For some data, the answer may be days. For other information, it could be decades.
That difference is becoming increasingly important as organizations rethink their approach to encryption, cybersecurity, data protection, and quantum computing.
A common assumption is that if information is securely encrypted today, it will remain protected for as long as the organization needs it. But encryption protects information against today’s capabilities, not necessarily tomorrow’s.
This creates an important question for executives, cybersecurity leaders, and organizations handling sensitive information:
If encrypted information is captured today, could someone decrypt it in the future?
The answer may depend not only on the strength of today’s encryption, but also on how long the information needs to remain confidential.
What does “confidentiality lifetime” mean?
The confidentiality lifetime of information is the period during which unauthorized disclosure could cause meaningful harm.
For example:
- A temporary access code may only need protection for minutes or hours.
- A company’s pricing strategy may need confidentiality for several months.
- Intellectual property could require protection for years.
- Personal, financial, legal, or health-related information may need protection for decades.
- Government, defence, research, and strategic information can have confidentiality requirements extending even further.
This means that cybersecurity decisions should not ask only:
“Is our data encrypted?”
They should also ask:
“How long does this data need to remain confidential?”
That second question changes the conversation.
Why is long-term data confidentiality becoming a cybersecurity concern?
Encryption algorithms are designed to make unauthorized access computationally difficult.
But the security environment changes over time.
Computing power increases. Cryptographic research advances. New vulnerabilities are discovered. Organizations replace systems. Algorithms become outdated. And emerging technologies—including quantum computing—could eventually change the assumptions behind some widely used cryptographic systems.
This creates a strategic cybersecurity risk known as “harvest now, decrypt later.”
What is “harvest now, decrypt later”?
Harvest now, decrypt later (HNDL) refers to the possibility that attackers collect encrypted information today with the intention of decrypting it in the future when technology makes that possible.
The attacker does not necessarily need to understand the information today.
They can simply store it.
If the information remains valuable for many years, today’s encrypted data could become tomorrow’s intelligence.
This is particularly relevant for organizations handling:
- Long-term intellectual property
- Research and development data
- Customer information
- Financial records
- Legal documents
- Government information
- Strategic business plans
- Authentication credentials
- Proprietary algorithms
- Trade secrets
- Personal information
The important issue is therefore not simply whether data is encrypted today.
It is whether today’s encryption will provide adequate protection for the entire confidentiality lifetime of the information.
How does quantum computing affect encryption?
One of the reasons organizations are discussing long-term encryption is the development of quantum computing.
Quantum computers use fundamentally different approaches to computation than traditional computers. If sufficiently powerful, fault-tolerant quantum computers become available, certain mathematical problems underlying widely used public-key cryptographic systems could become significantly easier to solve.
This has implications for technologies such as:
- RSA
- Diffie-Hellman
- Elliptic Curve Cryptography (ECC)
The timeline for achieving cryptographically relevant quantum computing remains uncertain.
That uncertainty is precisely why organizations should not wait for a specific date.
Cybersecurity planning generally has to account for uncertain but potentially significant future risks.
What is post-quantum cryptography?
Post-quantum cryptography (PQC) refers to cryptographic algorithms designed to remain secure against attacks from both conventional and quantum computers.
Unlike quantum cryptography, post-quantum cryptography does not require a quantum communication network. Instead, it uses mathematical algorithms that are intended to resist quantum attacks while operating on conventional computing infrastructure.
The transition to post-quantum cryptography is therefore becoming part of longer-term cybersecurity and cryptographic-agility planning.
Organizations do not necessarily need to replace every encryption system immediately.
But they should understand:
- What cryptography they currently use.
- Where it is used.
- Which information depends on it.
- How long that information needs protection.
- How difficult those systems will be to replace.
- Whether vendors support future cryptographic migration.
How long should encrypted data remain confidential?
There is no universal answer.
The appropriate confidentiality period depends on the information’s value, sensitivity, regulatory requirements, and expected useful life. Take the assessment test.
A practical approach is to classify information according to its required confidentiality lifetime.
| Information type | Potential confidentiality requirement |
|---|---|
| Temporary authentication information | Minutes to days |
| Operational business information | Months to years |
| Competitive intelligence | Several years |
| Intellectual property | 5–20+ years |
| Sensitive personal information | Potentially decades |
| Long-term research data | 10–30+ years |
| Government or strategic information | Potentially decades or longer |
These are illustrative categories rather than universal retention requirements.
The key principle is:
The stronger the information’s long-term value, the more important it is.
Why encryption alone is not enough
Encryption is an important security control, but it is not the entire security strategy.
An organization can have strong encryption and still experience a serious data breach because of:
- Compromised credentials
- Poor key management
- Misconfigured cloud storage
- Insider access
- Weak identity controls
- Vulnerable applications
- Social engineering
- Ransomware
- Third-party suppliers
- Unpatched infrastructure
This is why executives should consider encryption as part of a broader cyber resilience strategy.
The question is not simply:
“Are we encrypted?”
It is:
“Can we maintain the confidentiality and integrity of critical information throughout its useful life?”
What is cryptographic agility?
One of the most important concepts organizations should understand is cryptographic agility.
Cryptographic agility is the ability to change cryptographic algorithms, protocols, keys, and related technologies without having to completely redesign an organization’s systems.
Why does this matter?
Because cryptographic standards can change.
An algorithm considered secure today may become vulnerable tomorrow. Organizations therefore need the ability to migrate without creating massive operational disruption.
A company that has cryptography deeply embedded across applications, databases, devices, APIs, and third-party platforms may discover that replacing an outdated algorithm is considerably more complicated than expected.
This is why cryptographic inventory and dependency mapping are increasingly important.
What should businesses do today?
Organizations do not need to predict exactly when quantum computers will become capable of breaking today’s cryptography.
Instead, they can begin preparing for uncertainty.
1. Create a cryptographic inventory
Identify where encryption and cryptographic algorithms are being used.
Look beyond databases.
Consider:
- Applications
- Cloud platforms
- APIs
- VPNs
- Mobile applications
- IoT devices
- Backup systems
- Digital certificates
- Identity systems
- Third-party platforms
2. Identify long-lived sensitive information
Not all data requires the same level of long-term protection.
Determine which information would still be sensitive or commercially valuable five, ten, twenty, or more years from now.
3. Assess “harvest now, decrypt later” exposure
Ask:
If someone copied this encrypted information today, would it still be valuable if decrypted ten years from now?
For some organizations, the answer will be yes.
4. Develop a post-quantum migration roadmap
Organizations can begin evaluating where post-quantum cryptography could eventually be introduced.
This does not necessarily mean immediately replacing every existing algorithm.
It means understanding the migration path.
5. Build cryptographic agility
Systems should ideally be designed so that cryptographic components can be upgraded without requiring an organization-wide technology replacement.
6. Talk to technology vendors
Organizations should ask vendors:
- What encryption algorithms are currently supported?
- Are post-quantum algorithms on the roadmap?
- How will cryptographic migration be handled?
- Can algorithms be changed without replacing the platform?
- How are encryption keys managed?
- What happens when a cryptographic standard is deprecated?
These questions can reveal significant differences in long-term cybersecurity readiness.
What should executives ask about encrypted information?
Cybersecurity is increasingly a business-risk question rather than simply an IT question.
Executives and boards can ask:
“What information would still be valuable if stolen today and decrypted ten years from now?”
“Which of our systems depend on public-key cryptography?”
“How quickly could we replace a compromised or obsolete cryptographic algorithm?”
“Do we know where our most sensitive encrypted information is stored?”
“How dependent are we on third-party vendors for encryption and key management?”
“Do our contracts require vendors to support future cryptographic standards?”
“What is our plan for post-quantum cryptography?”
These questions can help move the discussion from technology protection toward business resilience.
The bigger issue: information has a lifespan
Every piece of information has a lifecycle.
It is created, stored, accessed, transferred, archived, and eventually deleted—or retained indefinitely.
Encryption should be considered across that entire lifecycle.
A useful framework is:
Information value → Confidentiality lifetime → Threat environment → Cryptographic protection → Migration capability
This helps organizations avoid treating encryption as a one-time implementation decision.
Instead, encryption becomes part of an ongoing information governance and cyber resilience strategy.
Frequently Asked Questions
How long should encrypted data remain confidential?
It depends on the sensitivity and expected value of the information. Some data may only require short-term confidentiality, while intellectual property, personal information, research, and strategic information may require protection for decades.
What is “harvest now, decrypt later”?
Harvest now, decrypt later is a cybersecurity threat in which attackers collect encrypted information today with the expectation that future technology may allow them to decrypt it.
Is current encryption safe from quantum computers?
Some current cryptographic systems are expected to be vulnerable to sufficiently capable quantum computers, particularly widely used public-key approaches such as RSA and ECC. The exact timing of practical cryptographically relevant quantum computing remains uncertain.
What is post-quantum cryptography?
Post-quantum cryptography uses cryptographic algorithms designed to resist attacks from both conventional and quantum computers.
Should businesses switch to post-quantum cryptography now?
Organizations should assess their exposure and begin planning for migration, particularly when they hold information with long confidentiality lifetimes or operate systems that are difficult to replace. The appropriate implementation timeline depends on the organization’s technology environment and risk profile.
What is cryptographic agility?
Cryptographic agility is the ability to replace or update cryptographic algorithms and related security mechanisms without major disruption to business systems.
Why is quantum computing a cybersecurity issue?
Quantum computing could eventually undermine some cryptographic assumptions used by today’s security systems. The concern is particularly significant for information that needs to remain confidential for many years.
From Encryption to Long-Term Cyber Resilience
The most important question may not be:
“Can our encryption be broken today?”
It may be:
“What happens if information encrypted today must remain confidential for the next 10, 20, or 30 years?”
Organizations cannot know exactly what computing technology will look like decades from now.
They can, however, understand the information they need to protect, identify the cryptography supporting it, assess how long confidentiality matters, and build systems capable of adapting as the threat landscape changes.
Long-term confidentiality requires more than strong encryption. It requires the ability to adapt.
For business leaders, that means treating encryption, post-quantum readiness, cryptographic agility, information governance, and cyber resilience as connected parts of the same strategic conversation.
