Store-now-decrypt-later attacks raise an uncomfortable question for security leaders: what do we owe the future when attackers may already have the data and are simply waiting for the keys to history?
We do not know the full scope of encrypted data that has already been harvested. We may never know. Still, the conclusion is hard to avoid: when it comes to sensitive data, any is too much.
It is worth sitting with what “stolen” actually means in this context. The data may already be gone...not hypothetically at risk... gone. It may have left the building, left the airspace, left the country, and now be sitting hostage outside the organizations, agencies, vendors, and systems that were trusted to protect it.
If enough of that data is eventually decrypted, the result may not look like an isolated breach. It may look more like a global WikiLeaks-level exposure event, where private communications, credentials, intellectual property, government information, personal records, health data, financial data, and years of institutional memory become readable all at once or in waves.
Buckle Up
While your pulse may be rising, there is a sick sort of comfort in that possibility. If everyone’s data is exposed together, that feels less personal. Less personally embarrassing and perhaps less personal in identifying who passed the buck that enabled this global pantsing situation.
In times like this we turn to the bard... Tom Lehrer and his masterpiece “We’ll All Go Together When We Go.” For anyone who has not had the pleasure, it is a darkly funny Cold War-era song about collective doom. Part of the joke is that if the worst happens to everyone, at least no one is left behind to deal with the mess.
There is something very human in that kind of humor: a little bleak, a little clever, and maybe a little too comforting if we are not careful. Alas, tis a trap! Shared exposure may make the failure feel less individual, but it does not make the damage less real. In fact, it can make the consequences harder to contain, harder to attribute, and harder to recover from.
Real people still get hurt. Real organizations still lose trust. Real security teams still have to respond. The fact that everyone else may be standing in the same wreckage does not make the wreckage any less real. This is where quantum risk becomes especially uncomfortable.
It can feel far away, abstract, and easy to defer. It can feel like one more thing on an already impossible list. To be honest, it can also be tempting to think: I’ll be retired by then. That will be the next person’s problem.
However, store-now-decrypt-later breaks that logic. The attack may already be happening. The exposure is very likely to already exist. The only thing that has not happened yet is the reveal. Those who see preparing for quantum risk as an exercise in predicting when a cryptographically relevant quantum computer will arrive are missing the point.
Recognize that adversaries do not need one today to create a future problem, they need only to collect the data now and wait.
The Harsh Realities
Of course, none of this exists in a vacuum. It is easy to write a thoughtful article about why quantum readiness matters. It is much harder to be the person sitting inside the security organization, looking at the current threat landscape, the budget, the team capacity, the board expectations, and the list of fires that already needed attention yesterday.
CISOs and security leaders do not need another outsider pretending the job is easy. The volume of what security teams are being asked to manage right now is very real. AI alone is enough to make anyone’s head spin. Security teams are being asked to protect the organization from AI, enable the organization to use AI, explain AI risk to the board, write policies for AI, monitor employees using AI, and keep up with all the AI requests... using AI.
At the same time, while AI is certainly having its continued moment in the spotlight, seven encores in... it is not the only threat in the landscape. It has been added on top of ransomware, third-party risk, identity attacks, compliance requirements, cloud complexity, budget pressure, talent constraints, and the daily joy of being told security should move faster without slowing anyone down.
So yes, quantum can sound like “one more thing.” Still, someone has to be willing to say: this is a good thing to do now.
Even if it is not the loudest alarm, the easiest board slide, or the priority that will make everyone feel better by Friday, the burden of inaction does not disappear just because it can be passed forward. That is why the answer cannot be to wait for quantum risk to feel urgent enough. By then, the organization may already be reacting to choices it made years earlier.
The better move is to start doing the practical work of readiness while there is still room to shape the outcome.
The good news is that doing the hard thing does not have to be quite so hard. Readiness does not mean ripping and replacing everything tomorrow, and no one needs to drop everything to enroll in quantum physics. It starts by moving crypto-agility from a concept to an operating capability: start where you are, build visibility as you go, and reduce risk in practical steps.
The real call is ownership. Who is responsible for understanding where cryptography lives today? Who is responsible for making sure it can be secured tomorrow?
Put the question on the roadmap, note it in the risk register, and bring it to the board before the board is asking from a place of fear. Give the next security team something better than a shrug and a forwarding address.
Doing the quantum thing may feel like the hard thing, but it is also the good thing: practical, responsible, and protective before the reveal. After all, when the reveal comes, “we all went together” will not be much of a defense. Someone will inherit the choices being made right now.
The question is whether they inherit a plan, or a mess.
