Harvest now, decrypt later: what the quantum threat means for Southwest Florida businesses

What is harvest now, decrypt later?

Harvest now, decrypt later is an attack in which an adversary steals encrypted data today, stores it, and waits for a future quantum computer capable of breaking the encryption. The data does not need to be readable now. It only needs to still be sensitive when the decryption capability arrives.

This reframes a hard truth for any Southwest Florida business holding long-lived records. The confidentiality of data you encrypt in 2026 depends not only on today's cryptography but on how long that data must stay secret and when a quantum computer that can break RSA or elliptic-curve encryption actually arrives.

The threat is not science fiction and it is not only a government problem. Any organization whose data has a long secrecy shelf life is exposed, because the harvesting can happen years before the decryption. Learn how a verifiable AI and quantum security program maps this risk for your specific data.

Why does NIST post-quantum cryptography matter right now?

NIST post-quantum cryptography matters now because the defensive standards are finalized and deployable, while the offensive capability is still emerging. On August 13, 2024, NIST published its first three post-quantum standards. Waiting for a quantum computer to appear before you migrate means your already-harvested data is decrypted before you act.

The three standards cover the two functions quantum computers threaten. FIPS 203 specifies ML-KEM, a module-lattice key-encapsulation mechanism for secure key exchange that replaces RSA and ECDH. FIPS 204 specifies ML-DSA, a lattice-based digital signature scheme. FIPS 205 specifies SLH-DSA, a stateless hash-based signature scheme whose security rests only on hash functions.

• FIPS 203 (ML-KEM): quantum-resistant key exchange, based on CRYSTALS-Kyber, to replace RSA and elliptic-curve key agreement.
• FIPS 204 (ML-DSA): the primary digital signature standard, based on CRYSTALS-Dilithium, for authentication and integrity.
• FIPS 205 (SLH-DSA): a hash-based signature backup, based on SPHINCS+, that relies on different math for defense in depth.

The defensive standards are finished. The offensive capability is still coming. That gap is the window to act in.

These are not drafts or proposals. They are the algorithms federal systems and major vendors are already deploying. Our post-quantum migration approach is built on these finalized standards rather than experimental ciphers.

How soon could quantum computers break today's encryption?

No one can name the exact year a cryptographically relevant quantum computer arrives, and honest analysis avoids a fixed date. But you do not need a date to make a decision. The relevant question is whether your data will still be sensitive when that machine exists, and government timelines already assume it is close enough to plan around.

The NSA cited harvest now, decrypt later as a primary driver of urgency behind CNSA 2.0. If the US government treats 2030 to 2033 as its migration deadline, a private firm holding records that must stay confidential into the 2040s cannot reasonably assume it has more slack than the agencies do.

The practical test is Mosca's inequality, defined by cryptographer Michele Mosca in 2015. Add X, the number of years your data must stay secret, to Y, the years your migration will take. If X plus Y is greater than Z, the years until a quantum computer can break today's encryption, you are already exposed and should be migrating now.

Which Southwest Florida businesses are most exposed?

The businesses most exposed are those whose data must stay confidential for years or decades. In Naples and Southwest Florida that means legal, medical, financial, and title firms. Their records combine high sensitivity with long mandated retention, which is exactly the profile harvest-now-decrypt-later attackers target.

Consider a title company or real estate closing firm along the Gulf coast. A 30-year mortgage file encrypted today with RSA-2048 stays sensitive for three decades. If a capable quantum computer arrives even around 2030, a file harvested this year still has more than two decades of exposed confidentiality left.

• Law firms: privileged client files, litigation records, and estate documents that must stay confidential for years or permanently.
• Medical and dental practices: protected health information with multi-year Florida retention requirements and lifelong patient sensitivity.
• Financial advisors, wealth managers and banks: account records, tax data, and long-term financial plans.
• Title, escrow and real estate closing firms: identity documents, wire instructions, and multi-decade mortgage files.

If your firm handles any of these categories, harvest now, decrypt later is a risk on your books today, not a future one. Our enterprise security program is designed around exactly these long-retention data profiles.

What should a business do about long-shelf-life data now?

The first step is not to rip out your cryptography. It is to build a cryptographic inventory: know where your most sensitive, longest-lived data lives, how it is encrypted, and how long it must stay secret. CISA, NSA, and NIST identify this inventory as the foundation of any credible quantum-readiness roadmap.

The reassuring news is that the transport layer is already moving. Cloudflare has deployed a hybrid key agreement combining ML-KEM with classical X25519, so protection does not depend on a single unproven algorithm. As of mid-September 2025, a large share of human web traffic to Cloudflare was already using post-quantum key agreement.

A sound plan combines that edge protection with a data-level roadmap: identify your long-lived crown jewels, apply post-quantum or hybrid encryption where the shelf life demands it, and keep a verifiable record of what was protected and when. See how we run this at the Cloudflare edge and pair it with AI governance so both your data and your AI systems are covered. When you are ready to map your exposure, contact our Naples team.