Defence-Driven Deadline: Why PQC Can’t Wait Any Longer

Quick answer: Post-quantum cryptography migration can’t wait because adversaries are already using harvest-now-decrypt-later attacks, capturing encrypted data today to decrypt once quantum computers are capable enough. Defence organizations are leading the transition because they understand this risk best, guided by NSA requirements and NIST’s finalized ML-KEM and ML-DSA standards. The recommended action is to start with a cryptographic discovery audit now, since migration windows are years long and compress further the longer organizations wait.

Key Takeaways

• Harvest-now-decrypt-later attacks mean quantum risk is active today, not a future concern; adversaries are already collecting encrypted data to decrypt later.
• Defence organizations are leading PQC adoption, guided by NSA guidance, National Security Memorandum 10, and joint CISA/NIST/NSA advisories.
• NIST finalized ML-KEM and ML-DSA in August 2024; migrations should build around these standards rather than proprietary alternatives.
• Delaying migration compounds risk: expanding HNDL exposure, regulatory non-compliance, growing PKI debt, and shrinking migration windows.
• A four-step framework, discovery, prioritization by data sensitivity, crypto-agility, and NIST alignment, applies to any sector, not just defence.

When people hear about Post-Quantum Cryptography (PQC), many assume it is a problem for the distant future. It is not. The threat is real, it is active, and it is already affecting the data your organization is protecting right now. The defence sector has recognized this and started acting. It is time for everyone else to do the same.

The Quantum Threat Is No Longer a Future Problem

Quantum computing is real and advancing quickly. Governments and large technology companies are spending enormous amounts of money building quantum machines. These machines, once mature, will be able to break the encryption that protects almost every digital communication today. Algorithms like RSA, ECC, and Diffie-Hellman will no longer be safe once a cryptographically relevant quantum computer (CRQC) arrives.

Most experts believe a CRQC could exist within the next ten years. Some think it could come sooner. But the more urgent issue is that adversaries do not need to wait for that machine to cause damage today.

This is where the Harvest Now, Decrypt Later (HNDL) strategy comes in. Nation-state adversaries are already capturing encrypted data today and storing it. When they eventually have a quantum computer powerful enough, they will decrypt everything they have collected. Your sensitive communications, financial records, and personal data could already be sitting in a foreign database waiting to be unlocked.

Why Defence Organizations Are Leading the PQC Transition

Defence sector cybersecurity teams are not overreacting. They understand the threat better than most. Defence organizations deal with highly sensitive data, face sophisticated adversaries, and know that a cryptographic failure could affect national security, not just a company’s reputation or finances.

The U.S. National Security Agency has issued guidance requiring post-quantum cryptography readiness across national security systems. The White House’s National Security Memorandum 10 identified quantum computing as a top-priority risk and directed federal agencies to begin reviewing their cryptographic assets. CISA, NIST, and the NSA have all published joint advisories urging critical infrastructure sectors to start preparing now.

The HNDL strategy is not theoretical in the defence world. It is a documented and active approach used by nation-state intelligence services. The lesson for other sectors is simple: if the organizations with the most to lose are already moving, so should you.

The Cost of Waiting: Risks of Delayed Migration

Delaying your post-quantum migration creates real risks. Here is what those risks look like:

• Expanding Attack Surface from HNDL: Every day you use quantum-vulnerable encryption, you give adversaries more data to collect and store. You cannot go back and protect data that has already been captured.
• Regulatory Non-Compliance: NIST finalized its first PQC standards in 2024, including ML-KEM and ML-DSA. Federal agencies face compliance deadlines. Defence contractors under CMMC or FedRAMP will see stricter quantum-readiness requirements. Starting late means rushing to comply later.
• Public Key Infrastructure (PKI) Debt: PKI is built into certificates, identity systems, and secure communications throughout your organization. The longer you wait, the harder and more expensive it becomes to update.
• Compressed Migration Windows: Post-quantum migration takes years for most large organizations. It involves finding all cryptographic assets, replacing algorithms, testing systems, and coordinating across supply chains. Organizations that start late end up spending more and accepting greater risk.

Preparing for a Post-Quantum Future

Good preparation starts with knowing what you are protecting and where your cryptographic systems are. Here is a straightforward framework to follow.

Step 1: Cryptographic Inventory and Discovery

You cannot replace what you cannot find. Start by mapping all the cryptographic assets across your systems, including certificates, encryption libraries, TLS configurations, key management tools, and third-party integrations. This step usually takes longer than expected, which is exactly why starting early matters.

Step 2: Prioritize by Data Sensitivity

Not all data carries the same risk. Focus first on systems that handle information that needs to stay private for many years, such as classified records, financial data, and health information.

Step 3: Build for Cryptographic Agility

Cryptographic agility means designing your systems so that encryption algorithms can be swapped out without rebuilding everything from scratch. This is a smart approach for any organization, not just for the quantum transition.

Step 4: Align with NIST PQC Standards

NIST has published the first formal quantum-resistant encryption standards. Use these, specifically ML-KEM for key exchange and ML-DSA for digital signatures. Do not build your migration around proprietary solutions. Stick with the NIST PQC Standards and watch for further updates.

How Organizations Beyond Defence Should Respond

The Quantum Computing Threat is not limited to defence. Financial services, healthcare, energy, and telecommunications all face the same risks. Any organization that handles sensitive data with a long shelf life needs to take this seriously.

Private sector organizations face an added challenge: unlike defence contractors, they often have no mandatory compliance deadline pushing them to act. But the risk is just as real. A financial institution holding years of client data is just as attractive a target as a government communication.

Supply chain exposure is another factor. If you are a vendor to a government agency or defense contractor, you will eventually face quantum-readiness requirements passed down through the supply chain. Getting ahead of that now puts you in a much stronger position.

How Encryption Consulting Can Help

Most organizations know they need to prepare for the quantum threat. The harder part is knowing where to start, how to prioritize, and how to build a migration plan that holds up to regulatory scrutiny. Encryption Consulting’s PQC Advisory Services are designed to answer exactly those questions.

Through cryptographic discovery, targeted risk mitigation, and NIST-aligned planning, our team helps you build a quantum-resilient, audit-ready infrastructure without having to figure it all out internally.

Here is what the engagement covers:

Cryptographic Discovery and Inventory: We map all cryptographic assets across your environment, including certificates, encryption libraries, TLS configurations, key management systems, and third-party integrations. This is the foundation of any post-quantum migration and the step most organizations underestimate.

Risk Assessment and Prioritization: Not all systems carry the same exposure. We assess your environment based on data sensitivity and shelf life, helping you focus first on the areas where the Harvest Now, Decrypt Later threat is most relevant.

NIST-Aligned Migration Roadmap: We build a structured migration plan aligned to the NIST PQC Standards, including ML-KEM and ML-DSA, with clear milestones and sequencing that fits your organization’s timeline and compliance obligations.

Hybrid Cryptography Implementation: During the transition period, we help you implement hybrid cryptographic approaches that maintain compatibility with existing systems while introducing quantum-resistant algorithms in parallel.

Cryptographic Agility Enablement: We design your systems so that algorithms can be updated without rebuilding everything from scratch, giving you flexibility as the post-quantum landscape continues to evolve.

The window for unhurried preparation is closing. Starting now means you get to plan. Starting later means you get to scramble.

Conclusion

For years, post-quantum cryptography was mostly talked about. That has changed. NIST has published its standards. Federal agencies have deadlines. The NSA has issued migration guidance. The time for awareness is over. The time for action is now.

Moving to the action phase means getting leadership buy-in, assigning clear ownership of your Post-Quantum Migration program, setting a budget, and bringing in the right expertise. Most organizations do not have deep internal knowledge of quantum-resistant encryption or post-quantum PKI architecture. Acknowledging that gap is the first step toward closing it.

Partnering with specialists who have already worked through defence-sector PQC requirements gives you a faster, clearer path forward. Experience with NSA CNSA 2.0 requirements and DoD cryptographic migration translates directly into practical guidance for any sector.

Frequently Asked Questions

Why can’t PQC migration wait until quantum computers actually exist?

Because of harvest-now-decrypt-later attacks. Nation-state adversaries are already capturing and storing encrypted data today, intending to decrypt it once a cryptographically relevant quantum computer becomes available. Data encrypted today with vulnerable algorithms is already exposed, regardless of when that machine arrives.

Why are defence organizations leading PQC adoption?

Defence organizations handle highly sensitive, long-shelf-life data and face sophisticated nation-state adversaries who actively use harvest-now-decrypt-later as a documented strategy. They are also guided by binding requirements: NSA guidance, National Security Memorandum 10, and joint CISA/NIST/NSA advisories.

What are the risks of delaying post-quantum migration?

Four compounding risks: an expanding attack surface as more data gets harvested under vulnerable encryption, regulatory non-compliance as deadlines under CMMC and FedRAMP tighten, growing PKI debt as more certificates and identity systems need updating, and a shrinking migration window since large-scale migrations take years to execute.

What is the first step in a PQC migration?

Cryptographic inventory and discovery. Organizations need to map every certificate, encryption library, TLS configuration, key management tool, and third-party integration before they can prioritize or replace anything. This step consistently takes longer than expected.

Which NIST standards should a PQC migration be built around?

ML-KEM for key exchange and ML-DSA for digital signatures, both finalized by NIST in August 2024. Organizations should build migrations around these standardized algorithms rather than proprietary alternatives.

Does this apply to organizations outside defence and government?

Yes. Financial services, healthcare, energy, and telecommunications organizations hold data just as attractive to harvest-now-decrypt-later attacks. Private sector organizations often lack a mandatory compliance deadline, but the underlying risk is identical, and vendors to government agencies will eventually face quantum-readiness requirements passed down through the supply chain.