A stolen password can be reset. A compromised laptop can be replaced. Intellectual property is harder to recover. Once source code, engineering data, product designs or confidential research reaches the wrong party, the commercial damage may continue for years.
That unusually long lifespan changes the security question. An encrypted file captured today could remain valuable long after the project has finished. Attackers may store protected information in the hope that future computing capabilities will make it readable later.
This is why quantum security deserves attention before a cryptographically relevant quantum computer exists. NIST refers to the threat as "harvest now, decrypt later". Information is collected while it is still encrypted, retained and targeted again when stronger computing methods become available.
The phrase "quantum-proof" is often used as convenient shorthand. "Quantum-resistant" is usually more precise. No responsible security programme should promise immunity from every present or future attack. The practical aim is to remove avoidable dependencies on vulnerable cryptography while reducing the amount of useful information exposed through any single compromise.
Intellectual property may need to remain confidential for decades
A short-lived password and a confidential aircraft design do not have the same protection period. The password may lose its value within weeks. A technical drawing, manufacturing process or pharmaceutical formula could remain commercially sensitive for twenty years or more.
Organisations should therefore compare three periods: how long the information must remain confidential, how long migration to stronger protection will take and when a practical quantum threat could emerge. Nobody can state the final date with certainty. That uncertainty is a reason to prepare, rather than a reason to wait.
A useful risk test
Confidentiality lifetime + migration time should be considered against the possible arrival of a cryptographically relevant quantum computer.
If valuable information must remain secret beyond the expected life of its current protection, the risk already exists.
The UK's National Cyber Security Centre recommends completing discovery and an initial migration plan by 2028, conducting the highest-priority migration work by 2031 and working towards full migration by 2035. These dates turn quantum readiness into a manageable technology programme rather than an undefined future concern.
Perfect secrecy does not depend on an attacker's computing power
Most encryption provides computational security. Breaking it would require an impractical amount of time or processing power using known methods. Advances in algorithms or computing can alter that calculation.
Perfect secrecy is a stricter mathematical property. A ciphertext reveals no useful information about the original message, even if the attacker has unlimited computing power. The classic example is the one-time pad, provided its key is genuinely random, at least as long as the message, kept completely secret and never reused.
Those conditions are demanding. Generating, distributing and protecting a unique key equal in size to every message is difficult at business scale. Key reuse also destroys the security property. Perfect secrecy should not be used as a loose synonym for powerful encryption or a general label applied to any fragmented file.
Post-quantum algorithms are designed around mathematical problems believed to be difficult for both classical and quantum computers. Perfect secrecy is information-theoretic and does not rely on the attack being computationally difficult.
Public-key systems face the most direct quantum challenge
Quantum risk is sometimes described as though every encryption method will fail at once. The picture is more specific. Public-key cryptography, including widely used approaches based on integer factorisation and elliptic curves, faces the clearest threat from a sufficiently capable quantum computer.
Symmetric encryption is affected differently. The NCSC states that established symmetric algorithms with suitable key sizes, including AES, are not significantly affected in the same way. The priority is replacing vulnerable public-key methods used for key establishment and digital signatures, while preserving strong symmetric protection.
NIST finalised its first three principal post-quantum standards in August 2024. They cover key establishment and digital signatures, and organisations are encouraged to begin transitioning. This work will affect browsers, operating systems, network protocols, applications, certificates, hardware and supplier services. It cannot be completed through one software purchase.
Businesses reviewing encrypted file-sharing controls should ask how keys are established, which algorithms are used, what the supplier's post-quantum roadmap looks like and whether the service can adapt as standards develop.
ASR changes how a complete business file is retained
My MX Data uses ASR, which stands for Anonymise, Shard and Restore, as an additional method of protecting sensitive information. ASR transforms the data so the original content is not recognisable, separates it into protected shards and restores the file for an authorised recipient.
An isolated shard does not contain the complete readable document or enough business context to reconstruct it independently. The approach reduces reliance on retaining one complete, readable file in a single location.
The diagram below shows why an individual fragment has limited value when separated from the wider restoration process.
An isolated shard does not provide the complete original file
The authorised restoration process requires the protected fragments to be brought back together correctly.
ASR is separate from standard encryption and should not be described as another name for it. It should also not be confused with a formal proof of perfect secrecy unless the complete implementation has been independently shown to meet that exact mathematical definition.
Its practical value sits within defence in depth. Encryption protects relevant stages of storage and transfer. Sharding reduces the information held in one place. Named-recipient access, multi-factor authentication and permissions restrict who can request restoration. Audit records provide evidence of access and activity.
Intellectual property is often most exposed while moving between organisations
Engineering data, software packages and confidential research frequently pass through customers, suppliers, advisers and project partners. Encryption at rest cannot correct an open public link, an inaccurate recipient or access that remains available after a contract ends.
MX is designed for controlled B2B file exchange. Files can be restricted to named recipients, protected through multi-factor authentication and made available under defined access conditions. Detailed transaction records help administrators establish whether information was accessed or downloaded.
This distinguishes a controlled business file exchange from general cloud storage. Storage and live collaboration platforms serve valuable purposes, but sensitive transfers may require closer oversight of the recipient, availability period and evidence retained afterwards.
| Preparation area | Question to answer | Practical action |
|---|---|---|
| Information lifetime | Which intellectual property must remain confidential for ten, twenty or thirty years? | Prioritise long-life design, research, software and trade-secret material. |
| Cryptographic inventory | Where does the organisation depend on vulnerable public-key cryptography? | Map applications, certificates, protocols, hardware and supplier services. |
| Crypto-agility | Can algorithms and certificates be changed without replacing the full system? | Include migration support in architecture and procurement decisions. |
| File exchange | Can a complete readable file be obtained through one compromised link or account? | Use named recipients, strong authentication, expiry and layered data protection. |
| Supplier readiness | What are technology providers doing about post-quantum standards? | Request roadmaps, supported algorithms and realistic migration dates. |
Quantum readiness starts with the information you already hold
Begin by identifying intellectual property with a long confidentiality lifetime. Trace where it is stored, how it is transferred and which external parties can receive it. Then document the cryptography and identity controls protecting each stage.
The exercise will expose useful improvements even before post-quantum migration is complete. Public links can be replaced with named access. Expiry settings can close forgotten exchanges. Stronger authentication can protect recipient accounts. ASR can provide another layer for highly sensitive files. Audit records can make activity easier to investigate.
No single control makes intellectual property immune to attack. A credible strategy combines current security hygiene, post-quantum planning, adaptable cryptography and tighter control over every external file exchange. The files worth stealing in ten years are often the same files being shared today.
