What happened
Two authorities on opposite sides of the Atlantic published reports in the week beginning October 5 urging organizations to speed up their move to post-quantum cryptography. Europol, Europe's law enforcement agency, and the US Government Accountability Office both argued that the timeline for action is shorter than many organizations assume.
The GAO said it has already made 89 recommendations to 23 agencies, covering three core areas: building a prioritized inventory of vulnerable cryptography, identifying what funding a transition would need, and testing post-quantum cryptography. None of the 24 agencies cited in the report had fully addressed all three, it found, citing gaps in cryptography expertise, transition processes, and testing plans.
Europol published two reports on quantum on October 7. One assessed how encrypted communications and stored files could become vulnerable to harvest now, decrypt later attacks, where data is captured today and cracked once a powerful enough quantum computer exists. A second examined the quantum threat to cryptocurrency wallets.
Why this is a GRC story
This is a planning and governance problem before it is a technical one. The GAO's findings are not about broken algorithms. They are about organizations that have not built an inventory of where their cryptography lives or decided who pays for the migration. Those are governance tasks. Without an inventory, you cannot prioritise, and without a priority order you cannot fund the work.
Harvest now, decrypt later turns data retention into a risk. If an adversary can copy encrypted traffic today and wait, then any long-lived sensitive data you hold is already exposed in principle. That reframes encryption from a present tense control into one with a deadline attached. Records that must stay confidential for years are the ones that matter most.
Outside estimates keep the pressure on. Consensus on when a cryptographically relevant quantum computer arrives is genuinely divided, and Google has suggested it could be as soon as 2029. Faced with that uncertainty, treating the migration as a long term project with no owner is the riskiest position of all. Cryptography transitions are measured in years, so the useful question is not whether the threat is near, but whether the work has started.
What to watch
Watch for agencies and regulators translating these recommendations into deadlines, and for progress updates on whether the cited agencies close the three gaps. Guidance that names specific milestones tends to move organizations faster than a general warning.
In the meantime, Europol's practical advice is to cut the easy exposure first: move to modern protocols such as TLS 1.3 and SSH2 and retire legacy ones. For most teams, an accurate inventory of where vulnerable cryptography is used, and who owns each system, is the honest starting point. That work is unglamorous, but it is the same foundation every later step depends on.
Attribution: Analysis based on Infosecurity Magazine and related public reporting. This article is original commentary, not a repost of the source material.