Adversaries are already harvesting encrypted data to decrypt later. With widely used algorithms such as RSA and ECDSA set to be disallowed by 2035, migration to post-quantum cryptography is a business-wide programme, not a technical patch.
Most organisations do not know where cryptography is used across applications, infrastructure and third parties. Building that inventory and crypto-agility is the first step, and long data retention periods in sectors such as banking make it urgent.
