2035 Is the Deadline. Here’s How to Be Quantum-Safe Before It’s Too Late
The quantum threat is no longer theoretical. As adversaries engage in “harvest now, decrypt later” attacks, collecting encrypted data today with the intent to decrypt it once quantum computers mature, the need to shift to post-quantum cryptography (PQC) has become urgent and unavoidable. While some organizations are still waiting for finalized standards or compliance mandates, the stark reality is that by the time those arrive, it may already be too late.
Dustin Moody, the mathematician leading the post-quantum cryptography standardization project at NIST, has been at the forefront of this shift since 2016. In a recent episode of Shielded: The Last Line of Cyber Defense, he delivered a direct message to organizations of all sizes: The time to act is now.
“The standards are here,” he explains. “And now maybe some people think, okay, we’ve got the standards, we’ll just switch over. Be a real easy, quick thing… But I don’t believe it’s going to end up being just a quick, easy, simple transition.”
That’s because the 2035 deadline isn’t the starting line; it’s the finish line. For large organizations with deeply embedded infrastructure and sprawling software ecosystems, migrating to quantum-safe systems could take a decade or more. The only safe option is to start immediately.
According to Moody, the first step is organizational: build a dedicated internal team and assign leadership responsibility. PQC readiness can’t be an afterthought buried within an IT department. It needs executive-level visibility and proper resources. That team’s initial task? Begin a cryptographic inventory. Most organizations don’t fully understand where cryptography is used across their systems—whether in internal applications, third-party services, APIs, or legacy protocols. Without that visibility, any migration plan is built on guesswork.
Inventory alone, however, isn’t enough. Crypto agility, the ability to update cryptographic components without interrupting running systems, must be designed into future architectures. “Crypto agility describes the capabilities needed to replace and adapt cryptographic algorithms for protocols, applications, software, hardware, and infrastructures without interrupting the flow of a running system to achieve resiliency,” Moody says. This isn’t a future nice-to-have. It’s essential infrastructure for the quantum era.
And the threat landscape is evolving faster than many realize. Moody confirms that U.S. government agencies are already observing harvest now, decrypt later behavior from adversaries. “It is a real attack. It’s not just something that could happen in the future, but that it’s ongoing now,” he notes. “They have seen our country’s adversaries and enemies actively scooping up data with the idea that maybe in the future, they’ll be able to unlock it and get access to that information.”
That risk is especially acute for any data with a long shelf life such as medical records, legal documents, financial contracts, or national security information. Even if your encryption seems secure today, if that data remains sensitive five, ten, or fifteen years from now, it’s already vulnerable. While symmetric algorithms like AES offer some protection, public-key encryption methods such as RSA and elliptic curve cryptography are known to be quantum-vulnerable. Once the keys are broken, everything encrypted with them is at risk.
For industries like healthcare, finance, critical infrastructure, and defense, this should be a wake-up call- not for panic, but for prioritization. NIST’s National Cybersecurity Center of Excellence (NCCoE) is already working with both government and private-sector partners to document best practices, develop migration strategies, and share early implementation lessons. Organizations that begin now can take advantage of this growing body of knowledge and test PQC algorithms within isolated systems, internal tools, or during natural upgrade cycles.
Crucially, Moody doesn’t recommend tearing everything down overnight. The next 12 months should be focused on momentum—building awareness, allocating resources, and beginning to embed post-quantum readiness into your broader security strategy. “Start by building a team, having someone in charge of it, and putting together a roadmap for your organization,” he advises. “Begin doing some risk assessments. Start talking to vendors and your customers and your suppliers, making sure that they’re aware.”
Hybrid cryptography, deploying classical and quantum-safe algorithms together, can offer a transitional bridge but also introduces added complexity. “Whenever you combine two things, there’s a chance that someone will find a way to come at it with a new angle,” Moody explains. “There are some potential reasons why you might not want to do hybrid… but it’s a pretty conservative way to do that until we get more experience with implementations.” Organizations must weigh the trade-offs carefully and stay informed as hybrid adoption patterns emerge.
What’s at stake isn’t just technical; it’s strategic. Organizations that begin the transition now gain control over their timeline, reduce the risk of rushed migrations, and build confidence among regulators, partners, and customers. Most importantly, they establish a foundation of trust and resilience in a world where quantum computing is not just on the horizon, it’s accelerating toward it.
Moody’s advice is clear: don’t wait for another round of standards. Don’t wait until your competitors are moving. Don’t wait until your encrypted data is already compromised. Inventory your cryptographic systems. Start the internal conversations. Treat post-quantum readiness not as a compliance checkbox but as a core strategic initiative.
“It’s gonna be hard,” he says, “but we gotta get it done.”
You can hear the full conversation with Dustin Moody on Shielded: The Last Line of Cyber Defense, available now on: