Post-quantum migration is often prioritized by application criticality alone. A new Europol report, Harvest now, decrypt later, adds a second clock: how long intercepted information would remain valuable. Published October 7 with University Carlos III of Madrid, the report assesses scenarios in which adversaries collect encrypted data now and attempt to decrypt it when more capable quantum computers become available.
Europol does not claim that criminals are systematically conducting this activity at scale today. It notes uncertainty around timing and the substantial storage, processing, and technical resources involved. That restraint is important. The operational lesson is not that every ciphertext faces the same imminent threat. It is that information with long confidentiality requirements can accumulate risk before a cryptographically relevant quantum computer exists.
Two timelines determine urgency
A conventional risk review asks how damaging a compromise would be today. Harvest-now-decrypt-later analysis also asks whether the data will still matter after the time needed to collect it, preserve it, and eventually attack its public-key protection.
Long-lived government communications, intellectual property, medical records, legal matters, identity data, and law-enforcement material may retain value for many years. Short-lived operational data may not. Labels such as “confidential” or “high impact” are too broad to express that difference.
Organizations should attach a required confidentiality horizon to important data classes and compare it with two uncertain but manageable estimates: the time needed to migrate the systems protecting the data and the plausible window in which the current cryptography could become breakable. Exact dates are not required to identify where those windows overlap dangerously.
The inventory must connect data to cryptography
A certificate list cannot answer a harvest-now-decrypt-later question by itself. Teams need to know which data crosses each protected channel, where encrypted copies are stored, which parties can observe the traffic, and which cryptographic mechanisms provide confidentiality.
Useful inventory relationships include:
- data class, owner, retention rule, and confidentiality horizon;
- applications, APIs, file-transfer paths, backups, and archives that handle it;
- protocol, negotiated key establishment, implementation, and configuration;
- termination points, intermediaries, external partners, and trust boundaries;
- supplier dependencies and upgrade constraints;
- observation source, evidence date, and known coverage gaps; and
- target state, accountable owner, exception, and remediation proof.
This model separates data sensitivity from technical exposure while connecting them well enough to set priorities. It also keeps unknowns visible. Failure to observe cryptography in an environment is not evidence that the environment contains none.
Retention is part of the control set
Migration is not the only response. Europol also points to limiting unnecessary data retention, removing outdated protocols, improving key management, and testing post-quantum solutions. If information no longer serves a legal, operational, or business purpose, retaining it can lengthen the period in which it may be stolen or exposed.
That does not mean deleting records indiscriminately. Retention decisions must respect regulatory, evidentiary, safety, and business obligations. It means that data governance and cryptographic migration should share the same prioritization discussion. Reducing unnecessary copies, narrowing access, and shortening justified retention can reduce exposure while complex systems move toward new cryptography.
“PQC enabled” is not enough evidence
A system may advertise post-quantum support but protect only some connections, clients, or segments. Hybrid key establishment may protect confidentiality while authentication remains classical. A gateway may negotiate a post-quantum mechanism externally and classical cryptography internally. Archived files may depend on a separate key lifecycle.
For high-priority data, completion criteria should state the exact path, algorithm or hybrid construction, implementation, configuration, endpoint population, and observation period. Teams should test interoperability and fallback, then re-observe production behavior. A product capability statement is useful supplier evidence, but it is not proof that a particular data flow received the intended protection.
What organizations should do next
Start by selecting a small number of data classes whose confidentiality clearly extends for years. Map their flows and stored copies to the cryptography that protects them. Identify external exposure points and dependencies that make change slow.
Next, rank remediation using both consequence and time. A moderately critical system carrying decades-sensitive data may deserve action before a visibly critical system whose information expires quickly. Record assumptions and review them as technical forecasts and business requirements change.
Finally, combine migration work with justified retention reduction, supplier engagement, protocol modernization, and evidence-based testing. Treat uncertainty as a reason to maintain options and shorten lead times—not as permission to claim an exact quantum deadline.
How Vista Platform helps
Vista Platform is a self-hosted cryptographic system of record. Its operating loop—discovery, canonical inventory, evaluation, action, and proof—helps organizations connect cryptographic observations to assets, owners, policy decisions, migration work, and evidence.
Vista Platform Core is free of charge and includes discovery, inventory, compliance and PQC assessment, and CBOM generation without asset, sensor, seat, or time caps. Vista tracks and governs post-quantum migration; it does not generate PQC keys or perform every migration. Selected-asset Active Scan is targeted rather than indiscriminate network scanning. Vista is not a vulnerability scanner, and discovery gaps are not proof of absence.
See Vista’s post-quantum and cryptographic inventory resources.
Where uncertainty remains
The arrival date and capabilities of a cryptographically relevant quantum computer remain uncertain, as do the scale and targeting of present-day collection. Europol’s report does not turn that uncertainty into a universal emergency. It shows why organizations should prioritize long-lived confidentiality now, while migration and data-governance choices remain available.
Source
- Harvest now, decrypt later, Europol and University Carlos III of Madrid, October 7, 2026.