Jerry Petersen 
- GDIT’s Matthew McFadden believes U.S. adversaries are already carrying out harvest now, decrypt later operations, in anticipation of Q-Day
- Quantum Sky’s Peter O’Donoghue predicts that Q-Day is near
- Brooks Consulting’s Chuck Brooks and Everforth ECS’ Mark Maglin have offered recommendations on how to prepare for Q-Day
General Dynamics Information Technology’s Matthew McFadden said during a panel at the recent 2026 TechNet Indo-Pacific conference that U.S. adversaries already use quantum technology, and while the sophistication of their capabilities remain unclear, they nevertheless pose threats, Defense One reported Wednesday.
Of particular concern to McFadden is post-quantum cryptography, or PQC, and the challenge of “harvest now, decrypt later,” or HNDL, that accompanies it. According to the GDIT vice president for cyber and division chief information security officer, adversaries may, for some time now, have been collecting data with the aim of breaking their encryption with a quantum computer at some point in the future.
What is Harvest Now, Decrypt Later?
HNDL is a tactic in which adversaries intercept and stockpile encrypted data today, betting that a future cryptographically relevant quantum computer will be able to unlock it. The National Security Agency has warned that threat actors are already conducting such operations, and a Government Accountability Office review found none of 24 federal agencies fully prepared for the shift to quantum-resistant encryption.
What Is Q-Day?
Quantum Sky’s Peter O’Donoghue believes the day when a quantum computer breaks current encryption, known as Q-Day, is near. Speaking to Defense One following McFadden’s panel, O’Donoghue predicted, “Q-Day is going to be a thing that happens…definitely within the next five years.”
When it comes to preparing for that day, Quantum Sky’s chief technology officer does not consider a one-size-fits-all approach practicable and thinks different agencies need to understand the risk relative to their respective contexts. Still, for O’Donoghue, the situation is urgent.
“Like sitting on your hands and going into a kind of analysis paralysis is not the answer. Denying it is definitely not the answer either,” he said.
How Do You Prepare for Q-Day?
Brooks Consulting International President Chuck Brooks shares O’Donoghue’s concern, saying in a recent column on GovCon Wire, “Government agencies, defense contractors, financial institutions, healthcare organizations and critical infrastructure operators should prepare before such a capability becomes practical.”
“Inventorying cryptographic assets, identifying vulnerable algorithm systems, prioritizing sensitive information with long confidentiality requirements and planning for post-quantum cryptography are all necessary,” he recommended.
Brooks, an Executive Mosaic GovCon Expert, went on to say that “quantum technology presents both security and opportunity,” adding, “United States should pursue quantum research and strengthen the cryptographic foundations of digital infrastructure.”
For his part, Mark Maglin of Everforth ECS in June urged federal agencies to begin implementing Automated Cryptographic Discovery and Inventory, or ACDI, architectures, which could help organizations map cryptographic assets and identify high-risk vulnerabilities.
Maglin also recommended that agencies enhance their cryptographic agility by adopting modular cryptographic components, centralizing key management and reducing reliance on hard-coded encryption. He also endorsed the use of hybrid cryptography as a bridge to PQC, combining classical and quantum-resistant algorithms.
Additional steps include modernizing infrastructure to support PQC requirements and engaging vendors on transition planning, procurement requirements and supply chain risk.
Maglin’s suggestions were echoed by McFadden during the TechNet conference.
“It’s hard to migrate when you don’t know what you have. So, really, the first step in this process is really having a comprehensive inventory,” McFadden said, adding, “One of the things you realize pretty fast is like you’re very reliant on third-party providers…you’ve got to really work together with the system owners, the third-party suppliers, your supply chains,” with the aim of building a governance team to facilitate compliance and cryptographic agility.
