Harvest now, decrypt later: are your encryption controls ready?

TL;DR: Harvest now, decrypt later attacks target encrypted data today so attackers can decrypt it later when quantum computing weakens RSA and ECC, according to Sectigo. The result is a long-tail exposure problem: crypto agility and post-quantum planning become governance requirements, not optional upgrades.

Editorial analysis by NHI Mgmt Group, based on content published by Sectigo: “Harvest now, decrypt later attacks & how they relate to the quantum threat”.

By the numbers:

• The article says conventional asymmetric cryptography may no longer provide sufficient protection by 2030.

Key questions

Q: How should security teams prepare for harvest now, decrypt later attacks?

A: Start with a complete cryptographic inventory, then rank assets by confidentiality lifetime and business impact.

Q: Why does quantum risk change how organisations think about data retention?

A: Because encrypted data can be stolen now and decrypted later, retention length becomes a security variable.

Q: What breaks when an organisation keeps using legacy encryption algorithms?

A: Legacy encryption fails when weak hashes, short keys, or obsolete protocols still underpin trust decisions.

Practitioner guidance

• Inventory cryptographic dependencies across identity and data flows Map where RSA, ECC, certificates, tokens and other cryptographic dependencies are used across applications, integrations and storage layers.
• Define a post-quantum migration roadmap Set sequencing for discovery, testing, hybrid deployment and retirement of vulnerable algorithms so replacement work happens before quantum risk becomes operationally urgent.
• Protect long-retention data with stronger lifecycle governance Prioritise records whose confidentiality must last for years, not months, and review whether encryption, retention and archival policies assume too much about algorithm longevity.

Bottom line: Harvest now, decrypt later is a delayed exposure problem, not a theoretical one, because ciphertext collected now can become readable later if cryptography weakens.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →