Every executive I brief on post-quantum cryptography opens with the same question. How much time do we have?

Wrong question. The clock does not start when a working quantum computer boots up in some lab. For any data whose confidentiality has to outlive your migration, the clock started years ago.

This is what cryptographers call harvest now, decrypt later. It is the single most important idea for boards and CISOs to sit with over the next twelve months.

What is being stolen right now

Nation-state adversaries do not need to break RSA-2048 today to benefit from it tomorrow. They only need to store the ciphertext. Storage is cheap. Patience is cheaper.

The data that matters most is the data with the longest useful shelf life.

  • Medical records and genetic data. Sensitive for a lifetime. Increasingly for the lifetime of that person's descendants.
  • Trade secrets, source code, pre-release IP. Commercially valuable for a decade or more.
  • Long-term financial contracts, M&A files, legal privilege material. Discovery risk that outlives most CEOs.
  • Identity documents, biometric templates, PII. Effectively non-rotatable. You cannot reissue someone's fingerprints.
  • Signals intelligence and diplomatic traffic. The reason nation-state harvest programs exist in the first place.

The exposure window is not the moment quantum arrives. It is the whole span between when the ciphertext was created and when a large enough quantum computer exists. If that arrival is 2032 or 2035 or 2040, and reputable estimates now cluster in that band, then any data with a longer sensitivity horizon is already at risk. Every day you wait, more vulnerable ciphertext lands in someone else's archive.

NIST finalized the standards. That was the starting gun.

In August 2024, NIST published the first three finalized post-quantum standards.

  • ML-KEM (FIPS 203). Module-lattice key encapsulation. The drop-in replacement for RSA and elliptic-curve key exchange.
  • ML-DSA (FIPS 204). Module-lattice digital signatures. The primary replacement for RSA and ECDSA signing.
  • SLH-DSA (FIPS 205). Stateless hash-based signatures. A conservative backup built on well-understood hash security.

These are not drafts. They are federal standards. Every major cloud provider, TLS library, HSM vendor, and code-signing service is now shipping PQC or has committed to ship it. The debate about whether to migrate is over. The only real question is how fast you can execute.

The real problem isn't the math. It's the inventory.

Here is the uncomfortable truth I have watched settle over one boardroom after another. Most enterprises cannot answer the most basic question of PQC readiness. Where, exactly, are you using cryptography today?

Cryptography lives in TLS terminators. Code-signing pipelines. VPN tunnels. Database encryption. Storage-layer keys. Mobile app pinning. IoT device firmware. Third-party SaaS integrations. Backup archives. Certificates embedded in hardware you shipped five years ago. Thousands of API tokens and JWT signing keys. Some of it is centrally managed. Most of it is not.

You cannot migrate what you cannot see. That is why the first serious PQC deliverable in any organization is not a migration. It is a Cryptographic Bill of Materials. A CBOM. Loosely modeled on the SBOM movement that followed SolarWinds. A living inventory of every place your organization consumes or produces cryptographic material. What algorithm. What key length. What library. What expiration. What data classification.

Building a CBOM is neither exciting nor easy. It is the closest thing PQC has to a Y2K-style tractable engineering problem. It is what separates the organizations that will migrate in three years from the ones still discovering vulnerable systems in 2032.

Crypto-agility. What it actually means.

The other word every executive is now hearing is crypto-agility. It has become the kind of term that shows up in every deck and means whatever the presenter wants it to mean. Usually: "we should be able to swap algorithms someday."

That is not what crypto-agility means. It is a specific architectural discipline with concrete tests.

  • Can your application negotiate a new cipher suite without a code deploy?
  • Are your key identifiers and algorithm identifiers separated in stored ciphertext and signed artifacts, so you can rotate one without breaking the other?
  • Can your PKI issue certificates with hybrid classical + PQC signatures during the transition?
  • Does your code-signing verification path accept multiple algorithms? Can you deprecate one on a policy timeline instead of a code timeline?
  • Do you know which vendors give you configurability of the crypto layer, and which ones have it hardcoded?

If the answer to most of these is "no" or "we'd have to check," that is not a failure. It is a starting position. Almost nobody was designed for this. Crypto-agility is a decade-long architectural investment, not a checkbox.

Three things to do this quarter

If you are a CISO reading this on a Sunday night and you want to walk into Monday's leadership meeting with something concrete, here is what actually moves the needle.

1. Commission the CBOM. Even a partial one.

You do not need to inventory every system on day one. Start with the crown jewels. The data classifications with the longest confidentiality requirements and the systems that hold them. A CBOM covering your top ten crypto-consuming applications is infinitely more useful than a perfect CBOM you never start.

2. Get PQC on the vendor questionnaire. Today.

Every renewal. Every new procurement. Every third-party assessment. Add a PQC roadmap question and a crypto-agility question. This is the single highest-leverage action available to you, because vendor readiness is your longest lead-time dependency. If a critical vendor cannot articulate a PQC migration plan by 2027, you need to know that in 2026, not 2030.

3. Fund a hybrid pilot on one internal TLS path.

Pick one non-critical internal service. Terminate TLS with a hybrid classical + PQC cipher suite. Learn what breaks. Learn what your monitoring can and cannot see. Learn what your library upgrade path really looks like. The knowledge is the deliverable. Not the pilot.

The quantum era will not arrive with a press release. It will arrive quietly, in whichever lab reaches the threshold first. By the time it is public, the harvest problem will have already played out. The organizations that fare best will not be the ones who moved fastest at that moment. They will be the ones who started years earlier, when the deadline still felt distant and the discipline of getting ready was still optional.

It is not optional anymore. The deadline is today.

Lekshmy Sankar, PhD