Encryption Breaks Later. The Theft Happens Now.

An attacker doesn't need to break your encryption today. Copying the traffic and waiting works just as well.

The industry calls the day current public-key encryption falls Q-Day. Everyone wants the date. In a 2025 Global Risk Institute survey, experts put the arrival of a cryptographically relevant quantum computer at 28–49% within ten years and 51–70% within fifteen. The width of that range is the finding.

Q-Day is the day encryption breaks. It is not the day the risk starts. The question that matters is what your organization is accumulating between now and then. Call it quantum debt.

The Attack Happens Now. The Damage Lands After Q-Day.

Harvest Now, Decrypt Later. Intercept encrypted traffic today, store it, and open it when a machine strong enough exists. The moment of attack and the moment of damage come apart.

Nothing Looks Broken. That Is the Problem.

Systems run normally. The data is still encrypted. The collection itself may never be detected. Nothing surfaces until the day it all surfaces at once.

That structure is what makes long-lived data expensive. State secrets, genomic records, research data that has to survive decades. For those, today's encryption may not be enough.

Quantum Debt Compounds Like Technical Debt. Refactoring Doesn't Clear It.

Software teams know the shape. Code written fast to hit a deadline looks fine the day it ships. Complexity accrues. The bill arrives later, with interest.

Encryption behaves the same way. Keeping the current scheme costs nothing today, and replacement is inevitable.

Encryption Sits in Every Layer, So Delay Widens the Scope

Servers, networks, databases, authentication, external integrations. Encryption is embedded in all of them. Every month of delay adds dependencies, expands the change surface, and raises the cost of the eventual swap.

One difference separates the two kinds of debt. Technical debt can be refactored away. Quantum debt includes data already collected and already sitting on someone else's disk. When that data is decrypted after Q-Day, the exposure is permanent.

You can refactor technical debt. You cannot un-expose data.

Technical debt raises your future cost. Quantum debt raises your future cost and the irreversible risk of your past at the same time.

Mosca's Inequality: Two of the Three Variables Are Already Yours

The security field uses a simple formula for this.

X is how long your data has to stay protected. Y is how long it takes to migrate your systems to post-quantum cryptography. Z is the time remaining until a quantum computer can break current encryption. If X plus Y exceeds Z, you are already late.

The three are not the same kind of number. Z is unknowable. You can assign probabilities to Q-Day. You cannot fix a date.

X and Y are arithmetic. How long your data has to be protected and how long your migration takes are questions your own organization can answer. There is no reason to wait on Z to start. The uncertainty in Z is the argument for calculating X and Y first.

The Regulatory Clock Already Moved

The US government and the major security standards no longer file this under distant future. CNSA 2.0 and the relevant NIST guidance treat post-quantum migration as a long transition that requires dated schedules and procurement and replacement plans.

Reading your own migration clock matters more than reading the quantum one.

Not All Data Carries the Same Quantum Debt

Applying X and Y to real data sharpens the picture by sector. Add a third input: whether anyone has a reason to take that data today.

So the question is never only whether the data is vulnerable to a quantum computer. It is how long it must be protected, how long the migration will take, and how attractive it is to an attacker right now.

Defense: X Measured in Decades, Y Measured in Legacy

State secrets and military information have to hold for decades, which makes data collected today a natural Harvest Now, Decrypt Later target. Targeting intensity is high, since specific states and organizations pursue it deliberately. Exposure paths are narrow and the risk is still large.

Y is no easier. Defense systems run on long-lived legacy infrastructure, complicated authentication and key management, and heavy interconnection. Wholesale replacement of the encryption layer isn't available. Long X, long Y, high current targeting. This is the first place to look.

Genomics: Sensitivity That Doesn't Decay

Genetic information stays personally sensitive as time passes, so encryption applied today has to hold in the future.

Y is a problem here too. This data is distributed across research institutes, hospitals, pharmaceutical companies, and cloud providers. Determining what is stored where, under which algorithm, is itself the first project. Migration takes substantial time after that. McKinsey grouped healthcare and pharmaceutical data with national security records as data requiring confidentiality for decades, effectively permanently. Both variables are long, which means the plan has to start without knowing Q-Day.

Digital Assets: Quantum Doesn't Read Your Data. It Re-Asks Who Owns It.

Finance takes a different cut. Mosca's Inequality handles protection period and migration time. In finance you also have to ask what collapses when the encryption breaks.

Not all financial data needs to stay secret for decades. But the public-key cryptography behind digital signatures and authentication does more than keep things confidential. It determines who controls the asset. The damage profile matters as much as X and Y, because what breaks is trust in ownership itself.

The exposure has been estimated. Some research puts the amount of Bitcoin with exposed public keys at roughly 7 million BTC.

Applying post-quantum cryptography everywhere at the same speed is not the answer. Start where X is long, Y is large, and current targeting or encryption dependency is high. That is what it looks like to run Mosca's Inequality against a real migration plan.

87% Have a Plan. 7% Have Deployed.

In DigiCert's 2026 survey, 87% of companies had built a transition plan. 7% had actually deployed. The gap between those two numbers is where quantum debt accumulates.

The debt also grows on its own. Every new dataset, every new service wired into the existing encryption scheme adds to it. Many organizations can't yet say where and how encryption is used inside their own systems.

SHA-1 Showed How Long Removal Takes

Deprecating the old hash function taught the lesson once already. Choosing a replacement algorithm and stripping the old one out of operating systems, browsers, servers, certificates, and applications were problems of completely different difficulty. Post-quantum migration works the same way.

Cloudflare Went From 2% to 60% in Two Years

Cloudflare started preparing in 2019 and applied post-quantum encryption to its websites and APIs from 2022. The share of traffic protected by post-quantum methods rose from 2% in early 2024 to the 60% range by February 2026, and the company has published a roadmap to complete the transition by 2029.

They did not move because they were confident about Q-Day. They moved because they knew the migration itself takes years.

Crypto Agility Is the Capability That Pays the Debt Down

None of this means every company replaces every algorithm now. It means sequencing. Know what data you hold, how long it has to be protected, and how long the migration will take.

Then shorten the migration itself. That capability has a name: crypto agility, the structural flexibility to swap cryptographic algorithms quickly.

Changing encryption used to be an exceptional event. From here, new algorithms arriving and old ones being retired should be a baseline assumption in system design. Which algorithm you run today matters less than whether your architecture lets you change it when you have to. That capability slows the rate at which quantum debt accrues and draws down what has already accrued. It can be a competitive advantage on its own.

Startups Get the Cheapest Window

Nobody knows when quantum computers arrive. Data doesn't wait for them. New data is created and encrypted today, and new dependencies attach to existing systems. Some of it has to stay protected for decades.

So the questions come before Q-Day, not after it. How long does our data have to be protected. How long will post-quantum migration take. How much quantum debt are we adding right now.

For startups the questions carry more weight. The systems are still small and the legacy is thin, which makes this the window where encryption architecture and data flows can be designed from the start. Crypto agility that costs one small decision today becomes a multi-year migration project once the company has grown.

You can't control when the quantum computer arrives. You can choose what's standing when it does.

Managing the quantum debt you're accumulating now comes before predicting Q-Day.

About Kakao Ventures

Founded in 2012 and backed by Kakao — Korea's leading tech platform — Kakao Ventures is one of Korea's most active Seed-stage venture capital firms, with approximately $280M USD in AUM. We partner with founders before the path is fully defined, when conviction in people matters more than proof in numbers.

Our portfolio includes Lunit (AI cancer diagnostics), Rebellions (AI semiconductors), and Dunamu (operator of Upbit, one of Asia's largest crypto exchanges).

If you're building at the edge of what's possible — we'd like to hear from you.