Right now, someone could be recording your company’s encrypted network traffic. They cannot read it yet. That is actually the whole point. Adversaries are collecting scrambled data today and just storing it until quantum computers get strong enough to crack it open. Eddy Zervigon, CEO of Quantum XChange, has spent the last several years warning pretty much anyone who will listen that this threat is already live. His company just won a 2026 Fortress Cybersecurity Award in the Quantum Security category, and honestly, the timing could not be better.
[YOUTUBE SHORT EMBED: Harvest Now, Decrypt Later Explained | Quantum XChange - riverside_copy_of understanding the 'harvest now, decrypt l_winners'_circle.mp4]
The Clock Is Already Running on Harvest Now, Decrypt Later
The attack has a name that sounds almost polite: harvest now, decrypt later. Bad actors intercept encrypted transmissions today, knowing they really cannot open them yet. So they wait. Zervigon calls it one of two threats a cryptographically relevant quantum computer creates, and frankly, he thinks the second one is scarier. A man in the middle attack would let an adversary sit inside a live transmission, spoof an identity, and actually change the data moving across the network. Think oil pipeline pressure readings, or a big buy order that just flipped to a sell order.
The timelines are moving too. Zervigon told the House Homeland Security Committee late last year that conventional wisdom had shifted from 2035 to within the decade, with Google and IBM basically agreeing. The latest Global Risk Institute quantum threat report puts expert odds of a code-breaking quantum machine appearing within ten years at up to 49 percent, which is honestly the highest estimate in the report’s history.
[YOUTUBE SHORT EMBED: Quantum Computing's Accelerating Timelines | Quantum XChange - riverside_copy_of quantum computing's accelerating timelines_winners'_circle.mp4]
Fifty Years of Encryption Are Running Out of Road
For roughly five decades, three algorithm families have guarded nearly everything we do online. Diffie-Hellman, RSA, and ECC worked beautifully, in large part thanks to Moore’s Law letting defenders stay just ahead of attackers. Quantum computing flips that math completely. Calculations that would take a classical machine thousands of years suddenly become very quick work.
NIST finalized its first post-quantum cryptography standards in August 2024 and is still evaluating dozens more. Zervigon likes to point out that NIST actually has another 45 algorithms under review, and it is not, in his telling, a sign they hit it out of the park with the first one. Some very promising candidates were broken with plain old classical computers during final peer review. So betting your entire security posture on any single algorithm seems like a rather risky wager.
Two-Factor Authentication for Your Encryption Keys
Quantum XChange’s answer, Phio TX, is actually refreshingly simple to explain. For fifty years, encryption keys and data traveled together on the same line, which basically handed attackers a single target. Phio TX separates key generation and delivery from the data plane and puts keys in their own completely out-of-band control channel. Zervigon compares it to two-factor authentication for encryption keys, and honestly, the analogy lands. The six-digit code on your phone really is not what makes 2FA effective. It is the fact that authentication happens out of band, so the attacker suddenly has to crack two planes instead of one.
An intercepted transmission becomes pretty much useless when the keys were never on that line in the first place. The platform deploys as an overlay on existing network gear, typically in days, with no downtime and no rip and replace. Phio TX now holds both FIPS 140-3 and FIPS 203 validations at the same time, which is currently a market first. Federal agencies, including work with Customs and Border Protection, are clearly taking notice.
[YOUTUBE SHORT EMBED: Two-Factor Authentication for Encryption | Quantum XChange - riverside_copy_of two-factor authentication for encryption _winners'_circle.mp4]
Crypto Agility Beats Picking the Perfect Algorithm
Here is the part that really separates Zervigon’s thinking from the standard industry playbook. Most vendors basically frame quantum readiness as an algorithm swap. Zervigon says that is solving the wrong problem, and frankly the data backs him up. A DigiCert survey found only 5 percent of enterprises actually have quantum-safe encryption deployed. IBM’s readiness index scored the average organization at just 25 out of 100.
Standards will keep changing, key sizes will keep growing, and nobody wants to bring down a production network every single time NIST updates a recommendation. Crypto agility means the architecture can swap algorithms on the fly, literally without dropping a single encrypted tunnel or touching an application. Zervigon’s demos show algorithm changes happening live, which frankly makes the point better than any slide deck could. In his congressional testimony he put it pretty plainly: you cannot achieve innovative results on legacy timelines.
[YOUTUBE SHORT EMBED: Architecture Over Math in Cybersecurity | Quantum XChange - riverside_copy_of architecture over math in cybersecurity_winners'_circle.mp4]
Jumping in the Water
So where does a CISO actually start? Zervigon’s advice is really quite concrete: take your biggest, fattest pipe carrying your most sensitive data and start locking it down. Securing the network layer first captures the vast majority of the threat surface at a very reasonable cost. He basically compares waiting for a perfect application-by-application migration to buying a biometric safe for your jewelry before locking the front door.
[YOUTUBE SHORT EMBED: Biometric Safe vs Door Security | Quantum XChange - riverside_copy_of biometric safe vs door security_winners'_circle.mp4]
The math on timing is simple and honestly a little uncomfortable. If a code-breaking quantum computer shows up in three years, anything you need to keep secret for more than three years is exposed right now. Post-quantum cryptography migration tends to take years, so the starting gun matters. For organizations holding decades of sensitive records, we are pretty much past the comfortable starting point. The generalized federal deadline sits around 2030 for the most critical systems, which sounds far away yet really is not.
Quantum XChange spent years building for a moment the rest of the market is only now acknowledging. That is sort of the definition of foresight, and it is exactly the kind of work the Fortress Cybersecurity Awards were created to recognize.
Enjoying insights from industry leaders? Subscribe to The Winners’ Circle podcast on your favorite podcast player and never miss an episode. Listen and subscribe at bintelligence.com/podcast.