The Quantum Threat Timeline
The debate isn't whether quantum computers will break current cryptography — it's when. Conservative estimates say 10–15 years. Optimistic quantum researchers say 5–7. But the real threat is already here: harvest-now-decrypt-later.
State-sponsored actors are capturing and storing encrypted traffic today, waiting for quantum computers to decrypt it tomorrow. If your VPN traffic, TLS sessions, or encrypted backups contain data that's still sensitive in 10 years, you're already exposed.
A Practical Migration Roadmap
NIST finalized its post-quantum standards in 2024: ML-KEM for key encapsulation and ML-DSA for digital signatures. The standards exist. The implementations exist. The migration can start today.
Step 1: Cryptographic Inventory
You can't migrate what you can't find. 1-SEC's Quantum-Ready Crypto module scans your infrastructure for every cryptographic algorithm in use — TLS versions, cipher suites, certificate types, key sizes, hashing algorithms. The output is a complete inventory of your quantum-vulnerable cryptography.
Step 2: Prioritize by Risk
Not everything needs to migrate at once. Long-lived secrets (CA certificates, signing keys) are highest priority. Short-lived session keys for real-time communication are lower priority. Data at rest that must remain confidential for 10+ years is somewhere in between. The inventory tells you where to start.
Step 3: Hybrid Deployment
You don't have to go all-in on PQC immediately. Hybrid schemes combine a classical algorithm with a PQC algorithm so you're protected against quantum attacks without losing backward compatibility. 1-SEC's Rust engine supports ML-KEM and ML-DSA operations when compiled with the PQC feature flag.
Detecting Harvest-Now-Decrypt-Later
1-SEC's Quantum-Ready Crypto module watches for bulk encrypted traffic capture targeting quantum-vulnerable ciphers — the operational signature of harvest-now-decrypt-later campaigns. Unusually large data flows encrypted with RSA or classical ECDH that are being copied or mirrored to external infrastructure are flagged as potential HNDL activity.
This is the threat that makes PQC migration urgent rather than theoretical. The data being harvested today can't be un-harvested tomorrow.