Fortinet director urges early quantum-safe migration as 'harvest now, decrypt later' risk grows

Quantum computing promises advances in areas such as financial modelling and could help optimize energy and transport networks or streamline global supply chains, according to the article. It also poses a cybersecurity risk. The article says comparisons with AI are imperfect: AI is transforming how organizations operate, while quantum computing could fundamentally challenge the cryptographic foundations that protect sensitive data and digital communications.

Investment is increasing. The article notes that the United States is directing significant funding into quantum technology, and that the U.K. has committed up to £2 billion in quantum innovation and aims to become the first country to manufacture and deploy quantum computers at scale. That work could deliver benefits, but it also accelerates the need to prepare for cryptographic risk.

Most public-key cryptography used today, including RSA and elliptic curve cryptography, relies on mathematical problems that conventional computers would take a significant amount of time to solve. A sufficiently powerful quantum computer could solve them at an exponentially faster rate, potentially undermining encryption used to protect sensitive information. The article says there is no definitive date for when quantum computing will be able to break widely used encryption, a point often called “Q-Day,” but that the cybersecurity threat is already here.

The article describes threat actors using a strategy known as “harvest now, decrypt later,” collecting and storing encrypted information today with the intention of decrypting it once quantum computers reach sufficient capability. That puts sensitive, long-lived data at risk even if it is secure now, including government and critical infrastructure data, intellectual property and confidential business information.

The first step for organizations is to understand where they are exposed, the article says. In practice, that means identifying information that needs long-term protection and understanding the cryptography used to secure it. A cryptographic audit can bring these dependencies to light and help teams decide which systems and data need attention first.

The findings can guide a transition toward quantum-resistant security, with post-quantum cryptography playing a central role. The article points to the National Institute of Standards and Technology’s Post-Quantum Cryptography standards as a starting point for organizations planning to migrate existing environments. It also notes that quantum key distribution uses quantum mechanics to share encryption keys in a way that can reveal interception attempts, but requires specialized infrastructure and is therefore more suited to high-value uses than widespread deployment. The right approach depends on what an organization needs to protect, how long that information must remain confidential and the systems it relies on.

The article says organizations should begin the transition today by mapping exposure, testing alternatives and establishing migration priorities, giving themselves more time to manage the shift before their information becomes at risk.