Six surfaces where quantum risk is real.

Harvest now, decrypt later

Adversaries record TLS sessions, VPN tunnels and encrypted archives today, to decrypt once a cryptographically relevant quantum computer exists. Anything with a long secrecy half-life — IP, health data, M&A material, government records — is already exposed.

Source · CISA / NSA / NIST Quantum-Readiness factsheet (2023)

Public-key infrastructure & TLS

Certificate chains, TLS handshakes and mutual-auth deployments rest on RSA and ECDSA — both broken by Shor's algorithm. Hybrid key exchange (X25519 + ML-KEM) is already shipping in mainstream browsers and servers; certificate migration is the long pole.

Source · NIST IR 8547 (draft) · FIPS 203

Code & document signing

Software updates, firmware, container images and legal documents signed with RSA/ECDSA today remain verifiable only as long as those schemes stand. Long-lived signatures need ML-DSA or SLH-DSA roots well before Q-Day.

Source · NIST FIPS 204 / 205 · NSA CNSA 2.0

Key management systems & HSMs

Enterprises hold thousands of keys across cloud KMS, on-prem HSMs and escrow services. Each has an algorithm, a rotation cadence and a blast radius. The inventory of which keys protect what is the prerequisite for any migration sequencing.

Source · NIST SP 800-57

Vendor & supply-chain cryptography

Your TLS terminators, identity providers, payment rails and observability stack each bring their own primitives. One vendor still defaulting to RSA-2048 in 2031 is a single point of harvest exposure for the whole estate.

Source · ENISA PQC integration study

Compliance & migration windows

DORA is in force for EU finance; NSA's CNSA 2.0 timeline is running; NIST's draft guidance deprecates RSA/ECC after 2030 and disallows them after 2035. The inventory → migrate → re-certify cycle takes years — the deadlines assume you have started.

Source · EU DORA · NSA CNSA 2.0 · NIST IR 8547 (draft)