Most quantum-safe cryptography conversations are framed around a future event: the day a cryptographically relevant quantum computer (CRQC) becomes available and today’s public-key algorithms stop protecting anything. That framing makes the risk feel comfortably distant. It also misses the part that isn’t distant at all.
Harvest now, decrypt later (HNDL) – sometimes called steal now, decrypt later (SNDL) – describes an adversary capturing encrypted data today and simply holding onto it. The data doesn’t need to be readable now. It only needs to still matter by the time a CRQC exists to break the encryption protecting it. The attack’s collection phase requires no quantum computer at all – only patience, storage, and something worth waiting for.
Why this is a present risk, not a future one
UK NCSC’s own guidance on preparing for post-quantum cryptography is direct about this: “The threat to key agreement is that an adversary collecting encrypted data today would be able to decrypt it in future, should they have access to a CRQC.” NCSC notes the attack is realistically only worthwhile for high-value information, given the storage costs involved – but for the data that qualifies, the exposure window opened whenever collection became possible, not whenever decryption becomes possible.
That’s the uncomfortable reframe. The countdown to “when does this stop being safe” isn’t measured from today. For plenty of organisations, it started years ago, quietly, without an incident to mark the moment.
The maths of “already exposed”
A simple test, often attributed to Dr Michele Mosca, makes the exposure concrete. Take three numbers: how many years your data needs to stay confidential (X), how many years it will take you to migrate the systems protecting it (Y), and how many years remain until a CRQC exists (Z). If X plus Y is greater than Z, that data is already exposed under an HNDL attack, whether or not the collection has happened yet.
For anything with a genuinely long confidentiality life – financial records, health data, long-term contracts, government and citizen records, source code and trade secrets – the first number alone can run to decades. Add the years a real migration programme actually takes across a large estate, and Z doesn’t need to be very small at all before the inequality tips the wrong way.
The related, distinct risk: forged signatures
HNDL threatens confidentiality: something encrypted today, read later. A related but separate risk threatens integrity instead. Trust now, forge later (TNFL) describes what happens once today’s signature algorithms – RSA, ECC – can eventually be broken: an adversary can forge a new signature that appears perfectly legitimate under an existing key, undermining trust in anything ever signed with it, not just data captured in advance. Where HNDL is about collection today, TNFL is about the retroactive credibility of a signature once the algorithm underneath it fails. Both point to the same underlying question: which of your cryptographic assets protect something whose value will outlast the algorithm protecting it?
Which data is most exposed
Not everything carries equal HNDL risk. A session key protecting a five-minute video call has effectively no exposure window worth worrying about. The data that matters is whatever needs to stay confidential, or stay trustworthy, for years: regulatory filings, intellectual property, litigation-sensitive material, health and insurance records, anything with a statutory retention period measured in decades. The standards bodies driving cryptographic governance – PCI DSS 4.0, DORA, NIS2 among them – don’t mandate a specific replacement algorithm by name. What they consistently require is an up-to-date inventory of the cryptography in use and a governance process around it, which is itself an acknowledgement that you can’t reason about HNDL exposure, or anything else, without first knowing where the long-lived data and the keys protecting it actually are.
Knowing where you stand before the maths gets worse
NIST finalised its post-quantum standards – ML-KEM, ML-DSA, SLH-DSA – in August 2024. Its proposed transition guidance signals deprecating RSA and ECC by 2030 and disallowing them by 2035, with UK NCSC and the EU’s own roadmaps pointing to broadly comparable horizons out to 2035. Those dates matter, but treating them as the start of the clock misreads the risk. For HNDL specifically, the clock already started the moment anything worth protecting for a decade or more was first encrypted with an algorithm quantum computers will eventually break.
That’s why the practical starting point isn’t picking an algorithm. It’s discovery: finding out which cryptography is protecting which data, right now, and how long that data actually needs to stay confidential or trustworthy. A living Cryptography Bill of Materials (CBOM) is what makes that answerable – not as a one-off scan, but as a record that stays current as the estate changes. From there, exposure can be scored by how long the data must hold and how badly a breach would land, so the systems facing the sharpest HNDL exposure move to the front of the migration roadmap, rather than being addressed in whatever order they happen to be found.
The quantum computer capable of finishing this attack doesn’t exist yet. The part of the attack that doesn’t need one may already be under way.
Further reading: our whitepaper on Harvest Now, Decrypt Later, building an Enterprise CBOM, and cryptographic exposure assessment.