Critical infrastructure operators across energy, water, manufacturing, and transportation sectors are signing post-quantum cryptography readiness attestations they cannot operationalize; the tooling to assess or implement PQC in OT environments does not yet exist at the required scale or maturity. Nation-state threat actors documented with capability to target OT networks, including those assessed to have conducted reconnaissance on critical infrastructure, are engaging in ‘harvest now, decrypt later’ campaigns against OT networks, exfiltrating encrypted operational data for future decryption once cryptographically relevant quantum computers become available. The business risk is a compliance posture built on attestations that exceed operational capability, combined with a live data exfiltration threat with a delayed but high-consequence detonation profile.