Topic starter
18/08/2026 2:14 pm
TL;DR: Encrypted data theft is already a live threat because attackers can store it now and decrypt it later, while EY says 87% of UK business leaders expect quantum disruption by 2030 and ISACA found 56% of security and trust professionals are concerned, according to Ground Labs. The practical issue is not distant quantum capability but how long sensitive data, digital identities and certificates remain valuable and exposed.
Editorial analysis by NHI Mgmt Group, based on content published by Ground Labs: “Harvest now, decrypt later: Why quantum risk cannot wait”.
By the numbers:
- 87% of UK business leaders expect disruption from quantum computing by 2030, according to EY research cited by Ground Labs.
Key questions
Q: What breaks when encrypted identity data is harvested now and decrypted later?
A: The failure is not immediate access but deferred compromise.
Q: Why do long-lived data and credentials increase quantum risk?
A: Long-lived data increases quantum risk because information that is safe today may still need to remain confidential after quantum-capable attackers emerge.
Q: What are the signs that cryptographic exposure is growing?
A: Look for systems with undocumented certificates, duplicated sensitive data across email and backups, long retention periods, and identity or application services that still depend on vulnerable public-key algorithms.
Practitioner guidance
- Map long-lived data and identity records Classify which records must remain confidential beyond 2030, including identity data, biometric data, legal records and sensitive business information, then rank them by confidentiality lifespan and exposure.
- Build a cryptographic inventory Document the algorithms, keys, certificates, libraries and dependencies protecting each high-value system so you can see where vulnerable public-key cryptography still underpins trust.
- Reduce unnecessary retention and duplication Delete stale copies, enforce retention rules and narrow access paths so fewer long-lived records are available for harvest-and-hold attacks.
Bottom line: Harvest now, decrypt later turns encryption into a time-based risk problem because data stolen today may only be exploitable years later.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:06 pm
Harvest now, decrypt later is a governance failure of data lifespan, not just a cryptography problem. Organisations often classify encryption as sufficient once data is protected in transit or at rest, but that assumption ignores how long the underlying information must stay confidential. When data has a multi-year or lifelong value horizon, the control has to be evaluated against future decryption capability as well as present-day interception. The practitioner conclusion is simple: confidentiality planning must align with retention reality.
A question worth separating out:
Q: When should organisations prioritise post-quantum migration work over waiting for final standards?
A: Organisations should begin planning now, even before every standard detail is final, because migration across certificates, validation software, and application ecosystems can take years. Waiting creates a larger backlog once production deadlines tighten. The sensible sequence is inventory, lab testing, and dependency mapping first, then staged rollout as standards and interoperability guidance stabilise.
👉 Read our full editorial: Harvest now, decrypt later exposes long-term identity data risk