# Harvest now, decrypt later: why your AI data needs post-quantum security today | RankShield > Adversaries are storing encrypted data now to decrypt once quantum computers arrive. For AI systems, whose weights and data stay valuable for years, the clock has already started. > > Source: https://rankshield.co/resources/harvest-now-decrypt-later-ai/ · RankShield (the verifiable, quantum-safe AI security platform) Resources / Quantum # Harvest now, decrypt later: why your AI data needs post-quantum security today Adversaries are storing encrypted data now to decrypt once quantum computers arrive. For AI systems, whose weights and data stay valuable for years, the clock has already started. June 27, 2026 · 10 min read · post-quantum security for AI Jamie Kloncz Founder & CEO, RankShield Share "Harvest now, decrypt later" (HNDL) is the quiet reason post-quantum security is urgent in 2026, not in some far-off future. The idea is simple and unsettling: adversaries don’t need a quantum computer today to threaten you. They can vacuum up encrypted data now, store it, and decrypt it once a cryptographically relevant quantum computer exists, currently projected between roughly 2033 and 2037 ([Gopher Security](https://www.gopher.security/news/harvest-now-decrypt-later-quantum-migration-guide) 4 ). Any data whose value outlives that window is already exposed. For AI systems, whose model weights, training data, and proprietary context stay valuable for years, that makes HNDL a today problem. This piece explains why the standards and deadlines are already set, why AI assets in particular are the prime target, what quantum-safe protection actually means for them, and how to sequence a migration that starts now instead of after a "Q-Day" announcement that will come too late for anything you encrypted in the meantime. Note the language throughout: quantum-safe, never "quantum-proof," because no one can honestly promise permanent immunity. Key takeaways - Harvest-now-decrypt-later means adversaries store your encrypted data today and decrypt it once quantum hardware arrives, so long-lived secrets are already exposed. - The standards are final: in August 2024 NIST published FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA), so the algorithms to migrate to are no longer drafts. - AI concentrates exactly the long-lived, high-value secrets HNDL targets: proprietary model weights, training data, and the private context flowing through agents. - Migration is a multi-year effort that starts with a cryptographic inventory, not a purchase order, so waiting for a Q-Day announcement is already too late. - Quantum-safe (never “quantum-proof”) means sealing the right assets with ML-KEM and ML-DSA and signing autonomous actions so their proof stays valid long-term. ## What is “harvest now, decrypt later,” and why is the clock already running? The attack inverts the usual order of operations. Normally you worry about a capability that exists now; here the capability, a cryptographically relevant quantum computer, does not exist yet, and that is precisely what makes the threat easy to underestimate and dangerous to ignore. An adversary does not need the quantum computer today. They need only to capture your encrypted data now, intercepted traffic, exfiltrated backups, copied archives, and store it cheaply until the hardware arrives, currently projected somewhere between roughly 2033 and 2037. Then they decrypt the hoard retroactively. The collection is happening in the present tense; only the decryption lives in the future. That timeline inverts the usual risk calculation, and the inversion is the whole point. For most data, value decays quickly, so a breach years from now is harmless. For anything whose confidentiality must outlast the arrival of quantum decryption, the opposite is true: it is exactly the data most worth harvesting, because it will still be sensitive when it becomes readable. The clock is already running not because a quantum computer is imminent, but because the capture is. Every day that long-lived data moves or sits protected only by today’s public-key cryptography is a day it can be added to someone’s patient archive. ## Are the post-quantum standards and deadlines actually set? The waiting period is over. In August 2024, [NIST finalized three post-quantum standards](https://csrc.nist.gov/projects/post-quantum-cryptography) 1 : FIPS 203 (ML-KEM) for key encapsulation, FIPS 204 (ML-DSA) for digital signatures, and FIPS 205 (SLH-DSA) as a hash-based backup. Guidance now points enterprises toward quantum-resistant implementation on aggressive timelines, and analysts project the global migration of cryptographic infrastructure to exceed $15 billion by 2030. The significance is not just that algorithms exist; it is that the target of a migration is now a standard rather than a research bet, which removes the last excuse for waiting to see what wins. Migration itself is a multi-year effort, commonly estimated at 5 to 15 years for a full transition across systems and suppliers, and it starts with a cryptographic inventory, not a purchase order. You cannot protect what you have not located, so the first move is discovering where cryptography lives and which data classes carry the longest confidentiality lifetimes ([NIST NCCoE](https://pages.nist.gov/nccoe-migration-post-quantum-cryptography/) 2 ). The organizations that wait for "Q-Day" to be announced will already be too late for anything they encrypted in the meantime, because the harvest of that data will have already happened. Set against published mandates, the U.S. federal push on high-value key establishment and [CNSA 2.0](https://www.nsa.gov/) 3 milestones running toward 2035, the arithmetic says begin the inventory now and migrate the longest-lived data first. DOWNLOADABLE INFOGRAPHIC ### What AI data is harvest-now-at-risk? AI concentrates long-lived, high-value secrets. Quantum-safe, never “quantum-proof.” Free to share with attribution. ## Why is AI the prime target for harvest-now-decrypt-later? AI concentrates exactly the kind of long-lived, high-value secrets HNDL attackers want, in one place, at a scale that makes the patient strategy worth their storage costs. Proprietary model weights that took millions of dollars and enormous compute to train do not lose value in a year; they are among the most valuable assets an AI company owns, and their confidentiality matters for as long as the model or its successors have commercial edge. Training datasets can contain sensitive, regulated, or proprietary information whose secrecy obligations run for years. And the private context flowing through autonomous agents, the prompts, the retrieved documents, the credentials and business data an agent touches, is a continuous stream of exactly the material an adversary would want to read later. Encrypt those assets with today’s RSA or elliptic-curve cryptography and you are betting their confidentiality won’t matter a decade from now. For most enterprises building on AI, that bet is wrong, because the whole point of a proprietary model or dataset is that its value persists. This is the specific reason AI raises the HNDL stakes above the general case: it is not just that AI systems hold long-lived secrets, but that their most valuable secrets are unusually long-lived and unusually concentrated, which is precisely the profile that rewards an adversary willing to harvest now and wait. The organizations treating post-quantum protection as a future concern are, in effect, deciding that their model weights and training data will be worthless by the mid-2030s, which is rarely what they actually believe. There is a second, subtler reason AI deserves special attention here, which is that AI systems move their most sensitive data around far more than a static archive does. A model’s weights may sit encrypted at rest, but training pipelines copy datasets between systems, inference services stream private context through prompts and retrievals, and autonomous agents carry credentials and business data across tools and networks all day long. Every one of those movements is a chance for an adversary to capture ciphertext for later decryption, so the harvestable surface of an AI system is not a single vault but a constant flow. That is why a quantum-safe posture for AI has to cover data in motion and the agent layer, not just data at rest, and why treating it as a one-time encryption upgrade misses the point: the exposure is continuous, so the protection has to be too. ## Which of your AI data is actually at risk from quantum decryption? You do not need a threat-intelligence team to triage this. You need two numbers: how many years a given asset must stay confidential, and the earliest year a quantum computer could plausibly break today’s encryption. Compare them. If the confidentiality requirement outlasts that horizon, the asset is exposed to harvest-now-decrypt-later and belongs at the front of your migration queue. Run your AI assets, and any other long-lived data, through the test below. DATA SHELF-LIFE TEST ### Is this AI asset harvest-now-at-risk? - Years this asset must stay confidential - Est. year quantum could break today’s crypto - Harvest-now-decrypt-later status ## What does quantum-safe security for AI actually mean? Post-quantum security isn’t a single switch; it’s protecting the right things with the right algorithms before the harvest matters. For AI specifically, that means being deliberate about which assets carry long confidentiality lifetimes and sealing those first, rather than trying to boil the ocean or, worse, doing nothing because the whole migration looks daunting. The practical shape of a quantum-safe posture for AI comes down to a few concrete moves, each mapped to the assets that matter most. Sequencing that work is its own exercise, and the [post-quantum migration](https://rankshield.co/post-quantum-migration/) page sets out how to inventory what you hold before you start swapping algorithms. - Seal data, model context, and agent credentials with post-quantum cryptography (ML-KEM for key establishment, ML-DSA for signatures). - Prioritize anything with a long confidentiality lifetime: model weights, training data, IP, and health and financial records. - Sign autonomous agent actions with post-quantum signatures, so the proof of what an agent did stays valid for the long term, not just until quantum breaks today’s signatures. - Stay crypto-agile, so the algorithm in use is a configuration you can upgrade rather than a foundation you have to rebuild when standards advance. ## Is your AI stack ready for the post-quantum transition? Score your current posture against the moves that actually close the harvest-now-decrypt-later gap for AI assets. The point is not a perfect score today; it is knowing which of your most valuable, longest-lived secrets are still riding on cryptography a future quantum computer is expected to break. Because the migration is measured in years and the harvest is happening now, an honest readout of where you stand is the cheapest and most useful first step you can take. READINESS CHECK ### Is your AI data quantum-safe yet? - Have you inventoried where cryptography protects your AI assets (a CBOM)? - Are your longest-lived AI secrets (weights, training data) protected against quantum yet? - Do you sign autonomous agent actions with post-quantum signatures? - Is your cryptography crypto-agile (swappable by config)? - Do you have a migration plan mapped to the NIST / CNSA 2.0 dates? FREQUENTLY ASKED ## Questions, answered. Jamie Kloncz CEO, RankShield · online What is "harvest now, decrypt later"? It is an attack strategy where an adversary captures your encrypted data today, intercepted traffic, exfiltrated backups, copied archives, and stores it cheaply until a cryptographically relevant quantum computer exists (projected roughly 2033–2037), then decrypts the hoard retroactively. It does not require the quantum computer to exist yet; it only requires the capture, which is happening now. The threat is concentrated in data whose confidentiality must outlast the arrival of quantum decryption, because that data will still be sensitive when it becomes readable. Why does harvest-now-decrypt-later matter for AI specifically? Because AI concentrates exactly the long-lived, high-value secrets the strategy targets. Proprietary model weights cost millions to train and hold value for years; training datasets carry regulated or proprietary information with long secrecy needs; and the private context flowing through autonomous agents is a continuous stream of sensitive material. Encrypt those with today’s RSA or elliptic-curve cryptography and you are betting their confidentiality won’t matter a decade from now, which contradicts the entire premise of building proprietary AI. That is why AI raises the HNDL stakes above the general case. Are post-quantum standards actually ready to use? Yes. In August 2024, NIST finalized FIPS 203 (ML-KEM) for key encapsulation, FIPS 204 (ML-DSA) for digital signatures, and FIPS 205 (SLH-DSA) as a hash-based backup. The algorithms you migrate to are standards, not research bets, which removes the last reason to wait and see what wins. Analysts project global cryptographic migration to exceed $15 billion by 2030, and U.S. federal guidance and CNSA 2.0 milestones toward 2035 set concrete dates to plan against. How long does a post-quantum migration take? It is a multi-year effort, commonly estimated at 5 to 15 years for a full transition across systems and suppliers, and it begins with a cryptographic inventory rather than a purchase order, because you cannot protect what you have not located. The length is exactly why waiting is dangerous: organizations that wait for a "Q-Day" announcement will already be too late for anything they encrypted in the meantime, since that data will have been harvested. The practical response is to inventory now and migrate the longest-lived, highest-value assets, for AI that is model weights and training data, first. What is the difference between quantum-safe and quantum-proof? Quantum-safe (used interchangeably with post-quantum) means cryptography designed to resist the quantum attacks we currently understand, based on standardized algorithms like ML-KEM and ML-DSA. "Quantum-proof" implies a permanent, provable guarantee of immunity that no one can honestly make, so it should be treated as a marketing red flag rather than a security claim. RankShield deliberately says quantum-safe, never quantum-proof, and keeps its cryptography crypto-agile so it can be upgraded as standards evolve, which is the honest posture for a moving field. How does RankShield protect AI data against quantum threats? RankShield seals data, context, and every agent action with post-quantum cryptography by default, using ML-KEM for key establishment and ML-DSA and SLH-DSA for signatures, so autonomy today does not become a liability once quantum hardware matures. It signs autonomous actions with post-quantum signatures so their proof of what an agent did stays valid long-term, and it is built crypto-agile so the algorithms can be refreshed as standards advance. The honest framing is quantum-safe, not quantum-proof: the strongest standardized protection available, matched to how long your AI secrets must actually last. ## References - [NIST — Post-Quantum Cryptography project (FIPS 203/204/205)](https://csrc.nist.gov/projects/post-quantum-cryptography) - [NIST — Migration to Post-Quantum Cryptography (NCCoE)](https://pages.nist.gov/nccoe-migration-post-quantum-cryptography/) - [NSA — Commercial National Security Algorithm Suite (CNSA) 2.0](https://www.nsa.gov/) - [Gopher Security — Harvest now, decrypt later migration guide](https://www.gopher.security/news/harvest-now-decrypt-later-quantum-migration-guide) WRITTEN BY ## [Jamie Kloncz](https://rankshield.co/author/jamie-kloncz/) Founder & CEO, RankShield Jamie Kloncz is the founder and CEO of RankShield, the verifiable AI and quantum security platform. He started the company after two attacks landed in a single week: his phone was cloned, and his business was hit by a click-fraud campaign. One targeted him as a person, the other his livelihood, and no single tool defended both. That experience, together with surviving an AI voice-clone scam, shaped RankShield’s core belief: the threats of the AI age are personal first, and trust should be something you can check, not just extend. More from Jamie → ## Make every AI action provable. RankShield is the verifiable, quantum-safe AI security platform — protection you can check, not just trust. Explore the platform → Get started ## More from Resources Security Cloudflare Blocks AI Crawlers by Default on September 15. What Site Owners Must Do On September 15, 2026, Cloudflare changes how it treats AI crawlers for every site. Here is what could quietly cut your AI visibility, and the settings to check before then. Quantum AI Just Broke a Post-Quantum Algorithm. Here’s What It Actually Means An AI model weakened a post-quantum algorithm in about 60 hours. Before you panic: it was not a standardized one, your encryption is not broken, and the real lesson is about speed. Quantum A Post-Quantum Migration Roadmap: Moving Your Business Off Vulnerable Crypto NIST’s post-quantum standards are final and federal deadlines are set. Here is a staged roadmap to move your business off vulnerable cryptography in the right order.