Encrypted data stolen today could be read in plain text within a decade, and that single fact should reorder the security priorities of every organisation operating in Singapore. The city-state's recent moves to promote quantum-resistant encryption mark a genuine advance in national cyber policy. But the danger these standards are meant to address is not theoretical or distant - it is already being exploited.
The data stolen now, read later
Security researchers have long warned of so-called "harvest now, decrypt later" operations, in which adversaries intercept encrypted traffic or exfiltrate stored data with no ability to read it immediately. Instead, they archive it, betting that sufficiently powerful quantum computers will eventually break the mathematical problems underpinning today's public-key cryptography. Algorithms such as RSA and elliptic-curve encryption rely on problems - factoring large numbers, solving discrete logarithms - that are computationally impractical for classical machines but theoretically vulnerable to a mature quantum computer running known algorithms. Nobody can say with precision when that threshold will be crossed. What is certain is that data encrypted today, if captured now, carries an expiry date on its confidentiality.
This matters most for information with a long shelf life: medical records, financial histories, trade secrets, government communications, intellectual property. If that data remains sensitive five or ten years from now, it is already exposed to future decryption, regardless of how strong the encryption looks by current standards.
Why rigid defences will fail
Replacing cryptographic infrastructure across a large organisation is slow, often taking years when legacy systems, third-party integrations and regulatory requirements are factored in. Betting everything on a single post-quantum algorithm is also risky, because the mathematical standards for post-quantum cryptography are still being refined and tested by global standards bodies. An algorithm considered robust today could be weakened or deprecated as research advances.
The more resilient approach is crypto-agility: building systems that can update cryptographic methods and keys without tearing down existing infrastructure or halting business operations. In practice, this often takes the form of hybrid encryption, layering a post-quantum algorithm alongside a classical one so that a system remains protected even if one method is later found wanting. This is not a theoretical ideal - it is a transitional necessity while the cryptographic community converges on durable standards.
Practical steps organisations can take now
Waiting for quantum computers to mature before acting is a strategy built on false comfort. Organisations in Singapore and elsewhere should treat this as an operational priority rather than a future agenda item. Useful starting points include:
- Conducting a full inventory of where and how cryptography is used across systems, applications and data stores.
- Reviewing the post-quantum readiness and roadmaps of third-party vendors and cloud providers.
- Identifying and hardening high-value access points, including administrative and privileged accounts.
- Deploying zero-trust Identity and Access Management platforms that already support quantum-resistant encryption.
- Adopting Privileged Access Management controls that limit lateral movement across networks if a breach occurs.
None of these steps require a finished quantum computer to be useful. They reduce the attack surface today while preparing organisations for a cryptographic transition that is coming whether businesses are ready or not.
A policy signal, not a finish line
Singapore's encouragement of quantum-resistant standards gives organisations a useful reference point and a sense of regulatory direction. But policy announcements set expectations; they do not retrofit old systems or retroactively protect data already stolen. The responsibility for closing that gap sits with enterprises themselves; those that treat crypto-agility as foundational infrastructure, rather than a future upgrade, will be far better placed to protect their data as quantum computing moves from research laboratories into practical reach.
