Foresight · The Silent Data Breach

Executive summary

• Quantum risk is often treated as distant “tech to monitor”, but harvest‑now, decrypt‑later means the most important phase of the risk is already underway.
  

• New research has reduced the estimated quantum resources needed to break mainstream encryption, and major providers have brought forward their post‑quantum migration plans to the end of this decade.
  

• Policy and cyber‑security guidance now expect boards to treat quantum cryptography as a strategic and systemic risk, not just a technical issue.
  

Considered board‑level actions

• Treat quantum risk as a current confidentiality and governance problem, not a future technology question.
  

• Identify which data sets must remain confidential for three to ten years, and how they are protected today, including in third‑party and cloud environments.

1. From future crypto risk to present‑day data exposure

Quantum computing has mostly been parked in the “horizon technology” box for boards, revisited occasionally but not treated as active risk. That view is now misleading. Harvest‑now, decrypt‑later means adversaries can copy encrypted data today and wait until quantum computers can break current public‑key cryptography. Long‑lived financial records, contracts, IP, strategic plans and client archives are already being targeted because decryption in a few years would still be highly damaging. Once this data is collected, the exposure cannot be reversed.

Confidence assessment: High confidence that harvest‑now, decrypt‑later collection is occurring today by state and criminal actors, medium confidence on volumes per sector or firm.

Board implications this quarter

Ask which data would still matter if exposed three to ten years from now, and how that data is encrypted and stored.

2. Where the risk is moving: three shifts since early 2026

2.1 Algorithmic advances: Q‑Day moved closer

Recent algorithmic work has cut credible estimates of the quantum resources needed to break widely used cryptography. Planning assumptions have shifted from “well into the 2030s” towards pressure later this decade for high‑value targets. In response, major providers have accelerated their post‑quantum roadmaps and are aiming for full platform‑level protection by around 2029. A two‑to‑three‑year window to migrate critical systems now looks like sensible preparation, not alarmism.

Confidence assessment: High confidence that realistic timelines for breaking mainstream encryption have moved closer, medium confidence on exact dates, low confidence in “10+ years away” assumptions.

Board implications this quarter

Challenge any internal plan that still assumes a decade‑long runway before quantum disruption matters.

2.2 Regulatory convergence: from guidance to roadmaps

Regulators and national cyber agencies have moved post‑quantum cryptography from optional guidance to structured roadmaps, especially in the financial sector and critical infrastructure. These roadmaps start with executive awareness and cryptographic inventory, then move through planning, migration and validation. They also acknowledge that large organisations may need several years simply to discover where cryptography is used, both internally and across key vendors. Boards are being told explicitly that they own this transition.

Confidence assessment: High confidence that supervisors and cyber agencies now view post‑quantum cryptography as a systemic board‑level issue, medium confidence on timing and detail in each jurisdiction.

Board implications this quarter

Assume future scrutiny will cover third‑party and supply‑chain exposure, not just in‑house systems.

2.3 HNDL as a cross‑domain cascade, not just cyber

Security and policy analysis now describe harvest‑now, decrypt‑later as a cross‑domain risk. The same underlying threat can show up as a cyber incident, a financial shock, a regulatory problem, a reputational crisis or a strategic loss of advantage. That is why current guidance stresses cryptographic asset inventories, prioritisation of long‑lived data, crypto‑agility and coordinated engagement with vendors and regulators. Post‑quantum migration is no longer seen as a narrow CISO project.

Confidence assessment: High confidence that harvest‑now, decrypt‑later will create impacts across multiple risk domains, medium confidence on which channel will dominate for any given firm.

Board implications this quarter

Treat post‑quantum readiness as a cross‑functional resilience issue and bring risk, legal, finance and strategy into the discussion, not only cyber.

3. The cascade across your risk landscape

Many organisations still file quantum under technology or cyber. For harvest‑now, decrypt‑later, that is too narrow. Silent harvesting today sets up future operational and cyber disruption when vulnerable schemes fail. Loss of confidentiality can undermine valuations, long‑term contracts, models and market position even without a conventional “breach” narrative. Weak preparation will attract regulatory and legal scrutiny once sector expectations harden. Public misuse of decrypted historical data can quickly erode trust with clients, partners and regulators. For IP‑intensive sectors, decrypted R&D, design files and long‑term customer information can permanently weaken competitive advantage.

4. Why the next 6–18 months are the critical window

Technical advances are shortening the realistic timeline to act, while regulatory and market expectations are becoming more specific. Large organisations may need two to three years to map where cryptography is used and start migration of the most exposed systems and data sets. That means the next 6–18 months are the period in which boards can still choose to move proactively. Delay increases the likelihood of facing tighter mandates, market pressure and urgent remediation later this decade, with less room to sequence changes on your own terms.

5. Why this matters for business

Two points bring this into sharp focus. First, the active phase of the risk has already begun: data is being harvested now, and waiting for quantum decryption capability is waiting until the consequences surface, not until the risk starts. Second, many firms do not yet understand their dependence on vendors, cloud providers and software that use vulnerable cryptography. You can improve your own posture and still be exposed through suppliers that move slowly, especially in payments, cloud, communications and core business platforms.

6. Where the HORIZON Futures Engine adds value

Most organisations have technical teams tracking standards and vendor roadmaps, but the real challenge is understanding how quantum‑related triggers move across domains for a specific business over a 2–18 month horizon.

Cross‑domain cascade mapping

Linking harvest‑now, decrypt‑later and post‑quantum developments into existing Regulatory & Policy, Economic & Financial, Climate & Environmental, and Operational Resilience & Supply Chain risk frameworks so boards can see how shocks connect, rather than treating them as isolated cyber events.

Emerging‑issue clustering and early warning

Grouping weak signals from standards bodies, regulators, national cyber agencies and vendors into clear emerging issues, and tagging them to Watchlist and Early Warning Indicators with 2–6, 6–12 and 12–18 month horizons aligned to board cycles.

Alternative futures analysis

Building scenarios around faster and slower quantum progress and regulatory tightening, then stress‑testing current cryptographic, vendor and data‑governance strategies against each to guide sequencing of decisions and investment in resilience.

7. One signal to watch over the next 6 months

A major quantum‑algorithm or capability disclosure from a leading technology firm, national laboratory or standards body that clearly shortens credible timelines for breaking mainstream encryption and triggers visible adjustments in vendor roadmaps or supervisory messaging.