Y2Q — shorthand the cryptographic community uses for "years to quantum," the point at which a sufficiently capable quantum computer could break the public-key cryptography most enterprise systems still rely on — gets treated in board conversations as a single future event. It isn't one. It is a migration problem with a start date years before the risk itself arrives, because data encrypted today can be harvested now and decrypted later.Why "Harvest Now, Decrypt Later" Changes the TimelineA quantum computer capable of breaking current encryption does not need to exist today for today's data to be at risk. An adversary can capture encrypted traffic now and hold it until decryption becomes feasible, which means anything with a confidentiality requirement measured in decades — not years — is already exposed to a threat that has not technically arrived yet. That reframes the planning question from "when will this happen" to "what are we encrypting today that still needs to be secret in fifteen years."What a Governance Programme Needs to Ask NowA cryptographic inventory, not a vendor's assurance: most organizations cannot currently list where and how they use public-key cryptography across their own estate, which makes a migration plan impossible to scope.A data classification tied to shelf life, not just sensitivity: a record's confidentiality requirement measured in decades — health records, national identity data, long-term contracts — belongs on a different migration clock than data that is worthless in two years.A vendor and standards posture, not an in-house cryptography project: post-quantum algorithm selection is a standards-body responsibility; the governance task is confirming vendors and platforms have a credible migration path, not building one internally.An owner named before the deadline is close: a risk with a long runway and no accountable owner is the kind of risk that quietly slips every planning cycle until it stops being a long runway.“The organizations caught out by Y2Q will not be the ones that guessed the wrong date. They will be the ones that never asked what they were encrypting that still needed to be secret when the date arrived.”A Governance Question Before It Is an Engineering OneNobody needs a post-quantum migration finished this year. What a governance programme needs this year is an honest inventory of long-shelf-life data, a documented view of vendor readiness, and a named owner — the groundwork that turns a distant, uncertain threat into a scoped, trackable risk instead of a line item that resurfaces, unresourced, at every board meeting until it is finally too late to matter.Share this articleX (Twitter)LinkedInFacebookCopy Link
Deep Tech ShiftsJul 30, 2026Confidential Computing and the Limits of Encrypting Data in UseConfidential computing closes a real gap — data exposed in memory while it's being processed. It is not a substitute for the governance a workload still needs around it.
Regulatory HorizonJul 2, 2026The Regulation That Hasn't Been Written Yet Is Still a Governance QuestionWaiting for a final regulatory text before building the governance capability it will require is a common instinct. It is also usually the most expensive way to comply with it.
Digital IdentityAug 27, 2026The Identity Perimeter That Replaced the Network PerimeterThe network perimeter stopped being the primary control boundary years ago. Most governance programmes have not finished updating their risk model to match.
