This piece is authored by Steven Kapinos, chief cyber officer at MANTECH, and Zack Chester, AI solution lead at MANTECH.
Harvest Now, Decrypt Later operations present a new paradigm for cybersecurity where encrypted data stolen today is already functionally compromised, sitting in adversary stockpiles as a ticking time bomb until cryptographically relevant quantum computers are able to unlock it.
The rapid pace of technological advancement brings both unprecedented capabilities and formidable new challenges to the federal landscape. Chief among these is the impending arrival of cryptographically relevant quantum computers, which poses an existential threat to current encryption standards. For government agencies and enterprise organizations alike, this creates both an urgent and long-term risk to data security that cannot be ignored.
We can no longer afford to wait until vulnerabilities in modern algorithms are definitively proven. The persistent risk of “harvest now, decrypt later” operations, where bad actors steal encrypted data today knowing they will be able to crack it tomorrow, creates an immediate need to secure our cryptographic assets.
To address this, agencies must proactively prepare for the emergence of cryptographically relevant quantum computers. Organizations need to pre-emptively migrate to the current NIST Post Quantum Cryptography (PQC) standards and fundamentally re-architect their cryptographic assets to become crypto-agile.
Crypto-agility is achieved through a dedicated abstraction layer positioned between applications and the actual algorithms. This critical architecture allows for the rapid introduction of new algorithms as they become available and necessary, without breaking existing systems.
Implementing this shift is not a change that will happen overnight, but it becomes manageable through a structured methodology. A comprehensive PQC framework utilizes a phased approach designed to prepare agencies for the rapid advancement of quantum computing. This evaluation and integration process breaks down into four critical phases:
-
Phase 1, Inventory and Vulnerability Assessment: You cannot protect what you have not cataloged. Automated tools must scan network and application code to identify where encryption is used and determine which classical algorithms are currently in play. A gap analysis then compares the current state against readiness standards to identify systems with mission requirements that may struggle to support portions of the transition, like larger PQC key sizes or increased latency and computational requirements.
-
Phase 2, Risk-Based Prioritization: Because a total rip-and-replace is impractical for large agencies, assets are triaged based on vulnerability risk, enterprise impact and criticality. A phased roadmap begins with a pilot use case, typically a non-critical but vulnerable communication channel, before moving to mission-critical infrastructure.
-
Phase 3, Architecting for Agility and Testing: The ultimate goal is not merely to patch old algorithms with new ones, but to fundamentally re-architect systems so future cryptographic swaps take hours, not years. Organizations should design centralized cryptographic management systems and decouple cryptography from core application logic. During this phase, IT leaders must establish sandbox environments to rigorously test the NIST PQC algorithms. Many organizations will adopt a hybrid approach here – layering classical and quantum-resistant algorithms together to ensure stability and compliance during the transition.
-
Phase 4, Establishing Crypto-Agility: This final phase decouples applications from underlying cryptographic libraries so future updates do not require rewriting software. By inserting a middleware layer, organizations create a framework to swap underlying algorithms at the server level without touching application code. Continuous monitoring must be established to track cryptographic health, enforce policy compliance and swiftly identify any shadow IT or legacy protocols that slip into the network.
Transitioning to PQC is an ongoing evolution of the cybersecurity mission. As initial use cases prove successful, they must quickly expand to include the most critical enterprise assets. This expansion requires automated monitoring to track algorithm usage in production environments, alerts to flag deprecated algorithms and governance protocols to continuously assess the evolving cyber threat landscape.
By embracing crypto-agility, agencies can ensure their data remains secure both today and well into the quantum future.
Throughout October, in recognition of Cybersecurity Awareness Month, WashingtonExec will feature op-eds from GovCon cybersecurity experts exploring emerging threats, evolving technologies, challenges shaping the field and practical strategies for strengthening cyber defenses.