Systems using modern cryptographic algorithms — such as ECC — protect major sectors including Healthcare, Defence, and Communications. These algorithms are secure today. But quantum computers such as the IBM Quantum System Core would make it exceedingly difficult for traditional systems to sustain their encryption in the long run. Information classified as confidential right now might already be in the process of being decrypted.
The quantum threat is already emerging through the "Harvest Now, Decrypt Later" strategy: adversaries intercept and archive encrypted data today — data they cannot yet read — and hold it until quantum computers mature enough to break it open. This is not a warning about the distant future. It is a description of operations already underway.
Tomorrow's Quantum Attacks Are Already on the Calendar
BCG analysis projects a structured timeline of quantum-enabled threat actors across different attack categories. By 2035, state-sponsored actors are expected to begin leveraging quantum capabilities for nation-state espionage and cyberwarfare. By 2040, criminal organisations will target mass identity theft and widespread fraudulent transactions. By 2045, corporate spies and hacktivists will use quantum advantages to steal trade secrets, disrupt utilities, and influence political outcomes. By 2050, insider threats will weaponise quantum decryption for internal sabotage and financial fraud.
These ongoing and upcoming threats are already accelerating the urgency of migration to Post-Quantum Cryptography (PQC) adoption. The damage that could materialise in the near future is not theoretical — it is being seeded now, through silent data harvesting happening at scale.
"Many quantum companies may start a bit too late on the adoption of PQC as well as the secure encryption measures — 'Harvest Now, Secure Later' is one of the most prominent reasons for this."
What Current Frameworks Lack for PQC
Despite growing awareness, most existing security frameworks were never designed for the quantum era. There are four critical gaps that leave organisations exposed:
1. Dependence on Quantum-Vulnerable Systems. Most existing systems rely on ECC and RSA, which are highly vulnerable to quantum computers — these solve their underlying mathematical problems with ease using Shor's algorithm. Security is based on problems that quantum computers can solve within a short timespan, making legacy encryption fundamentally unsafe once Q-Day arrives.
2. No Protection Against "Harvest Now, Decrypt Later". Current frameworks protect data against present-day threats — they are not built to withstand future quantum attacks. Cybercriminals can extract data today, store it for years, and decrypt it later. This gap is potentially lethal for sectors holding long-lived sensitive data.
3. Inflexible Systems. Many organisations have cryptography deeply embedded in VPNs, IoT devices, and Hardware Security Modules (HSMs). This makes it extremely difficult to introduce a new cryptographic system into existing infrastructure. Most infrastructures were simply not designed for easy cryptographic replacement or upgrade.
4. Cryptographic Agility Being Absent. Cryptographic agility means the ability to swap algorithms quickly when threats evolve. Most enterprises cannot easily migrate from RSA/ECC to PQC. Security frameworks remain rigid and slow to adapt — leading to a risky handover period where neither old nor new systems are properly secured.
What Has NIST Done to Overcome This Threat?
NIST has already made significant efforts to develop encryption standards that can be immediately deployed within PQC-ready systems. In August 2024, NIST finalised its first three post-quantum cryptographic standards. It is also planning to evaluate and announce additional algorithms in the near future for further testing and analysis. These can be deployed without the risks associated with legacy cryptography — providing a path forward that organisations can begin adopting today.
NIST's guidance also defines eight Crypto Agility Best Practices to help organisations manage the transition: establishing People and Governance structures; adopting Modular Cryptographic Design so components can be swapped; building Training and Awareness programmes; supporting Multiple Algorithms and key lengths; conducting ongoing Risk Assessment and Management; implementing Automated Update Mechanisms; maintaining Comprehensive Inventory of all cryptographic assets; and ensuring Interoperability and Standardisation across systems.
Even though it will take approximately a decade for PQC to root deeply into all vulnerable sectors, this migration — if executed correctly — will prevent cybercriminals from taking over decrypted markets and leaving sectors in a compromised condition.
How Does QNNX Help?
As organisations prepare for the transition to post-quantum cryptography, solutions such as QNNX help simplify the process by enabling cryptographic asset discovery, risk assessment, and migration planning. Rather than replacing existing security infrastructure entirely, QNNX is designed to help organisations identify quantum-vulnerable systems and support a smooth transition toward quantum-resistant cryptographic standards — improving long-term cyber resilience and keeping data secure in the long run.
The biggest gap in current security frameworks is their reliance on RSA, ECC, and other public-key cryptographic systems whose security collapses in the presence of large-scale quantum computers. Platforms like QNNX exist to bridge that gap — enabling a controlled, measured migration rather than a reactive scramble after Q-Day.
"To overcome this, companies such as QNNX play a major role in the smoother migration process — helping build a safer tomorrow, securely."
QNNX Research Team
Expert in post-quantum cryptography and secure communications infrastructure at QNNX.
