Data stolen today can be unlocked years from now, once quantum computers mature enough to break the encryption protecting it. Singapore's recent push toward quantum-resistant encryption standards marks a meaningful policy shift, but it addresses a threat that criminal networks are already exploiting. The gap between announcing new cryptographic standards and embedding them across an organisation's systems can stretch for years, and that gap is precisely where attackers are positioning themselves.
The "harvest now, decrypt later" problem
Encrypted traffic intercepted today is not useless to an attacker simply because it cannot be read immediately. Threat actors are archiving stolen datasets - financial records, medical files, intellectual property, government communications - on the assumption that sufficiently powerful quantum machines will eventually render current encryption readable. This is not speculative behaviour; it is a documented pattern in cybersecurity circles, built on the expectation that quantum capability will arrive before most organisations have finished migrating their systems. The sensitivity of data does not expire quickly. Medical histories, trade secrets, and state communications often retain value for decades, which means information encrypted with conventional algorithms today may still be worth stealing even if it takes ten or fifteen years to crack.
Why rigid defences will not survive the transition
The mathematical standards underpinning post-quantum cryptography are still evolving. Standards bodies continue to refine and test algorithms, and some early candidates have already been revised or replaced after further scrutiny. An organisation that locks itself into a single post-quantum algorithm risks repeating the very mistake it is trying to avoid: building a defence that cannot adapt when the underlying mathematics shifts again. Crypto-agility - the ability to swap cryptographic methods and keys without disrupting live systems - is the practical answer to this uncertainty. A hybrid approach, which layers quantum-resistant algorithms alongside proven classical encryption, offers protection against both present-day attacks and the quantum-era threats still taking shape. This is not a theoretical nicety. It is the difference between an organisation that can respond to a cryptographic revision within weeks and one that faces another multi-year migration project.
Where organisations should act first
Preparing for this shift does not require waiting for quantum computers to materialise. Several steps are available immediately:
- Conduct a full inventory of existing cryptographic systems to identify where legacy algorithms remain in use.
- Review the post-quantum migration plans of third-party vendors and cloud providers, since supply-chain dependencies often create hidden exposure.
- Prioritise protection for high-value access points, including identity systems and administrative credentials.
- Adopt identity and access management platforms built on zero-trust and zero-knowledge principles that already incorporate quantum-resistant encryption.
- Deploy privileged access management controls that limit lateral movement across networks if a breach does occur.
A security posture built for change, not finality
Singapore's regulatory attention to quantum-resistant encryption gives organisations a clear signal and a useful framework, but policy announcements alone do not close the exposure window. The institutions best positioned for the transition will be those that treat cryptographic agility as an ongoing operational discipline rather than a one-time upgrade. Data harvested today, whether financial, medical, or governmental, carries forward risk regardless of when quantum decryption becomes practical. Addressing that risk now, through layered and adaptable defences, is the only approach that accounts for both the uncertainty of quantum timelines and the certainty that today's encrypted data is already a target.