Forescout published adoption data showing nearly 90% of SSH servers on the internet lack post-quantum key exchange. The number circulated widely. So did a fair question from practitioners: what is the actual threat? An internet-facing medical device has bigger problems than its key exchange algorithm. Why would anyone care whether it supports PQC?
The question deserves a direct answer. There are three distinct threat categories in the quantum discussion. They have different clocks. The deadlines target the one whose clock is already running.
Recorded sessions
Key exchange algorithms like ECDH protect a session key with a math problem. A quantum computer running Shor's algorithm solves that problem. An adversary who records a full session today, handshake included, can hold the ciphertext until such a machine exists, recover the session key, and read the traffic.
This is the harvest now, decrypt later threat, usually shortened to HNDL. Its defining property is that the attack begins at recording time. The recording is happening now or it is not, and a defender cannot tell which. Every classical session on the wire today is potentially in an adversary's queue.
Who records at this scale is a narrow set. Bulk collection and decade-long storage is a state capability, and the states with that capability are the same ones already documented inside critical infrastructure networks. For an actor with established access, recording ciphertext is the cheapest thing it does all day.
What the sessions carry
What matters for prioritization is the shelf life of the session contents. The harder the contents are to rotate after exposure, the more the recording is worth. A card number expires on its own. A face never changes. Passwords should sit at the easy end of that scale. On embedded fleets they ship hard-coded and rotate never, so they behave like the things that cannot be changed.
An honest reading of operational networks says many sessions carry nothing worth a decade of storage. A command channel moving setpoints and status has a shelf life of hours. For those devices the recording threat genuinely ranks low, and adoption percentages that skip this distinction overstate the problem.
Two kinds of operational traffic survive the cut. The first is engineering transfers. Controller programs and batch recipes are process intellectual property, they move over SCP and SFTP during commissioning and backup, and they stay valuable as long as the process runs. The second is the authentication itself, wherever password login is still in use.
The bigger correction is direction. The question is usually framed as what gets pushed to the device, and little of value gets pushed to a sensor. The sensor's whole job is sending long-lived data back. A security camera produces faces and gait, which nobody can rotate, along with facility layouts and patterns of movement that stay useful for years. A medical imaging device streams patient data the same way. Process telemetry flowing uplink tells a competitor how the plant actually runs. The value of these recordings does not depend on hygiene failures like an unrotated password. The content is sensitive by nature.
Broken authentication
Signatures are the second category. A quantum computer can forge a classical signature and impersonate a server or sign a malicious firmware update. But forgery only works at attack time. The machine has to exist when the impersonation happens. Nothing recorded today makes this attack easier later.
This is why every major deadline framework puts key exchange first and signatures second. CNSA 2.0 requires post-quantum key exchange by 2030 and gives signatures until 2035. The ordering is the threat model. Confidentiality is exposed retroactively. Authentication is exposed only in the present.
Static keys
There is a worse version of the first category. TLS 1.2 with RSA key transport has no forward secrecy. The session key is encrypted directly under the server's long-term RSA key. Break that one key in the future and every recorded session under it opens at once. Ephemeral key exchange at least forces an adversary to attack each recorded session separately. Static RSA key exchange concentrates an entire recorded history into a single factorization.
Hosts still negotiating RSA key exchange today belong in a separate category from hosts on classical ECDH. A letter grade understates the distance between them.
The clock
None of this requires a prediction about when a cryptographically relevant quantum computer arrives. The regulatory deadlines exist because migration takes years and the recording window is already open. The binding constraint is how long your migration takes measured against 2030. The arrival date of the machine is secondary.
Hub and spoke
Sensors that cannot run post-quantum key exchange get a standard fix. Terminate their streams at a hub that can, such as a video recorder or a protocol gateway, and run the protected exchange from the hub outward. This is the right migration pattern for constrained devices, and it carries one honest caveat: aggregation concentrates the target. The hub's uplink carries every camera at once. Record that single link classical today and one future decryption opens the whole estate.
Two consequences follow. The hub's negotiated key exchange becomes the highest-leverage measurement on the network, worth verifying every scan. And the spoke legs between sensor and hub stay classical, recordable by an adversary who already holds a position inside the perimeter. Count that traffic as unmigrated, and treat the hub as a bridge while vendor firmware catches up.
What to measure
The threat operates on negotiated sessions. Capability figures, such as counting servers on an OpenSSH version that enables PQC by default, tell you what a host could negotiate. Recorded traffic reflects what it did negotiate. A host can advertise ML-KEM and still complete classical handshakes all day, because the outcome depends on the client and on everything between the client and the server.
The defensible measurement is negotiated key exchange, observed per session, tracked over time against the deadline. That trajectory is what [PQ]probe measures. The recording threat ends when the negotiated key exchange changes, and at no point before.