Encrypted traffic crossing the internet right now is being quietly copied and stored by adversaries who have no way to read it yet - but expect to, eventually. That warning came from Dr. Peter Huynh, Chairman APAC of SpecterAI Quantum Security, speaking at HPT D-DAY 2026. The practice, known as "harvest now, decrypt later," turns the quantum computing threat from a distant hypothetical into an active, ongoing campaign.
A threat already underway
The mechanics are straightforward: intercepted ciphertext, even if unreadable today, retains its value if it can be unlocked later. RSA and elliptic-curve cryptography, the mathematical backbone securing TLS connections and transaction signing across banking and commerce, are the primary targets, because a sufficiently powerful quantum computer could eventually break them. In response, the U.S. National Institute of Standards and Technology has standardized three replacement algorithms - ML-KEM, ML-DSA and SLH-DSA - designed to resist quantum attacks. Adoption, however, remains uneven, and Huynh argues that organizations treating this as a future problem are already behind.
Five stages, one weak link
SpecterAI's readiness framework moves through five stages, beginning with a cryptographic inventory that reaches well past firewalls and network configurations. Huynh pointed specifically to overlooked exposure points: hard-coded cryptographic libraries buried inside mobile banking applications, and key storage mechanisms inside ATMs. Once systems are mapped, data must be classified by how long it needs protection. A one-time password expires in minutes; a 30-year mortgage contract does not. Biometric data sits in its own category entirely. "A password can be changed in thirty seconds," Huynh said. "Nobody can change their face or their fingerprints."
That classification feeds into an assessment stage focused on real exposure rather than mere visibility, with hardware security modules examined first, since modules unable to support post-quantum algorithms will block any later migration outright. Migration itself centers on hybrid cryptography - pairing, for example, X25519 with ML-KEM-768 inside TLS 1.3 - alongside crypto-agility, meaning systems built with configurable algorithms rather than hard-coded ones. Huynh also urged that procurement contracts explicitly require post-quantum compatibility from vendors and partners.
One warning stood out: a hybrid connection can silently fall back to classical cryptography if a partner system lacks post-quantum support. Transactions keep processing. Dashboards stay green. The protection organizations believe they have is simply not there.
A timeline problem, not a race
Huynh reframed the urgency using a formula attributed to Professor Michele Mosca: if the years data must stay confidential (X) plus the years a migration takes (Y) exceed the years until a capable quantum computer exists (Z), that data is already exposed. Organizations cannot control X or Z. "The only lever leaders hold is Y, and the way to shorten it is a disciplined program that starts now," Huynh said.
Why independent validation matters most
The framework's final and, in Huynh's view, most decisive stage is independent validation. Internal audits and penetration testing, he argued, cannot certify genuine quantum resistance. "No organization can independently validate work it performed itself," he said. "This is not a judgment about anyone's capability. The team that designed and configured a system is the least likely to find the failure it did not anticipate, because it built the system on its own assumptions." He called for a clear separation between implementation teams and validation teams, paired with continuous reassessment as systems, partners, and security patches evolve over time.