September 5, 2026

·Quantum TLS

95% of Enterprises Have No Post-Quantum Migration Plan — And Attackers Are Already Harvesting Your Data

The Invisible Heist: Harvesting at Scale

Harvest Now, Decrypt Later (HNDL) isn't a hypothetical threat model drafted in a university lab — it is the standard operating procedure for well-resourced Advanced Persistent Threats (APTs). The mechanics are simple, brutal, and entirely passive: adversaries tap into backbone infrastructure, intercepting encrypted traffic and data exfiltrations secured under legacy RSA, ECDSA, or Diffie-Hellman algorithms. They dump this ciphertext into massive storage arrays and sit on it.

Once a quantum computer capable of running Shor's algorithm at sufficient scale emerges — a threshold the industry calls Q-Day — every byte of that harvested data gets decrypted retroactively. Data with a shelf life longer than the time-to-Q-Day (electronic health records, state secrets, intellectual property, long-lived infrastructure credentials) is effectively exposed the instant it crosses the wire today, no matter how robust the TLS 1.2 or 1.3 encryption looks right now.

The 95% Reality: Inertia vs. Standards

That is what makes the new report's headline number so alarming. 95% of organizations surveyed possess zero formal roadmap to migrate toward NIST's standardized PQC algorithms. We are no longer waiting on the math. The cryptographic primitives — ML-KEM (FIPS 203) for key encapsulation, and ML-DSA (FIPS 204) alongside SLH-DSA (FIPS 205) for digital signatures — are finalized, published, and actively being integrated into major libraries like OpenSSL and BoringSSL.

The algorithms are not the bottleneck. Cryptographic debt is.

Enterprise networks are littered with hardcoded keys, legacy appliances that cannot receive firmware updates, and proprietary software that fundamentally assumes a public key will always be 2048 bits long. When you swap an RSA key for an ML-KEM key, the payload size balloons. If your network appliances, load balancers, or custom applications lack crypto-agility, the transition will break your infrastructure before the quantum computers do.

Mosca's Inequality: The Math of Your Demise

In quantum cryptography, the urgency of migration is defined by Mosca’s Theorem: X + Y > Z.

• X is the time your data must remain secure (e.g., 10 years for financial records).
• Y is the time it will take to completely migrate your IT infrastructure to quantum-safe standards.
• Z is the time remaining until Q-Day.

If X plus Y is greater than Z, your cryptography has already failed. Security leaders widely estimate that enterprise-scale PQC migration (Y) will take anywhere from 5 to 7 years. If your data needs to stay confidential for a decade, and you are part of the 95% that hasn't started, the harvesting has almost certainly already begun against you.

The Compliance Hammer Falls

Regulators are done waiting for voluntary action. The NSA's Commercial National Security Algorithm Suite 2.0 (CNSA 2.0) has already mandated hard deadlines, requiring software and firmware signing to transition to quantum-resistant algorithms by 2025, and web browsers/servers by 2030. Equivalent bodies across the EU (ENISA) and Asia-Pacific are drafting similar compliance frameworks.

Being in the 95% isn't just a security gap anymore; it is rapidly becoming a board-level liability with a ticking clock attached.

How to Escape the 95%

The move forward is methodical, not panicked. The transition begins with discovery. You cannot protect what you cannot see. Organizations must initiate a comprehensive cryptographic inventory today — tracking every instance of RSA, ECDSA, and Diffie-Hellman in their stack. Following discovery, the industry standard is to adopt a hybrid classical-PQC deployment strategy (such as combining X25519 with ML-KEM) to ensure compliance and avoid catastrophic outages during the transition phase.

The post-quantum era has already started for the attackers. It is time it started for your infrastructure.