Insight
Harvest now, decrypt later is already in your threat model
If your data has to stay secret for ten years, the quantum question is not about the future. It is about what is being copied today.
QCT Studio team1 min read
If your data has to stay secret for ten years, the quantum question is not about the future. It is about what is being copied today.
Why this matters now
Regulators have moved from asking whether firms are aware of the risk to asking what they have done about it. That shift changes the conversation from research to delivery, and delivery needs an inventory, an owner and a date.
- Inventory first. You cannot migrate what you have not found.
- Rank by shelf life. Data that must stay secret longest moves first.
- Prove it continuously. A one-off report goes stale the day after it is filed.
The question is not whether the risk is real, but whether your migration finishes first.
What good looks like
| Stage | Output | Owner |
|---|---|---|
| Assess | Exposure by data class | CISO |
| Discover | Cryptographic inventory | Platform teams |
| Migrate | Hybrid designs in pilots | Architecture |
| Assure | Drift watch, board reports | Risk |
A note on hybrids
Hybrid schemes pair a classical algorithm with a post-quantum one, so the result is at least as strong as the stronger of the two:
shared_secret = KDF(x25519_secret || ml_kem_768_secret)
This is sample content generated by pnpm mockdata:up to show the layout. Remove it with pnpm mockdata:down.
- post-quantum
- strategy
