There’s a quiet strategy unfolding right now.
No alarms.
No flashing red dashboards.
No breached-password notifications.
Just storage.
Somewhere, someone is collecting encrypted data. Sensitive emails. Legal documents. Financial records. Medical exchanges. Intellectual property. Trade secrets. Innovation roadmaps.
They can’t read it today.
But they’re saving it.
This strategy has a name: harvest now, decrypt later.
When we sat down on Impact Quantum with Adam Firestone, CEO and co-founder of SIX3RO, he didn’t frame the post-quantum threat as a science fiction scenario. He framed it as a systems problem and a timing problem.
And the clock is ticking.
The Illusion of “Secure”
For decades, the internet has relied on classical asymmetric cryptography. RSA. Elliptic curve. The invisible handshake behind that little lock icon in your browser.
We’ve trusted it because breaking it would take tens of thousands of years on classical computers. The math behind it relies on trapdoor functions that are easy to compute in one direction and astronomically difficult to reverse.
That assumption is about to be challenged.
Quantum computing, in simple terms, introduces massive parallelism. Imagine solving a maze not by trying one path at a time, but by exploring every possible path simultaneously. That’s the promise.
It’s also the problem.
A sufficiently powerful quantum computer can run algorithms like Shor’s algorithm efficiently, meaning that the same encryption schemes protecting nearly everything connected to the internet today could be broken in hours or days instead of millennia.
And here’s the critical part: no one needs to break it today.
They just need to save it.
Harvest Now. Decrypt Later.
Nation-states and sophisticated actors understand this timeline.
Storage is cheap. Bandwidth is cheap. Time is patient.
If you believe that cryptographically relevant quantum computers will arrive between 2028 and 2030, and that’s increasingly where serious forecasts are clustering, then collecting encrypted data now becomes a strategic investment.
Think about what that means.
Every encrypted file transfer.
Every secure email.
Every TLS session.
Every VPN exchange.
If it’s captured today and stored, it could be decrypted once quantum computing capabilities mature.
This isn’t theoretical paranoia. It’s strategic math.
And it forces a different question:
What data do you have that needs to remain confidential beyond 2030?
Because that’s the data that’s at risk today.
The Timeline No One Wants to Talk About
In our conversation, Adam compared what’s coming to Y2K, but on a larger scale.
Remember 1998 and 1999? Organizations couldn’t spend money fast enough to patch systems before the clock rolled over.
Now imagine 2027.
Imagine executives realizing that:
- Post-quantum algorithms exist.
- Standards are still maturing.
- Protocol upgrades move at “geologic time.”
- Vendors aren’t ready.
- And the transition will take years.
The scramble won’t be theoretical. It will be budgetary.
But here’s the uncomfortable truth: migrating cryptography across global infrastructure is not a switch you flip.
It’s layered:
- Algorithms
- Protocols
- Architecture
- Credential management
- Vendor integration
- Supply chain dependencies
And standards bodies don’t move fast. TLS 1.2 to TLS 1.3 took nearly a decade. We don’t have that luxury now.
The Misconception That’s Dangerous
One of the biggest misconceptions Adam sees is this:
“We have post-quantum algorithms now, so we’re fine.”
No.
Algorithms alone do not solve the quantum problem.
They must be implemented. Integrated. Adopted into standardized internet protocols. Deployed at scale. Supported by vendors. Embedded into enterprise workflows.
And most organizations don’t build bespoke cryptographic stacks. They rely on:
- Microsoft 365
- Cloud providers
- SaaS platforms
- Third-party integrations
Which means they’re waiting on vendors.
And vendors are waiting on standards.
And standards are being debated.
Meanwhile, data is being harvested.
Why This Isn’t Just a Security Story
This is about economic continuity.
Adam framed it this way: the world works because information moves securely across organizational boundaries.
Out to in.
In to out.
Patent disclosures. Financial reports. M&A discussions. Legal filings. R&D collaboration.
If the integrity of those exchanges erodes, the trust layer of the global economy erodes with it.
Post-quantum readiness isn’t a niche cybersecurity upgrade. It’s infrastructure resilience.
So What Should Leaders Do Now?
First: stop treating quantum as “future you’s problem.”
Second: conduct a cryptographic inventory.
- What data must remain confidential for 5+ years?
- 10+ years?
- 20+ years?
Third: push vendors. Ask the uncomfortable questions:
- What is your post-quantum roadmap?
- Are you implementing NIST standardized algorithms?
- What is your migration timeline?
- How are you handling crypto agility?
Fourth: assume that “secure today” does not equal “secure tomorrow.”
Because it doesn’t.
The Calm Before the Budget Storm
Adam made one prediction that stuck with me:
There will come a moment, likely 2027 to 2028, when organizations won’t be able to spend money fast enough on post-quantum solutions.
The companies that prepared early will be calm.
The companies that wait will be reactive.
In cybersecurity, a reactive approach is expensive.
Quantum isn’t just about faster computation. It’s about the reshaping of trust.
And your encrypted data?
It may look safe.
It may feel safe.
But somewhere, it could already be sitting in cold storage.
Waiting.
