, screenshots, and AI-assisted summaries. These copies are often more exposed than the source system itself, which is why lineage and behaviour telemetry matter as much as encryption roadmaps.
Q: What should banks prove to regulators about quantum preparedness?
A: They should prove both migration planning and exposure visibility. That means showing where public-key cryptography is used, which data sets stay sensitive for years, who can reach them, and how unusual movement is detected. Regulators will care less about slideware than about evidence that risky data paths are known and governed.
Technical breakdown
How harvest now, decrypt later changes the risk model
Harvest now, decrypt later means attackers collect encrypted material today and wait until quantum capability makes current public-key schemes easier to break. The technical issue is retention, not just encryption strength: if the data remains valuable for 10 to 20 years, the attacker only needs access once. That makes exposure windows unusually long compared with many conventional theft scenarios. In practice, the risk is amplified when the same data passes through multiple systems, exports, and collaboration tools before it is finally stored or archived. See the Post-Quantum Readiness for Identity and PKI guide. Read Post-Quantum Readiness for Identity and PKI.
Practical implication: Prioritise the data sets whose confidentiality horizon outlasts today’s cryptographic assumptions.
Why unstructured data creates the quantum exposure path
Unstructured data is the operational gap that makes quantum risk concrete. Spreadsheets, PDFs, email attachments, shared drives, screenshots, and AI-assisted summaries often sit outside the control plane that protects structured databases. Once copied into these environments, the same material can be moved by insiders, contractors, or compromised accounts without triggering strong controls. From a governance perspective, the issue is not whether the source system is encrypted, but whether the copies are governed, monitored, and revocable. That is why data lineage matters as much as key management.
Practical implication: Track where sensitive content is copied, not just where it was created.
Why privileged access and AI workflows matter before quantum arrives
The article’s most identity-relevant point is that trusted access is the path that turns quantum risk into an operational issue. When administrators, developers, vendors, or service accounts can move sensitive data freely, their legitimate activity becomes the easiest harvest channel. AI and GenAI tools widen that path by creating additional export destinations and copy points. In identity terms, this is a governance problem about scope, observability, and intent, not just account possession. See the Identity Visibility and Intelligence Platforms guide. See the Identity Visibility and Intelligence Platforms (IVIP) Guide.
Practical implication: Baseline privileged and AI-assisted data movement so unusual exports are visible before they become permanent.
NHI Mgmt Group analysis
Quantum readiness in finance is fundamentally a data-governance problem, not only a cryptography programme. PQC protects future transport and signature assumptions, but it does not undo the years of data already copied into email, collaboration tools, local exports, and unmanaged repositories. Financial institutions therefore need to treat visibility into data movement as a first-order control, not a supporting metric. The practical conclusion is that quantum planning starts with where sensitive data actually lives.
The governance gap is the assumption that cryptographic strength alone preserves trust. In financial services, the article shows that identity, privilege, and human workflow often carry sensitive data farther than core systems do. That means the control failure is not just weak encryption but overreliance on trusted access as a proxy for safe handling. Conditional access and behavioral monitoring become relevant because location, device, and pattern context matter when access is the main export channel.
Harvest-now, decrypt-later creates a new class of latent exposure that boards must measure explicitly. The risk is not hypothetical once long-lived customer, trade, and strategy data can be copied into unmonitored places today. That makes data lineage, privileged-access oversight, and AI-tool governance part of the same control conversation. For practitioners, the message is to move from cryptographic inventory alone to exposure inventory plus behavior telemetry.
Service-account visibility debt: the article’s most operationally useful concept is that blind spots in trusted access create deferred breach value. If organisations cannot see where sensitive data moves under legitimate access, they cannot know what quantum later makes readable. The right response is to treat invisible data movement as accumulated risk and to remove it before cryptographic timelines become irrelevant. Practitioners should make visibility itself a governed asset.
From our research library:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- Read next: Identity Data Quality and Identity Fabric Guide
What this signals
Quantum readiness will be judged by data movement, not by cryptography roadmaps alone. Banks can document algorithm migration and still leave the highest-risk content exposed if they cannot see where it travels after normal work. The programme implication is clear: build control evidence around lineage, exports, and privileged pathways, not just key upgrades.
Harvest-now, decrypt-later turns routine copying into deferred breach inventory. A file moved into an email thread, shared drive, or personal folder may be harmless today and catastrophic later if it contains long-lived financial data. That means identity teams and data teams need a shared operational view of who can move what, where, and under what conditions.
For practitioners
- Prioritise long-lived data sets Start with transaction histories, identity records, strategy documents, and other data that would still be damaging in 10 to 20 years. Map where those assets actually live, including user-managed and unstructured locations.
- Map privileged and third-party data movement Baseline how administrators, developers, vendors, and service accounts move sensitive information, then flag unusual exports, destinations, and volumes. Focus on behaviour patterns rather than account creation alone.
- Tie PQC planning to exposure reality Use cryptography inventory and data lineage together so migration order reflects both algorithm risk and where the most sensitive content travels today.
- Monitor AI-assisted exports as a separate path Treat GenAI summarisation, chat uploads, and prompt-driven copying as distinct data movement channels that can carry regulated or long-lived information out of governed systems.
Key takeaways
- Quantum risk in finance is not just a future cryptography problem, because long-lived data already leaves monitored systems through ordinary work.
- The exposure becomes serious when trusted access, unstructured repositories, and AI-assisted workflows create copies that security teams cannot easily see or revoke.
- Banks should align PQC migration with data lineage and privileged-access telemetry so the most durable exposures are reduced first.
Related NHI Mgmt Group resources: Post-Quantum Readiness for Identity and PKI · Identity Data Quality and Identity Fabric Guide · Identity Visibility and Intelligence Platforms (IVIP) Guide
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 — Secret Leakage | Sensitive financial data is exposed when it is copied into unmonitored places outside governed systems. |
| NHI-05 — Overprivileged NHI | The article highlights privileged access paths that let accounts move sensitive data without sufficient scope control. | |
| Recommendation — Scan for exposed sensitive content in ungoverned repositories and revoke or contain the copies quickly. Reduce standing access and narrow the scope of service and privileged accounts that can move sensitive data. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The risk depends on who can reach and export long-lived sensitive data across systems. |
| Recommendation — Review entitlements that allow bulk data movement and remove unnecessary export paths. | ||
| CIS Controls v8 | CIS-5 — Account Management | The article centers on privileged and third-party access patterns that need governance and monitoring. |
| Recommendation — Maintain account inventories and monitor privileged access paths that can carry sensitive data out of control. | ||
| MITRE ATT&CK | TA0006;TA0010 — Credential Access; Exfiltration | The article describes legitimate access used to move data into unmonitored locations for later harvesting. |
| Recommendation — Map suspicious data movement to credential access and exfiltration tactics in your detection pipeline. | ||
Key terms
- Harvest now, decrypt later: An attacker strategy where encrypted traffic or stored data is collected today and decrypted later when better computing power becomes available. It matters to NHI governance because machine identities often protect the data paths and secrets most worth preserving over time.
- Data Lineage: The record of how data moves across systems, applications, and workflows. In security operations, lineage shows where sensitive data propagates, which identities touch it, and how a compromise could spread across connected environments.
- Behavioural Telemetry: Operational evidence that shows what an identity actually did, not just what it was allowed to do. For autonomous systems, behavioural telemetry is essential because policy compliance alone cannot prove that the sequence of actions was safe.
- Quantum Readiness: Quantum readiness is the programme of preparing identity, trust, and infrastructure systems for cryptographic change before current algorithms or certificates become unsafe. It combines discovery, migration planning, dependency mapping, and governance so trust can be updated without service disruption or hidden exposure.
Deepen your knowledge
NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, secrets management, and identity lifecycle control. It helps practitioners connect identity governance to the access and trust issues that shape broader security programmes.
Published by the NHIMG editorial team on October 22, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org