Doug Merritt

Ari Krakauer

Janani Rajendiran

Alex Weiss

Nick Davitashvili

Aviatrix 

Tim McConnaughy

Abdul Rahim

Willie Tejada

Varsha Vig

Tom Davis

Taylor LeGrande

Tabraiz Feham

Susan Hinrichs

Sam Pandey

Sachin Saurabh

Robert Panzer

Madhuri Kaniganti

Libby Botsford

Ken Horner

Kathryn Burkhardt

Karthik Balachandran

John Qian

Joe (Giuseppe) Amendolara

Jason Haworth

Jason Earnest

Irwan Prabowo

Harshvardhan Verma

George Lam

Eric Channing Brown

Deepak Mangipudi

David Pektas

Dariusz Terefenko

Chris McHenry

Bryan McAninch

Bryan Ashley

Brighton Vino Jegarajan

Benson George

Anirban Sengupta

Anh Profiti

Alicia Pollard

Akarsh Lavania

Matt Snyder

Ian Smith

Scott Leatherman

Cristian Critelli

Alex Escalona

Jessica MacGregor

Faizan Mustafa

Rodman Stuhlmuller

Rizwan Jamal

Nathan Pearce

Brad Gouzie

Rajesh Kumar Easwaramoorthy

David Hawk

Dan Sheldon

Gino Mommers

Frey Khademi

Ron Reed

Josh Cridlebaugh

Katie Holms

Abhishek Bhat

Bryan Woodworth

Lauren Tsukamoto

Nadim 

Trent Waskey

Nafis Nibraz

Deepesh Govindan

Matthew McSpadden

Tej Poudel

Karen Mason

Davina Kim

Bushra Alam

Scott Hamilton

CISA, NSA, and NIST have described it as an active threat in binding operational guidance since at least 2022. NSA CNSA 2.0 (2022) and NSM-10 (May 4, 2022) directed migration timelines based on the judgment that collection of valuable encrypted traffic was a present concern. Public attribution of specific HNDL campaigns is limited by classification and disclosure constraints, but the US signals intelligence community treating it as present-tense in policy documents that bind federal agencies is a substantive data point. 

How do we know Harvest Now, Decrypt Later collection is actually happening? 

You cannot know with precision. What you can map is what your organization transmitted under vulnerable cryptography and which of that data carries long-term value. Priority categories: authentication credentials and API keys, private keys that were ever transmitted or provisioned over the network, sensitive business communications, operational and architectural data, and long-lived records (financial, personnel, strategic). That inventory, scoped to the worst-case, is your planning input. 

What exactly is in an adversary’s archive from our network? 

Does Q-Day constitute a notifiable event under GDPR, HIPAA, or state law? This is legally unresolved for most organizations. Collection at one point and readability at a later point does not map cleanly onto notification frameworks designed for direct intrusions. Engage legal and compliance counsel now to establish your position. The time to reason through notification obligations is before the 72-hour clock starts. 

Does Q-Day constitute a notifiable event under GDPR, HIPAA, or state law?

Crypto agility, as discussed in the companion article, is the ability to replace cryptographic algorithms quickly as standards and findings evolve. Quantum agility extends that to the full lifecycle: migration before Q-Day, rapid credential and key rotation in response to the decrypt event, and adaptation to the targeted attacks that follow when adversaries weaponize what they have decrypted. The organizational infrastructure for both is largely the same. 

What is quantum agility and how is it different from crypto agility? 

Start with the combination of data lifetime and migration lead time for the forward track, and with credential rotation for the historical track: they are independent and can run in parallel. Systems generating data that must remain confidential for a decade or more deserve the earliest migration placement. Credentials and keys that were transmitted under vulnerable cryptography should be rotated regardless of migration status. Q-Day response planning and legal preparation can begin immediately; neither requires migration to be complete first. 

How do I prioritize if my organization cannot do everything at once?

Q-Day Reckoning

Q-Day, when quantum computers can break today’s encryption, is coming, but threat actors are harvesting data now. Learn how to respond with quantum agility.

The Two-Track Readiness Plan for Q-Day

Q-Day Reckoning: What to Do When the Archive Opens

Futuriom Report: Implementing Crypto Agility for Post-Quantum Cryptography

A recent Futuriom report by Scott Raynovich explains why enterprises need crypto agility to build a resilient infrastructure to stop Harvest Now, Decrypt Later. 

Futuriom Report Advises Building Crypto Agility for Q-Day

The Other Shift Nobody’s Watching Harvest Now, Decrypt Later

Quantum computers will break current encryption. Learn how Aviatrix Harvest and Decrypt Protection provides post-quantum cryptography and containment.

Aviatrix Harvest and Decrypt Protection

The Other Shift Nobody’s Watching: Harvest Now, Decrypt Later

Crypto agility is the ability to adapt cryptographic protection while preserving security and operations. Adopting post-quantum cryptography is a migration that should build this continuing capability across infrastructure, applications, and identity systems. NIST’s crypto-agility guidance already includes that operational scope. 

What is crypto agility, and how does it relate to PQC? 

Because discovery, vendor upgrades, and migration testing take time, while sensitive data may need protection for many years. Starting the work described in [NIST’s migration program](https://www.nccoe.nist.gov/applied-cryptography/migration-to-pqc) now reduces what remains when a new finding or requirement makes a change urgent. 

Why prepare before quantum computers can break current encryption? 

No. Rainbow, SIKE, and HAWK were candidates, not the [finalized standards](https://www.nist.gov/news-events/news/2024/08/nist-releases-first-3-finalized-post-quantum-encryption-standards). Their history supports adopting PQC with a plan for future changes. 

Did the candidate attacks break NIST’s finalized PQC standards? 

Neither is a universal private-sector deadline. [OMB’s June 2026 memo](https://www.whitehouse.gov/wp-content/uploads/2026/06/M-26-15-Execution-of-the-Migration-to-Post-Quantum-Cryptography.pdf) establishes a 2030 risk-reduction objective for covered agency systems, while NIST’s earlier draft described a transition through 2035. Set priorities using applicable requirements, data confidentiality lifetimes, and migration lead times; neither year predicts when capable quantum hardware will arrive. 

Is 2030 or 2035 the deadline for our organization? 

Managed encryption can coordinate changes for traffic within its coverage, but applications, certificates, signing, hardware, and stored data have additional requirements. The program needs evidence across those layers and accountable service owners. Measure both the protection delivered and the ability to execute another supported transition. 

Can network encryption complete the entire migration?

Post-Quantum Cryptography is Here: We Need to Adapt

NIST has set post-quantum cryptography standards, but even those standards can change. Learn how crypto agility provides continuous, lasting protection. 

5 Steps to Building Crypto Agility