Harvest now, decrypt later is the attack where an adversary records encrypted traffic today and keeps it until a quantum computer can break the key exchange that protected it. On October 1, 2026, the NSA stated that adversaries are already employing harvest now, decrypt later strategies, and since March 2025 the UK, Canada and the US have each put dates on post-quantum cryptography migration. If any of your data must stay confidential for a decade, your deadline comes earlier than the day a quantum computer arrives, and for the traffic your organization sent this morning it may already be behind you.
That sounds like a scare line, so here is the arithmetic behind it.
Harvest now, decrypt later turns Q-Day into a deadline you can calculate
Michele Mosca framed the problem, and the Global Risk Institute’s latest Quantum Threat Timeline Report states it simply. Add how long your data must stay secret to how long your migration will take. If that sum is longer than the time until someone has a cryptographically relevant quantum computer, you are already exposed, because everything recorded in the gap can be opened later.
The third number is the uncertain one, and it keeps moving in one direction. In 2015 Mosca put even odds on RSA-2048 being broken by 2031. The institute’s survey of 26 experts, summarized in March 2026, put the chance of such a machine at 28 to 49 percent within 10 years and 51 to 70 percent within 15. The same experts called covert, unpublished progress a concrete possibility, so the public record is a floor rather than a forecast.
Our position is that the useful input is not the quantum date at all. It is the shelf life of your data, which you control and can measure. A payment authorization worthless in a week does not care. Government records, sensitive personal data and trade secrets do care, and they cross the same TLS and VPN tunnels as everything else.
The machine needed to break RSA-2048 keeps getting smaller
Shelf life is your number. The attacker’s number comes from resource estimates, and the published ones have collapsed. In 2019, Craig Gidney and Martin Ekerå estimated that RSA-2048 could be factored in eight hours with 20 million noisy qubits. In May 2025, Gidney kept the same hardware assumptions and brought it to under a million qubits in under a week. In February 2026, Iceberg Quantum’s Pinnacle Architecture paper claimed fewer than 100,000 physical qubits at the same error rate and cycle time.
The newest figure has conditions. Pinnacle uses quantum LDPC codes, which need non-local interactions between qubits rather than the flat grid of the earlier papers, and its expected runtime is about a month. Nobody has built any of these machines. Still, every one of those papers moved the estimate the same way.
Elliptic curves are no safer. On March 30, 2026, Google Quantum AI and co-authors estimated that 256-bit elliptic curve keys could fall in minutes on fewer than half a million physical qubits. They proved the result with a zero-knowledge proof instead of publishing the circuits, and Google framed that as responsible disclosure. When researchers start withholding quantum attack details the way we withhold exploit code, the field is telling you how close it thinks the threat is.
Post-quantum cryptography deadlines are now in writing
If the attacker’s timeline is uncertain, the regulatory one no longer is. The standards have been ready since August 13, 2024, when NIST finalized FIPS 203, 204 and 205, giving us ML-KEM for key establishment and ML-DSA and SLH-DSA for signatures. NIST’s draft transition plan, IR 8547, proposes deprecating quantum-vulnerable algorithms at the 112-bit security level after 2030 and disallowing all of them after 2035. What changed in 2026 is that governments turned those proposals into obligations with owners.
Executive Order 14412, signed June 22, 2026, gives US agencies until December 31, 2030 to move high value assets and high impact systems to post-quantum key establishment, and until December 31, 2031 for signatures. It also directs a proposed FAR rule requiring covered federal contractors to meet NIST’s FIPS, post-quantum ones included, by the end of 2030. The NSA added on October 1 that new commercial National Security Systems must support quantum-resistant algorithms from 2027, with legacy systems phased out by 2030.
Canada set its own dates in 2025. The Canadian Centre for Cyber Security’s roadmap for federal systems asks for high-priority systems by the end of 2031 and everything else by the end of 2035. The Treasury Board then made the first milestone policy with a notice requiring departmental migration plans by April 1, 2026. The UK NCSC’s migration timeline runs on the same rhythm, with discovery by 2028, priority migrations by 2031 and completion by 2035. On September 3, 2026, the G7 cyber agencies issued a joint call to action to start now.
Notice how often 2031 appears, the same year Mosca gave even odds for in 2015. If you sell into US federal or Canadian government programs, these dates will reach you as contract clauses first, through the proposed FAR rule and the post-quantum procurement clauses Canada’s roadmap recommends.
Browsers already moved, so the gap is your servers
The good news is that quantum-resistant encryption for web traffic mostly shipped while the policy was being written. Cloudflare reported in February 2026 that client support for post-quantum key agreement on its network had grown from under 3 percent at the start of 2024 to over 60 percent. The server side lags badly, since only about 10 percent of the origins it scanned could negotiate it.
| Period | Value |
|---|---|
| Clients, Jan 2024 | under 3% |
| Clients, Feb 2026 | over 60% |
| Origins, Feb 2026 | about 10% |
That gap is the cheapest harvest-now risk you can close. OpenSSH has defaulted to a hybrid ML-KEM key exchange since version 10.0 in April 2025, and 10.1 warns when a session does not use one. OpenSSL 3.5, a long-term support release maintained until April 2030, ships ML-KEM, ML-DSA and SLH-DSA. The work is configuration, testing and finding the appliances that lag.
VPNs are where we expect friction. A complete specification for hybrid ML-KEM in IPsec only arrived in late 2025, roughly four years after TLS. In April 2026 Cloudflare reported that its IPsec does not yet interoperate with at least one major firewall vendor’s implementation, which shipped against an earlier, more general RFC. Site-to-site tunnels carry exactly the traffic harvesters want, so ask your firewall vendor which specification it implements, not whether it supports post-quantum.
Signatures are the slower half of PQC migration
Key exchange protects what is being recorded now. Signatures protect what you will trust later, and that half moves more slowly because the keys live in hardware and certificate chains. The NSA’s release names the risk “trust now, exploit later”. Google reprioritized its own migration toward authentication in March, with a 2029 timeline and ML-DSA arriving in Android 17. The NCSC’s 2028 milestone asks organizations to plan for long-lived hardware roots of trust.
The consequence lands in procurement. Appliances bought this year will often still be verifying firmware signatures when the 2030 and 2031 dates arrive. Settle now whether a vendor’s root of trust can move to a post-quantum algorithm in the field, or whether it needs a new box.
What a PQC migration plan needs in its first year
All of this has to land in one plan, and the Canadian roadmap is the most practical guide to its first year. Its first advice is to start with an initial, incomplete inventory and improve it as you go. Record, per system, the cryptographic configuration, vendor and version, service contract expiry, and expected refresh year. That last field is where the budget lives, since the roadmap warns that delay leads to rushed, costlier procurement. The certificates in the non-human identity inventory we have argued for are a good place to start this one.
Prioritize with the Mosca arithmetic. Systems that carry long-lived secrets across public networks go first, as the Canadian guidance advises. Systems that only sign short-lived tokens can usually ride their normal refresh cycle, provided it lands before the 2030s deadlines. Legacy that can never support the new algorithms gets isolated or tunnelled inside a post-quantum layer.
Two definitions keep a plan honest. The G7 agencies define cryptographic agility as building systems whose cryptographic components can be replaced, and warn against confusing it with negotiating cipher suites at runtime. Canada defines done as quantum-vulnerable algorithms disabled, isolated or tunnelled, not merely supported alongside the new ones. Plenty of progress reports count a hybrid-capable server as finished, and by that definition it is not. Mapping where keys and certificates live across cloud and identity platforms is work our security engineering practice does.
What to ask your team this week
The NSA’s warning is about traffic being recorded now, so start with what crosses the wire today.
- Which of our data must stay confidential past 2035, and which tunnels and APIs carry it?
- What share of our public endpoints negotiate hybrid ML-KEM today, and who owns the rest?
- Which VPN and firewall vendors have committed to the IETF hybrid ML-KEM specification, and by when?
- Which devices and signing keys cannot move to a post-quantum algorithm without replacement?
- Do new contracts require post-quantum support and crypto agility?
Bottom line
Rank your data by how long it must stay secret, then turn on hybrid ML-KEM wherever your stack already supports it, starting with the links that carry that data. Put post-quantum requirements into every contract you sign from now on. The recordings being made this morning will not wait for a plan.