Topic starter
24/10/2026 8:53 pm
TL;DR: Ciphertext gathered today can be decrypted later if quantum computing weakens RSA and ECC, according to Sectigo. Crypto inventories and migration plans have to account for data that must stay confidential for years.
Editorial analysis by NHI Mgmt Group, based on content published by Sectigo: “Harvest now, decrypt later attacks & how they relate to the quantum threat”.
By the numbers:
- The article says conventional asymmetric cryptography may no longer provide sufficient protection by 2030.
Key questions
Q: Why does quantum risk change how organisations think about data retention?
A: Because encrypted data can be stolen now and decrypted later, retention length becomes a security variable.
Q: What breaks when an organisation keeps using legacy encryption algorithms?
A: Legacy encryption fails when weak hashes, short keys, or obsolete protocols still underpin trust decisions.
Q: How should security teams prepare for harvest now, decrypt later attacks?
A: Start with a complete cryptographic inventory, then rank assets by confidentiality lifetime and business impact.
Practitioner guidance
- Inventory cryptographic dependencies across identity and data flows Map where RSA, ECC, certificates, tokens and other cryptographic dependencies are used across applications, integrations and storage layers.
- Define a post-quantum migration roadmap Set sequencing for discovery, testing, hybrid deployment and retirement of vulnerable algorithms so replacement work happens before quantum risk becomes operationally urgent.
- Protect long-retention data with stronger lifecycle governance Prioritise records whose confidentiality must last for years, not months, and review whether encryption, retention and archival policies assume too much about algorithm longevity.
Bottom line: Harvest now, decrypt later is a delayed exposure problem, not a theoretical one, because ciphertext collected now can become readable later if cryptography weakens.
Glossary terms: Harvest now, decrypt later, Crypto-Agility, Post-Quantum Cryptography, Machine identity lifecycle
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
25/10/2026 11:12 am
HNDL turns encryption into a lifecycle governance problem: the control failure is not only whether data is encrypted today, but whether the organisation can guarantee protection for as long as the data remains valuable. This makes retention, key dependency and migration planning part of the same risk picture. The practical conclusion is that encryption strategy must be managed as a time-bound control, not a one-time deployment.
A question worth separating out:
Q: When should security teams prioritise post-quantum readiness work?
A: Teams should prioritise it now for identities tied to long-lived confidentiality, hard-to-rotate secrets, and externally exposed trust paths. Those are the assets most likely to remain valuable if attackers capture encrypted material today. Waiting shifts the burden to an emergency migration, which is usually slower and more disruptive.
👉 Read our full editorial: Crypto agility is the practical answer to harvest-now risk
This post was modified 6 days ago by NHI Mgmt Group