What Is Harvest Now, Decrypt Later, and How Can Organizations Protect Against It?
Harvest-now-decrypt-later (HNDL) is an attack strategy where adversaries capture encrypted data in transit today and store it until a future quantum computer or any other future technology can break the key exchange protecting it. The attack is usually passive and largely undetectable, since intercepted traffic leaves no trace, triggers no breach alert, and cannot be retroactively protected once it has been recorded. If a piece of data's required confidentiality shelf life plus an organization's migration time exceeds the years remaining until quantum computers can break today's algorithms, that data is already compromised.
Post-quantum cryptography addresses the eventual decoding, but it does not stop the initial recording, since encrypted traffic can still be tapped and stored regardless of which algorithm produced it. CyberRidge's Carmel platform protects against the recording step itself, turning optical data-in-transit into unrecordable noise at the physical layer before any cryptographically relevant quantum computer comes into play.
Harvest-now-decrypt-later is the practice of intercepting and storing encrypted data today so an adversary can crack it later, once a quantum computer or any other future technology capable of breaking current public-key cryptography becomes available. The key nuance is timing: the theft happens now, but the payoff for the attacker could be years away, which is exactly why organizations handling long-lived sensitive data cannot treat this as a future problem. The rest of this article covers what HNDL actually looks like in practice, why standard encryption upgrades alone do not fully solve it, and what a layered defense looks like.
What Harvest-Now-Decrypt-Later Actually Is
HNDL describes an adversary copying encrypted network traffic, typically by physically tapping a fiber optic link, and archiving it rather than trying to break it immediately. The recording captures the key-exchange handshake alongside the encrypted payload, and the attacker is betting on future capability to break that recorded handshake rather than on breaking the AES payload encryption itself through present-day cryptanalysis. Security researchers use a simple comparison to judge whether data is already vulnerable to this kind of attack: how many years the data must stay confidential, weighed against the time it takes to migrate to safer encryption plus however many years remain before quantum computers or other technologies can break current algorithms. For data with a shelf life of ten or twenty years, such as government communications, financial records, or long-term intellectual property, this assessment often shows the exposure window has already opened.
Why This Is a Present-Day Threat, Not a Future One
HNDL is dangerous because it is silent. There is no breach notification for a fiber tap, no log entry, and no way to know afterward whether a given transmission was intercepted. Physical fiber tapping is not theoretical: intelligence and telecom security researchers have documented repeated cases of trunk-line and submarine cable interception, along with tapping at street cabinets and junction boxes that carry carrier-grade traffic. Encryption alone does not remove the exposure, because a tapped signal that is merely encrypted, rather than made physically unrecordable, is still a complete, storable copy of the data stream.
Read to find out the specific fiber tapping incidents that show HNDL is already an operational threat, from state-sponsored cable taps to trunk-line interception at major infrastructure hubs.
How Organizations Protect Against It
First, security teams need cryptographic visibility: an inventory of where data flows, which links carry long-shelf-life information, and which algorithms currently protect them. Second, that inventory should drive prioritization, since not every data flow needs the same level of urgency, but financial, government, and defense-related traffic typically does. Third, organizations migrate to post-quantum cryptography using hybrid key exchange, which protects future decryption of newly transmitted data. None of this, however, protects data that gets physically recorded off the wire before or during the transition.
This approach works because the weak link was never AES: the cipher encrypting the payload is already considered quantum-resistant. The vulnerable piece is the RSA or elliptic-curve key exchange, which is exactly what ML-KEM replaces; quantum key distribution answers the same key-exchange question by different means. Either way, the AES-encrypted payload remains a recordable waveform on the fiber, which is why the recording step needs its own defense.
Where Physical-Layer Protection Closes the Gap
CyberRidge's Carmel platform addresses the recording step that post-quantum cryptography does not reach. Carmel spreads the optical signal across a wide spectral band, embeds a constantly changing optical key within the transmission, and buries the result below a controlled layer of amplified spontaneous emission noise. An intercepted signal has no usable raw data to extract, so there is nothing meaningful to store for later, quantum computer or not. Carmel installs as a drop-in replacement for the transmission line card, is complementary to PQC and other higher-layer protocols rather than a substitute for them, and CyberRidge reports deployment in weeks with no added latency.
Curious why closing the recording gap matters more than which cryptographic algorithm you choose? It compares physical-layer security against quantum key distribution and post-quantum cryptography on exactly this point.
Practical Takeaways for Security Teams
Run the Mosca's theorem math for your own data: if shelf life plus migration time already exceeds a conservative quantum timeline, that data is exposed under current protections. Start post-quantum migration now for every TLS, VPN, and IPsec deployment, since that clock cannot be sped up later. For the specific links carrying data that must stay confidential for a decade or more, add physical-layer protection so a fiber tap yields noise rather than a storable copy.
Worried about data that has to stay confidential for years? Visit CyberRidge to see how Photonic Layer Security closes the harvest-now-decrypt-later gap.
FAQs
Q: What makes harvest-now-decrypt-later different from a normal data breach?
A: A normal breach is typically discovered through logs, alerts, or unusual access patterns. HNDL involves passively copying encrypted traffic off a fiber link, which leaves no trace and triggers no breach notification. Organizations often have no way of knowing whether their traffic was harvested until the underlying encryption is eventually broken.
Q: Does post-quantum cryptography fully protect against HNDL?
A: No. PQC and QKD both secure the key exchange. The step quantum computers actually threaten. Neither touches the payload: the AES-encrypted data stream is still a coherent, recordable waveform on the fiber. CyberRidge's Carmel addresses that gap by making the optical signal itself physically unrecordable.
Q: How do I know if my organization's data is already at risk under Mosca's theorem?
A: Compare your data's required confidentiality shelf life plus your realistic migration timeline against conservative estimates for large-scale quantum computing capability. For data that must stay confidential five years or more, many security teams find the exposure window is already open.
Q: Does CyberRidge's Carmel replace the need for post-quantum cryptography?
A: No. Carmel is designed to complement post-quantum cryptography and other higher-layer digital encryption protocols, not replace them. PQC protects keys against future quantum attacks, while Carmel prevents the underlying signal from being recorded in the first place.
Q: What kind of data is most at risk from harvest-now-decrypt-later attacks?
A: Sensitive data with a long confidentiality shelf life is most exposed, including government and defense communications, financial records, healthcare data, and intellectual property.
Q: How quickly can CyberRidge's Carmel be deployed to reduce HNDL exposure on a network?
A: CyberRidge reports that Carmel typically deploys in weeks, since it installs as a drop-in replacement for existing transmission line cards without requiring a redesign of the surrounding network. This is a company-reported figure, and actual timelines depend on network complexity.
Q: Can fiber tapping happen without an organization ever finding out?
A: Yes. Documented cases of trunk-line and submarine cable tapping show that interception can go undetected for years, since fiber taps do not typically disrupt service or trigger standard security alerts.