Harvest now, decrypt later, explained for people who own the risk

The attack is already running

Harvest now, decrypt later (HNDL) is the simplest attack in the post-quantum threat model, and the only one you can't detect. An adversary records your encrypted traffic, or exfiltrates your encrypted archives, and stores it. They can't read it yet. They don't need to. They wait until a cryptographically relevant quantum computer exists, then decrypt everything at once.

Nothing about this is speculative. Traffic capture is routine. Storage is cheap. The only variable is the arrival date of the machine, and that variable does not protect you, it protects the attacker, who gets to choose when the loss is realised.

Mosca's inequality

Michele Mosca framed the decision as a simple inequality. Let:

• x = how long your data must stay confidential (years)
• y = how long your migration to post-quantum will take (years)
• z = how long until a cryptographically relevant quantum computer exists (years)

If x + y > z, you are already losing confidentiality on data you send today.

x (confidentiality lifetime)  +  y (migration time)  >  z (time to CRQC)
      15                              4                       10        →  violated by 9 years

For a bank with a 15-year confidentiality requirement and a realistic four-year migration, the inequality is violated even under optimistic estimates of *z*. For an exabyte archive with a 30-year requirement, it is violated by decades.

What to do about it this quarter

1. Inventory. You cannot migrate what you cannot see. Produce a CBOM, a cryptographic bill of materials, across code, certificates, and infrastructure.
2. Score. Apply Mosca per data class. The output isn't "migrate everything"; it's a ranked list where *x + y > z* today.
3. Rewrap the cheap layer first. For most archives, the key-encryption-key layer can move to hybrid PQC quickly; the data-encryption layer is the expensive, slow part you plan around.

The point of HNDL is that it makes the deadline retroactive. The data you protect in 2030 was already stolen in 2024.