Harvest Now, Decrypt Later: Why KXCO Took Its Ontologies Private

The rooms are closed

For more than 90 days KXCO ran its ontologies in public. The AI-sector map was pointed at six household names and nothing but public sources, and it followed the dependencies down until all six converged on one firm in Veldhoven that makes the lithography machine every leading-edge AI chip is printed on. The Australia room put the trade between Australia and the United States into one sourced record: the tariffs, the exemptions, the critical minerals, the currency and the 50 largest listed companies, with a source on every claim and the proclamations quoted in their own words. Anyone could open them. Anyone could check a claim against the filing behind it. That was the point, and it was proved.

As of 19 October 2026 both rooms are private. They are still running. The records are still growing. They now serve KXCO and KXCO's clients, and nobody else. Each room carries a request-access form that reaches a person at KXCO, and that person decides. The Round Table Ontology page stays public, because the method is public. The records are not.

This piece explains why, because the reason is not what people assume. It is not that the rooms were too revealing about KXCO. It is that a report Europol published this month says, in plain language, what anybody holding a valuable record should already have worked out: the data you leave online is being collected now, by people who intend to read it later, and the most valuable thing you can leave online is the shape of what you know.

What 90 days in public proved

The method was never in doubt inside KXCO. The question was whether it survived contact with a stranger who did not want to believe it. Both rooms were built so that a stranger could try.

The AI-sector record, as of 17 October 2026, held 447 entities and 1,042 relationships, and 988 of those relationships carried a source anyone could open. The 49 marked derived were KXCO's own readings and said so. The 10 with no source were marked unsourced rather than dressed up. Every link carried its basis, its confidence and the date it took effect, and the weighting over the top of it was mine and was attributed to me rather than presented as a fact. The finding that mattered, that six of the best-known companies in the world rest on a single supplier of extreme ultraviolet lithography, was not in any one filing. It was in the relationships between filings, and the graph laid it out where anyone could read it.

The Australia room, as of 2 October 2026, held 548 entities, 328 claims and 780 links, from 212 sources, 145 of them filed with a government or an exchange. It went up on 1 October and it was public for 18 days. One path in it ran from a mining company to the metal it produces to the proclamation that taxes that metal to the country that levies the tax, and the proclamation link carried the proclamation's own words. Every figure in every finding was checked at build time against the claims it cited, so a finding could not drift from the record under it.

So the method held. A record in which every claim carries its source, its basis, its confidence and its date can be put in front of a hostile reader and it does not fall over. That is the thing KXCO set out to show, and it is shown. The rooms did the job they were built to do, and a demonstration that has done its job does not need to stay on the street.

What Europol said

In October 2026 Europol's European Cybercrime Centre, with University Carlos III of Madrid, published a report titled Harvest now, decrypt later under its Advisory Group on Research and Development. It is 40 pages and it is written for people who run things rather than for cryptographers. Its first key finding is the one to read twice: "The HNDL threat is real. It involves collecting and storing encrypted data today, with the expectation of decrypting it in the future using advanced computational methods or quantum computers. This threat does not require the attacker to have a quantum computer today."

The report sets out the attack in four steps, and the steps are ordinary. First, harvesting: adversaries gather encrypted data, often in bulk, from intercepted communications, data breaches, network traffic or online repositories. Second, storage: the data is kept, hidden, on throwaway cloud accounts, compromised hosts, peer-to-peer networks or physical media. Third, waiting: for an advance in cryptanalysis or for a quantum computer able to run Shor's algorithm against RSA and elliptic-curve keys. Fourth, decryption, which the report says "may happen after years or even decades", followed by fraud, identity theft or espionage with whatever was inside.

Who is at risk is laid out in a table. Citizens are low to medium, because most personal data loses its value, though financial records, medical histories and identity data do not. Companies are medium to high: "Trade secrets, client lists, financial data and sensitive contracts are all high-value assets susceptible to corporate espionage via HNDL." Governments are high: diplomatic cables, intelligence, law enforcement case files, informant identities and critical infrastructure data are "prime targets for state-sponsored actors".

On timing, the report refuses to play the guessing game and then gives the only dates that matter. It notes that NIST's transition report states that classical public-key cryptography "should be phased out by 2035, with today's most common configurations deprecated by 2030", and that the European Commission has issued its own coordinated implementation roadmap. In the United Kingdom the National Cyber Security Centre sets three milestones: by 2028, define your migration goals, carry out a full discovery exercise and build an initial plan; by 2031, complete the early, highest-priority migration activities; by 2035, complete migration of all systems, services and products.

Then comes the part that is about management rather than mathematics, and it is the part most reports leave out. Europol's managerial steps are, in its own order, five. Inventory the cryptography you currently use, because "without a clear map of where cryptography is deployed, planning an upgrade is guesswork". Identify which data carry long-term confidentiality requirements, since health records, classified communications, intellectual property and case files "may well exceed a ten-year sensitivity window".

Reduce the volume of data available to harvest "by applying data minimisation principles: enforcing retention limits, securely deleting data that are no longer needed, and segmenting high-value datasets so that a single point of interception does not expose everything". Keep long-term private keys in hardware security modules. Treat the transition to post-quantum cryptography as a programme rather than a project. The closing line of that section is the one I would put on the wall: "None of these steps requires waiting for a quantum computer to exist."

A graph is the most harvestable thing you own

Here is the connection to the rooms, and it is not the obvious one. Everything in the public rooms was public data. Nothing in them was secret. A harvester who took the whole of the Australia room would have taken 328 claims that were already sitting in the Federal Register, the Australian Bureau of Statistics, the Securities and Exchange Commission and the companies' own websites.

But that is not what they would have taken. They would have taken the relationships. The value of an ontology is not the facts in it. It is the typed, sourced, dated links between the facts, which is the one thing no filing holds and the one thing it costs money and judgement to build. A procurement system knows the suppliers it pays and does not know the suppliers those suppliers pay. A credit book knows the guarantor named on a facility and does not know that the same guarantor has pledged the same collateral to another facility in another book. The concentration lives between the documents. An ontology makes it a fact with sources. That fact is exactly what an adversary wants, because it is the finished intelligence product rather than the raw material.

Now put that beside Europol's stakeholder table. A client's ontology holds trade secrets, client lists, financial data and sensitive contracts, which is Europol's medium-to-high row word for word, and it holds them joined up. It is the single dataset in which "a single point of interception" exposes everything, because exposing the structure is the whole purpose of the thing. A harvested database of invoices is a nuisance. A harvested graph of who depends on whom, who guarantees whom and who permits what is a map of the institution handed to whoever wants to take it apart, and it stays true for years, which puts it squarely inside the ten-year window the report describes.

That is why the public rooms are closed and why no client record has ever been online. The public rooms proved that the method survives a hostile reader. The private rooms are where the method earns its keep, and the first rule of the private rooms is that the record never leaves the estate. KXCO's public line since 18 October is Hold the source. Publish the proof. The source is the record, the method and the private context, and it stays with the institution that owns it. The proof is a signature, a fingerprint, an anchor on a public chain, and that is what gets published, because a proof tells a stranger that a record existed in a given form at a given time without telling them what is in it.

Exhibit 1. Harvest now, decrypt later, as a knowledge graph

The threat reads better as a graph than as a paragraph, so here it is as one, drawn the way the Round Table draws everything: every node labelled, every link numbered, and the claim behind each link listed beneath it with its source. Nothing in the exhibit is KXCO's opinion. The four steps, the targets, the mechanism and the deadlines are Europol's. The two standards are NIST's. The implementation line is ours, and it carries its own evidence page.

A gold ring marks a seed, the two places a reader can start: the adversary at one end and the implementation at the other. The gold centre marks the single point of failure, which is the decryption step, because everything before it is cheap and everything after it is irreversible.

• 1. Adversary collects encrypted data in bulk from Harvest: intercepted traffic, breaches, online repositories. Europol and UC3M, section 2.1, step 1. Source: europol.europa.eu.

• 2. Harvest is followed by Store, hidden, for years. Europol and UC3M, section 2.1, step 2. Source: europol.europa.eu.

• 3. Store is followed by Wait for a cryptographically relevant quantum computer. Europol and UC3M, section 2.1, step 3. Source: europol.europa.eu.

• 4. Wait ends in Decrypt and exploit, after years or decades. Europol and UC3M, section 2.1, step 4. Source: europol.europa.eu.

• 5. Harvest targets Data that keeps its value: health, IP, government, case files. Europol and UC3M, key findings and section 4.2. Source: europol.europa.eu.

• 6. Data that keeps its value is protected today by RSA and ECC key exchange and signatures. Europol and UC3M, executive summary. Source: europol.europa.eu.

• 7. Shor's algorithm breaks RSA and ECC. Europol and UC3M, executive summary and section 2.1. Source: europol.europa.eu.

• 8. NIST deadlines deprecate RSA and ECC configurations by 2030 and phase them out by 2035. Europol and UC3M, section 1.2, citing NIST IR 8547. Source: europol.europa.eu.

• 9. Data minimisation shrinks the pool available to Harvest. Europol and UC3M, section 4.2, third step. Source: europol.europa.eu.

• 10. ML-KEM replaces RSA and ECC for key exchange. NIST FIPS 203, Module-Lattice-Based Key-Encapsulation Mechanism Standard. Source: csrc.nist.gov.

• 11. ML-DSA replaces RSA and ECC for signatures. NIST FIPS 204, Module-Lattice-Based Digital Signature Standard. Source: csrc.nist.gov.

• 12. kxco-post-quantum implements ML-KEM-1024 and ML-KEM-768. KXCO post-quantum packages page, read 19 October 2026. Source: kxco.ai.

• 13. kxco-post-quantum implements ML-DSA-87 and ML-DSA-65. KXCO post-quantum packages page, read 19 October 2026. Source: kxco.ai.

• 14. kxco-pq-scan inventories the estate's cryptography as a CycloneDX cryptography bill of materials, which is Europol's first managerial step. Source: npmjs.com.

How much of you is online

The question Europol's report leaves with the reader is a simple one and most institutions cannot answer it: how much of what you know is sitting on a network, encrypted with a key that will not hold, waiting to be collected? Not how much is secret. How much is there.

Start with what is already public and should not be joined up. A company's filings, its supplier announcements, its executives' speeches, its job advertisements and its litigation are each harmless alone. Put together, they are the graph. The AI-sector room showed that six of the best-known companies on earth could be resolved onto one supplier using nothing but public sources, and if KXCO can do that with public sources, so can anyone with the patience. The lesson is not to stop filing. It is to know that the joined-up version of your public record exists whether or not you built it, and to build it yourself first, inside your own boundary, so that you know what it shows before someone else does.

Then take what is encrypted and online. Europol's technical analysis confirms that TLS, SSH and OpenPGP, as deployed across the internet today, are all susceptible to harvesting, with the risk depending on configuration and key management. Every archived email, every backup in a cloud bucket, every document in a data room, every message between a bank and a client, every signed contract whose signature rests on an elliptic curve, is a candidate. The report's advice for medium-risk organisations is blunt: "Identify and securely delete unnecessary sensitive data. Limit long-term storage of confidential information." The advice for high-risk ones is to disable the old protocols now and start the post-quantum pilots now.

Then take what is not encrypted at all because nobody thought it mattered, which is where the graph lives in most firms. Relationship data is scattered across a customer relationship system, a procurement system, a legal matter list, a spreadsheet of introductions and the memory of three people. None of it is marked confidential. All of it, assembled, is the institution.

The rule KXCO applies to itself and to every client is the one the report arrives at by a different road. Keep the record on the estate, on hardware the institution controls or on hardware KXCO places inside the institution's jurisdiction with the institution holding the keys. Keep the language models outside the record, so that what the institution knows never enters a corpus it does not own. Publish only the proof: a signature anybody can check with a public key, an anchor on a public chain that shows a record existed in a given form no later than a given time, and nothing about what the record contains. Minimise what is online, because what is online is already being collected.

The post-quantum work, on npm

A record that has to stay private for a decade needs signatures and key exchange that will still hold when the keys protecting today's internet do not. KXCO built that part first and put it where anyone can audit it before relying on it.

The cryptography KXCO's products stand on is published as free packages on npm under the Apache-2.0 licence, and the post-quantum packages page lists all 16 of them. The core, kxco-post-quantum, at version 1.11.1 on 16 October 2026 per the npm registry, carries the primitives: ML-DSA-87 and ML-DSA-65 for signatures, ML-KEM-1024 and ML-KEM-768 for key exchange, and SLH-DSA-SHA2-192s, all from NIST FIPS 203, 204 and 205. It makes no network call and needs no account. One install, kxco-pq, brings the whole family.

Three of the packages answer Europol's managerial steps directly. kxco-pq-scan is the inventory: it finds the quantum-vulnerable cryptography already in a JavaScript dependency tree, separates what Shor's algorithm breaks from what it does not, and emits a cryptography bill of materials in CycloneDX format, which is the "clear map of where cryptography is deployed" the report asks for first. It runs today, without an account, with one command:

npx kxco-pq-scan

kxco-pq-vault is the answer for data at rest: file and envelope encryption to one or many recipients using ML-KEM-1024 by default, so that an archive harvested today is encrypted under a key exchange that Shor's algorithm does not touch. kxco-pq-hsm is the answer for keys: ML-DSA keys generated on a hardware security module and marked unextractable, so the private key never exists in process memory, which is Europol's fourth step. For data in transit, kxco-pq-tls runs ML-KEM-1024 key exchange alongside X25519 by default, which is the hybrid approach the report recommends for anyone who has to interoperate with peers that have not moved yet.

The evidence is a document rather than an adjective, and it is at kxco.ai/developers/pqc-evidence with a machine-readable copy anyone can diff against the registry. In NIST's ACVTS demonstration environment, NIST's own server generated and checked 2,130 test cases across ML-KEM, ML-DSA and SLH-DSA, every parameter set NIST offers for each, with zero failures, and issued demonstration certificate A11025 on 13 September 2026. A further 1,793 ACVP vectors passed, 225 interoperability checks against liboqs, Bouncy Castle and two Python implementations passed in both directions, and 33 protocol checks on X.509 and CMS objects issued by OpenSSL passed. The same page lists the claims KXCO does not make, because an evidence page that only accumulates is not evidence: the library is not FIPS 140-3 validated, it holds no CAVP validation, the JavaScript backend is not claimed constant-time, and no third party has audited it.

KXCO's recommendation for any new key is ML-DSA-87, the Category 5 parameter set, and the reasoning is published rather than asserted. The platform's own published signing key is ML-DSA-87. KXCO Armature, the public record the products anchor to, checks ML-DSA-87 and ML-DSA-65 signatures on chain and attests each finalised block with ML-DSA-87, and an independent verifier, kxco-verify, checks a KXCO signature on a reader's own machine with no call to any KXCO server. Every article on Live Trading News is signed by a human editor with ML-DSA-65 and anchored on Armature, which is the proof half of the rule applied to this page.

What to do this quarter

Europol's report ends with recommendations by stakeholder, and they are short enough to act on. Low-risk: strong unique passwords, multi-factor authentication, keep devices updated so that vendors' post-quantum upgrades arrive. Medium-risk: move to TLS 1.3 and SSH2, disable legacy protocols, enforce forward secrecy, delete what you do not need, limit long-term storage, and start exploring post-quantum options including hybrid ones. High-risk: disable TLS 1.0 and 1.1 now, prioritise post-quantum cryptography in critical infrastructure starting with pilots, and run a coordinated migration strategy with funding, standards and training behind it.

KXCO's version for an institution that holds a record worth keeping is five steps, in the order they pay.

• Run the inventory. One command on the JavaScript estate gives the cryptography bill of materials, and KXCO Portcullis takes the same survey across the rest of it and blocks a release on a critical finding by default.

• Name the data that must stay secret for 10 years. Europol's categories are a start: health, intellectual property, government communications, case files, and the relationship graph that nobody has marked confidential because nobody has drawn it.

• Cut what is online. Retention limits, deletion, segmentation, and the record itself kept on the estate rather than in anybody's cloud.

• Re-key what has to last. New signatures on ML-DSA-87, archives under ML-KEM-1024, long-term keys in hardware, and a hybrid key exchange on the wire until every peer has moved.

• Build the graph inside the boundary before somebody builds it outside. A first deployment with KXCO is always a sandbox and a discovery: the institution brings an extract of its own records and a question it cannot answer today, Round Table runs inside the estate, and nothing is connected to a live system until two named people decide it should be.

None of this waits for a quantum computer. The harvesting does not wait either, which is the whole of Europol's point and the reason the public rooms closed.

The next fact to watch is the NCSC's 2028 milestone, by which every institution in its remit is expected to have finished discovery and written its migration plan. Any record still online under today's keys on that date will have been in the harvest for two more years than it needed to be.

Shayne Heffernan, Ph.D., is the founder of the KnightsBridge Group (shayneheffernan.com).