Harvest Now, Decrypt Later: What Your Clients’ Data Is Worth in 2030

Last week a Midwest MSSP owner wrote: “I get the threat. I just don’t know how to make it feel real to a client who thinks quantum is still sci-fi.” Not surprising. ‘Too soon’ is another one I heard from a Canadian MSP…Let’s fix it.

What HNDL Actually Means

Sophisticated threat actors are intercepting and storing your clients’ encrypted data right now. Not decrypting – storing. Storage is cheap, patience is real, and they already know a cryptographically relevant quantum computer is coming. CISA and NSA both treat Harvest Now, Decrypt Later as an active threat posture. The attack surface isn’t the firewall. It’s every VPN tunnel, email, API call, and file transfer that moved over RSA or ECC in the last several years, sitting in an archive, waiting for Q-Day.

Which Clients Are Actually Exposed

The test question is one sentence: Does this data need to remain confidential in 2032?

Tier 1 – Talk to them this month: Healthcare (HIPAA, 10+ year retention), legal (privilege, M&A), financial services, government contractors, critical infrastructure.

Tier 2 – Plant the seed this quarter: SaaS with long retention customer data, manufacturers with proprietary IP, research institutions, anyone under GDPR or state privacy law.

Tier 3 – Do the inventory, low urgency: Professional services and retail SMBs with 2 – 3 year confidentiality windows.

The Math That Makes It Real

A cryptographically relevant quantum computer is 8 – 15 years out. Enterprise PQC migration takes 5 – 7 years minimum. Cryptographic inventory alone runs months at a mid-size org, then you’re testing hybrids, qualifying vendors, updating policies, and cycling renewal windows.

If Q-Day is 10 years out and migration takes 7, you start in the next 3 years to be on time. If Q-Day is 8 years out, you needed to start last year. With the support of AI, Q-Day is speeding closer all the time. AI has blown up projections from 2 -3 years ago and continuing to gain momentum.

That’s not fear mongering. That’s a Gantt chart.

What to tell your clients today

Some of your data needs to stay confidential for 10 years or longer. The encryption protecting it today won’t hold when quantum computers arrive. Adversaries are already harvesting that traffic now, storing it for the day they can decrypt it. The fix isn’t urgent in the sense of “drop everything,” but the planning is. We want to get ahead while the timeline is still manageable.

Where to Start Monday

  1. Pull your Tier 1 client list.
  2. Pick two with the longest data retention obligations.
  3. Send them this post or one paragraph of it. Ask: “Have you thought about this?”
  4. Whatever they say next is the start of a billable engagement.

Next week: what a cryptographic inventory actually looks like – the deliverable, the scope, and what you charge for it.

Stay sharp.

The Quantum Guy

The information in this post is provided for general informational purposes only and does not constitute professional, legal, technical, or security advice. Readers act on this content at their own discretion and risk; IoTSSA assumes no liability for any loss or damage arising from its use.