Topic starter
09/07/2026 1:40 pm
TL;DR: Post-quantum cryptography has shifted from a future concern to a present resilience problem because harvest now, decrypt later attacks can already expose long-lived data, and most organisations still lack a complete cryptographic inventory, according to Commvault. The real challenge is crypto agility: knowing where cryptography exists, who depends on it, and how to prioritize migration before certainty disappears.
Editorial analysis by NHI Mgmt Group, based on content published by Commvault: “Post-Quantum Cryptography: The Clock Has Already Started”.
Key questions
A: Start with the links that carry long-lived sensitive data and high-value administrative traffic, then use hybrid cryptography where classical and post-quantum methods can coexist.
Q: Why does Harvest Now, Decrypt Later change the PQC timeline?
A: Because the risk begins when encrypted data is collected, not when quantum decryption becomes practical.
A: Without a complete inventory, teams lose visibility into where certificates, keys, and other cryptographic assets live, who owns them, and when they expire.
Practitioner guidance
- Map cryptographic dependencies first Inventory where public-key cryptography exists across applications, certificates, cloud services, APIs, code signing, and third-party platforms before choosing migration targets.
- Prioritise long-lived data classes Rank information by retention period, regulatory sensitivity, and business value so Harvest Now, Decrypt Later exposure is addressed before short-lived data paths.
- Build a crypto-agility roadmap Document which platforms can swap algorithms, which require refactoring, and which depend on suppliers so transition sequencing is realistic.
Bottom line: Post-quantum risk is now a planning problem, not a distant research topic, because encrypted data can already be harvested for later decryption.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
09/07/2026 1:45 pm
Discovery debt is now the dominant PQC risk: Organisations are treating post-quantum planning as an algorithm decision when the harder problem is still inventory. Cryptography is embedded in applications, certificates, APIs, code signing, cloud services, and vendor platforms, so the first failure is blind scope. Until teams can see where cryptography lives, they cannot judge exposure or build a credible migration sequence.
A question worth separating out:
Q: What is the difference between crypto agility and one-time migration?
A: One-time migration replaces a specific algorithm once. Crypto agility is the ability to change cryptographic dependencies repeatedly as standards, suppliers, and threats evolve. It is a programme capability, not a single project milestone.
👉 Read our full editorial: Post-quantum cryptography readiness starts with discovery, not migration