Decrypting Tomorrow's Threats

Some argue we still have time, since quantum computing capable of breaking today’s encryption is a decade or more away. But breakthrough capabilities, especially in domains tied to strategic advantage, rarely follow predictable timelines. Just as nuclear research leapt from theory to practical application with little warning, quantum computing could deliver similar surprises. That uncertainty makes waiting a dangerous gamble.

Operational technology (OT) systems—responsible for electricity, water, transport, manufacturing and defence—are particularly exposed. These environments depend on long-lived data, including configuration files, schematics and control logic, that rarely change. In the wrong hands, this information becomes a blueprint for infiltration, disruption or sabotage. Many OT systems still rely on encryption standards that are widely expected to fall to quantum decryption well within the life of the data they protect. In this context, encryption that’s ‘good enough for now’ becomes a strategic liability.

Traditional OT cybersecurity rightly focuses on segmentation, uptime and predictable control behaviour. But these principles must now expand to include cryptographic survivability. It’s not enough for systems to withstand tampering today. They must remain secure five or 10 years from now, when today’s encrypted traffic could be cracked wide open.

Consider a hostile actor targeting the supervisory systems of regional utilities or firmware update paths for industrial controllers. Even if encrypted, the data need not be decrypted today. HNDL means it needs only to be stored. Once quantum decryption is feasible, attackers could reconstruct topologies, emulate trusted behaviour, or craft malware that mimics legitimate operations. The breach may have already occurred; we just haven’t seen the consequences yet.

Nor are only the crown jewels at risk. Protocol maps, telemetry logs and vendor documentation can all yield strategic insights. Anything that reveals how a system behaves, recovers or updates could be exploited to undermine it.

Some governments are moving early. In the US, the National Cybersecurity Strategy and the National Institute of Standards and Technology’s post-quantum standardisation program provide a roadmap for transition. Australia’s Critical Infrastructure Risk Management Program similarly positions quantum readiness within a broader push for cyber maturity. But real-world implementation, especially across OT, is still patchy.

Meeting the quantum threat requires governments, regulators and industry to work in concert. This starts with mandating post-quantum cryptography for critical communications, especially in domains where data must remain confidential for the long term. This isn’t a premium feature. It’s a baseline for strategic continuity.

Next, we need investment in quantum-resistant data tunnels, built to operate in contested or degraded environments. These secure channels must be independent of lower-trust networks and resilient even in black-start or disconnected conditions.

Supply chains must also be reassessed. Firmware signing, vendor update mechanisms and remote access protocols must be evaluated for quantum-resilience. A system is only as strong as its weakest trusted component.

Front-line staff, particularly field technicians and engineers, must be trained to spot subtle anomalies. HNDL-style breaches won’t trip conventional alarms. But informed human operators are often the first to notice when something feels wrong, before systems do.

Finally, contingency planning must evolve. If data loss today could be weaponised years from now, response plans must treat that loss as a latent threat, not a closed incident. Recovery isn’t enough; organisations must anticipate re-exploitation on longer timelines.

The most dangerous cyberattack may not be the one we can’t detect; it’s the one we’ve already forgotten.

HNDL forces a change in mindset. It shifts the conversation from recovery to irreversibility. Once sensitive data is lost, it can’t be made safe again. It can be only mitigated, redesigned, or prepared for impact. Quantum threats are not abstract. They are real, cumulative and already embedded in the systems we depend on.

The fuse is lit. We don’t know how long it is. But we do know this: the time to act was yesterday. The next best time is now.

Jason Van der Schyff is a consulting technologist whose work spans secure infrastructure, strategic supply chains and sovereign industrial capability within the AUKUS and Indo-Pacific context.

This article appeared originally at The Strategist (ASPI).