Encrypted traffic flowing across the internet right now is already being siphoned off by adversaries who have no way to read it - yet. According to Dr. Peter Huynh, Chairman APAC at SpecterAI Quantum Security, speaking at HPT D-DAY 2026, this "harvest now, decrypt later" strategy means organizations are not preparing for a hypothetical future risk. They are already losing data to it.
Why old encryption is already a liability
The mechanics are straightforward. RSA and elliptic-curve cryptography underpin most of today's secure communications, from the TLS handshakes that protect web traffic to the digital signatures that authorize financial transactions. Both rely on mathematical problems that classical computers cannot feasibly solve. A sufficiently capable quantum computer could solve them in a fraction of the time. Adversaries do not need that machine to exist today - they only need to store the encrypted data now and wait. The U.S. National Institute of Standards and Technology has already standardized replacement algorithms, including ML-KEM, ML-DSA and SLH-DSA, designed to resist attacks from quantum hardware.
A five-stage path to quantum-safe systems
Huynh outlined a structured framework that organizations should follow, beginning with a cryptographic inventory far broader than most security teams typically conduct. This means auditing not just network infrastructure but hard-coded cryptographic libraries buried inside mobile banking applications and the key storage mechanisms inside ATMs - components frequently overlooked because they sit outside conventional security reviews.
From there, data must be classified according to how long it needs to stay confidential. A one-time password and a 30-year mortgage contract carry entirely different risk profiles. Biometric data sits in its own category of urgency. "A password can be changed in thirty seconds," Huynh said. "Nobody can change their face or their fingerprints." That irreversibility is precisely why harvested biometric records pose a long-term threat even if the underlying systems are eventually upgraded.
Assessment follows, with hardware security modules singled out for early scrutiny, since modules unable to support post-quantum algorithms will block any future migration outright. Migration itself centers on hybrid cryptography - for instance, pairing X25519 with ML-KEM-768 inside TLS 1.3 - alongside designing systems for crypto-agility, so algorithms can be swapped rather than hard-coded permanently into infrastructure.
The hidden risk of false confidence
Huynh warned that hybrid implementations carry a quiet danger: if a partner system lacks post-quantum support, the connection can silently fall back to classical cryptography. Transactions continue. Dashboards stay green. But the intended protection has already evaporated, and few organizations have the monitoring in place to notice.
He framed the urgency using a formula attributed to Professor Michele Mosca: if the time data must remain confidential, plus the time migration takes, exceeds the time until a capable quantum computer exists, the data is already compromised. "The only lever leaders hold is Y," Huynh said, "and the way to shorten it is a disciplined program that starts now."
Why self-assessment falls short
The final and, in Huynh's view, most critical stage is independent validation. Internal audits and penetration testing, he argued, cannot substitute for outside scrutiny. "No organization can independently validate work it performed itself," he said. "This is not a judgment about anyone's capability. The team that designed and configured a system is the least likely to find the failure it did not anticipate, because it built the system on its own assumptions."
That reasoning extends to procurement as well: contracts should explicitly require post-quantum compatibility from vendors and partners. Huynh advocates separating implementation teams from validation teams entirely, and treating validation as continuous rather than a one-time checkbox, given how often systems, partners and patches change. The quantum threat may still be years away in its most dangerous form. The exposure it creates, by his account, is already here.