Harvest Now, Decrypt Later: A Pragmatic Post-Quantum Migration Timeline for 2026–2030
The post-quantum question changed in August 2024, when NIST finalized FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA). The standards debate is over; what remains is a migration project, and a deadline set by your adversary, not your roadmap. Intelligence agencies and criminal groups are already executing harvest-now-decrypt-later: capturing encrypted traffic today to decrypt when a cryptographically relevant quantum computer arrives.
The only deadline that matters is yours
Apply Mosca's inequality to your own data: if the years your data must stay confidential, plus the years your migration will take, exceed the years until a capable quantum machine, you are already late for that data class. Health records, financial data, IP, and state-relevant communications with 10+ year sensitivity are being harvested now. That is why migration priority follows data lifetime, not system criticality.
A phased model that survives contact with reality
Phase 1, Inventory (2026). Build a cryptographic bill of materials (CBOM): every algorithm, key length, certificate, library, and protocol across applications, infrastructure, and vendor products. Every enterprise we've assessed underestimated its cryptographic sprawl, hard-coded RSA in a payments batch job is the classic find.
Phase 2, Perimeter hybrid (2026–2027). Deploy hybrid key exchange (X25519 + ML-KEM) at TLS termination, browsers and major clouds already support it. This is the highest-value, lowest-disruption move: it immediately blunts HNDL against data in transit.
Phase 3, Long-lived data and signatures (2027–2029). Re-encrypt archives with quantum-resistant schemes by data-lifetime priority; migrate code-signing and firmware-signing to ML-DSA/SLH-DSA, signature migration is slower because verifier ecosystems must move with you.
Phase 4, Crypto-agility as posture (ongoing). The lasting lesson isn't ML-KEM; it's that algorithms must be swappable. Abstract cryptographic choices behind interfaces so the next transition is a configuration change, not a five-year program.