Anticipatory collection

The attack is passive, silent and undetectable, since nothing is broken and the victim generally never learns the copy exists. Its insurance reach belongs to this risk alone and has no equivalent: for a whole category of data the triggering fact has already occurred. Exfiltration took place, under a policy written years ago, it produced no observable damage, and it will produce damage a decade later. No other cyber exposure has this structure, in which the event, its discovery and the loss are separated by ten years or more. Quantum risk is therefore not a cyber risk in the sense the market gives that word, it is a long-tail risk disguised as a cyber risk, and development length is precisely what puts insurers in difficulty. Not to be confused with ordinary exfiltration, whose victim suffers the damage as soon as the data is published or sold: here, the stolen data stays unreadable until a quantum computer can decrypt it. Where the word appears: in no policy today; in the guidance of security agencies, and the contractual question it raises is the date of the triggering event under a claims-made policy.