CISOs at large enterprises are bringing concerns about long-lived data traversing aging interconnects to their boards early, particularly when mitigation options exist. Harvest-now-decrypt-later (HNDL) collection means data captured in 2027 remains vulnerable even with planned upgrades scheduled for 2029, as “nobody has watched an archive get smaller.” The article argues organizations should prioritize securing data flows, like WAN backbones, rather than individual assets, suggesting a shift in quantum-safe migration planning. This approach allows selected corridors to move forward while broader infrastructure upgrades continue.
Harvest-Now-Decrypt-Later Threatens Timelines for Long-Lived Data
Boards are increasingly focused on the risk of harvest-now-decrypt-later (HNDL) attacks impacting long-lived data, demanding mitigation strategies even when full infrastructure upgrades are years away. This disconnect between upgrade schedules and potential exposure is prompting early discussions between Chief Information Security Officers and their boards, particularly when viable solutions exist to reduce risk.
The core vulnerability isn’t the encryption algorithm itself, such as AES-256, but rather the methods used to establish fresh keys; this is the point exploited by HNDL collection. IonQ proposes shifting the focus from replacing existing encryptors to changing where those keys originate, allowing organizations to introduce quantum-safe key sources without a complete infrastructure overhaul.
An existing encryptor can remain in place while an additional quantum-safe key source contributes to session keying through a supported external interface, effectively layering security without disrupting current operations, the company says. “The vulnerable dependency that HNDL turns into a real exposure is how fresh keys are established,” the company states, highlighting the specific attack vector.
This approach offers a phased migration strategy, decoupling the speed of cryptographic agility from the pace of infrastructure upgrades. Once an external key path is established, subsequent algorithm or standards rollouts can be implemented as policy updates rather than requiring another large-scale infrastructure refresh.
This is particularly important given the uncertainty surrounding future cryptographic assumptions; combining post-quantum cryptographic material from multiple families, or with quantum key distribution (QKD)-derived material, creates redundancy and reduces reliance on any single assumption. “Nobody can tell you which assumption fails next, and I would rather not find out with the longest-lived data riding on one,” the company asserts, emphasizing the need for diversified security measures.
Clarion KX, for example, pre-builds keys and buffers them locally in a secure enclave, supporting backup delivery paths to maintain service levels even if the primary key feed is interrupted. A corridor losing its external key feed can either fail open, reverting to native key establishment to maintain traffic flow, or fail closed, raising an alert; the decision is a policy choice per data path.
IonQ’s out-of-band key distribution solution delivers keys without impacting data path performance, avoiding added latency, throughput changes, or encryptor configuration adjustments. The company reports no performance penalty, demonstrating that enhanced security doesn’t necessarily come at the cost of operational efficiency. The fundamental principle is that waiting for complete infrastructure readiness is not a neutral position. An adversary is not constrained by those timelines.
“Waiting is not neutral,” the company emphasizes, emphasising the proactive need to address vulnerabilities before they are exploited. This shift in thinking, prioritizing data flow security over individual asset protection, is becoming increasingly critical in the face of evolving quantum threats.
Prioritizing Data Corridors Over Endpoints Accelerates Quantum-Safe Migration
Selecting specific data corridors for immediate quantum-safe key management offers a pragmatic approach to mitigating risk while broader network upgrades proceed, a strategy gaining traction with enterprise boards increasingly focused on long-lived data confidentiality. The core principle is that delaying protection until full network readiness isn’t a neutral position; exposure accumulates with time, and a feasible mitigation can demonstrably reduce that risk.
This shift in thinking acknowledges that the slowest dependency in a migration timeline should not dictate the protection schedule for data with a longer lifespan. IonQ’s approach, detailed in recent analysis, centers on establishing quantum-safe key delivery to critical data paths, the interconnects carrying the most sensitive, long-lived information, without requiring immediate replacement of existing encryption infrastructure.
This allows organizations to address vulnerabilities on specific corridors while continuing to migrate the wider estate, a strategy that addresses the fundamental issue of key establishment, according to the company. “The quantum-vulnerable part of an encrypted link is how the keys are established, not the symmetric cipher carrying the data,” the company explains, highlighting the ability to leave existing encryptors in place.
Selected corridors move forward while the vendor and execution clocks keep running for the rest of the estate. Three key questions are driving the conversation with clients, according to the company: which corridors carry data that will outlive the planned migration path, where existing encryptors could accept an external key now, and what proportion of the longest-lived traffic still relies on a single cryptographic assumption.
Three Routes to Supplement Existing Encryption with Quantum-Resistant Keys
Selecting which data paths to secure first, rather than waiting for complete platform upgrades, represents a viable near-term strategy for mitigating quantum risks, according to recent analysis of enterprise network security. Prioritizing corridors carrying data with lifespans exceeding planned migration timelines allows organizations to address the most pressing vulnerabilities while broader infrastructure work continues. This approach acknowledges that application-level security remains separate from the protection of the data in transit along specific network segments.
The three identified routes to bolster existing encryption differ significantly in execution timelines and dependencies. Waiting for native Post-Quantum Cryptography (PQC) support within vendor platforms offers the longest path to protection, as it requires implementation across product families, hardware generations and subsequent procurement and testing cycles. An alternative involves accelerating upgrades along selected corridors where native PQC support already exists within the technology stack, requiring only software or protocol updates and replacement of blocking devices.
This, however, proves challenging to implement coherently across diverse and complex IT estates, and A third route focuses on supplementing existing key establishment processes, leaving the core encryption algorithms untouched. This allows organizations to introduce PQC-derived material via external key sources, feeding it into encryptors that support external key inputs. This method decouples key security from vendor release cycles, enabling protection before complete platform upgrades are finalized.
The math used can be identical, but the dependency shifts away from waiting for a vendor’s native PQC implementation. Three key questions guide this strategic assessment, according to the report. The first asks which corridors carry data whose confidentiality requirements extend beyond the timeframe of ongoing migration efforts. The second examines where organizations are unnecessarily waiting on vendor dependencies when existing encryptors could accept external keys.
The viability of this supplemental approach hinges on the ability to deliver PQC-derived keys through existing interfaces, potentially using Quantum Key Distribution (QKD) where fiber infrastructure and data lifetime justify the investment. The analysis suggests that organizations should focus on identifying and securing the most vulnerable data flows, rather than attempting a complete overhaul of their cryptographic infrastructure all at once.
Diversifying Key Sources Reduces Reliance on Single Cryptographic Assumptions
Supplementing existing encryptors with external key sources offers a pragmatic approach to mitigating harvest-now-decrypt-later (HNDL) threats, particularly for data with extended confidentiality requirements. While full network-wide quantum safety remains a longer-term goal, this strategy allows organizations to reduce immediate exposure on critical data flows without waiting for complete platform upgrades. The economics favor this approach, touching only the key establishment layer and avoiding costly, wholesale infrastructure replacements.
Native PQC support within vendor platforms remains subject to release cycles, hardware certifications and internal testing phases, potentially adding years to the timeline. By accepting external keys, existing encryptors can use PQC algorithms without requiring immediate hardware or software replacements. This approach also introduces cryptographic agility, enabling organizations to adapt to evolving cryptographic standards and algorithms more efficiently.
This is particularly valuable given the recent advisory from Germany’s Federal Office for Information Security (BSI) against new Classic McEliece deployments, demonstrating that even standardized algorithms are subject to reevaluation and potential vulnerabilities. Combining PQC-derived material with other sources, such as quantum key distribution (QKD), further enhances security. QKD, relying on the laws of physics rather than computational hardness, provides an additional layer of protection against algorithmic breakthroughs.
While QKD has limitations, such as the need for trusted relays over long distances, solutions like those offered by IonQ’s Clarion KX platform mitigate these risks by protecting user keys end-to-end with NIST-aligned algorithms. Field-proven deployments in high-SLA telecom environments, including a demonstration by JPMorgan Chase of 100 Gbps Quantum-safe IPsec VPN Tunnels, validate the feasibility of this approach. The goal is to reduce exposure ahead of the full migration to native PQC, and long-lived data should not rest on one assumption.
See today’s quantum computing news on Quantum Zeitgeist for the latest breakthroughs in qubits, hardware, algorithms, and industry deals.
