Your encrypted data could be harvested today and decrypted tomorrow
Quantum computing promises significant opportunities, but it also presents a fundamental challenge to the cryptographic methods organisations currently rely on to protect sensitive information.
The concern is not confined to the future.
Cybersecurity authorities have highlighted the threat commonly described as “harvest now, decrypt later”: adversaries collect encrypted information today and retain it with the intention of decrypting it once sufficiently powerful quantum computing becomes available.
This means organisations holding information that must remain confidential for many years should start considering their exposure now, rather than waiting for quantum technology to mature.
What information could be at risk?
- Legal and privileged information
- Financial records
- M&A and transaction documentation
- Health data
- Trade secrets and commercially sensitive information
For boards and senior management, quantum resilience is therefore increasingly a matter of risk management, governance and long-term business resilience, rather than simply an IT consideration.
From uncertainty to a practical roadmap
MHA’s Risk, Resilience and Security specialists have developed a structured approach designed to help organisations understand their cryptographic exposure and establish a prioritised migration roadmap towards quantum resilience.
| 01 | Discovery & Inventory
Identify where quantum-vulnerable cryptography is being used across the organisation’s systems and suppliers. |
| 02 | Risk Assessment
Prioritise actions according to actual business exposure rather than technical complexity alone. |
| 03 | Governance & Roadmap
Develop a quantum-safe migration plan, with clear ownership and milestones aligned with NCSC and NIST timelines. |
| 04 | Long-life Data Controls
Identify information that must remain confidential for extended periods and establish appropriate controls and accelerated timelines for protecting it. |
| 05 | Ongoing Monitoring
Monitor migration progress as vendors develop their solutions and relevant standards continue to evolve. |
Why start preparing now?
The objective is not to predict exactly when cryptographically relevant quantum computers will arrive.
Instead, organisations should understand what sensitive information they hold, how long it needs to remain protected, where vulnerable cryptography is being used and what needs to change.
MHA notes that requirements for quantum-safe migration planning are already being established for as early as 2028 for critical national infrastructure, including financial infrastructure.
Starting early creates the opportunity to approach migration as a governed, prioritised and proportionate programme, rather than being forced into a reactive technology exercise later.
Questions for Boards and Management
› Do we know where quantum-vulnerable cryptography is used across our organisation and supply chain?
› Which of our information still needs to be confidential five, ten or more years from now?
› Have we assessed our exposure to “harvest now, decrypt later” risk?
› Do we have clear ownership and a roadmap for migration towards quantum-safe technologies?
If the answer to any of these questions is unclear, it may be time to assess your organisation’s quantum-resilience readiness.
| Preparing today for tomorrow’s cyber risk
Through the wider Baker Tilly International network, clients can access expertise to help identify quantum-related exposure, assess priorities and develop a practical roadmap towards greater resilience. MHA describes its approach as phased and proportionate to an organisation’s size and complexity, with usable deliverables at each stage. Want to understand what quantum computing could mean for your organisation? |
