What are the limitations of cryptography in securing data?

Cryptography protects data only as long as the keys, the implementation, and the people who touch it stay trustworthy. It can't do anything once any of those three fail: even the strongest cipher doesn't stop someone from mistyping a permission, handing over a password through a phishing email, or misusing legitimate access to already-decrypted data.

Where does cryptography hold up?

Ciphers like AES-256 make brute-force attacks on encrypted data infeasible with current computing power, and algorithms such as RSA and elliptic-curve cryptography make key exchange practical over open networks. As long as keys stay private and the implementation is correct, encrypted data resists interception in transit and theft at rest.

Where does it fall short?

Cryptography can't stop insider misuse, social engineering, or bugs in how a system handles keys before or after encryption. Data is only protected while it's actually encrypted, and every application has moments where it sits in plaintext: in memory, in logs, or right after a user decrypts it. Poor key management undermines even correct algorithms; a leaked private key or a weak password protecting it defeats AES-256 as easily as no encryption at all. Quantum computing adds a longer-term limitation. Algorithms based on factoring and discrete logarithms, including RSA and elliptic-curve cryptography, are vulnerable to a sufficiently capable quantum computer, which is why NIST finalized its first post-quantum standards, ML-KEM and ML-DSA, in August 2024. Some adversaries already practice harvest now, decrypt later, storing encrypted traffic today to decrypt once that hardware exists.

What does this mean in practice?

Treat cryptography as one control among several, not a complete security strategy. It needs to sit alongside access controls, monitoring, and key management practices that limit how much damage a single leaked key or careless employee can do. Teams handling long-lived sensitive data are also starting to evaluate a migration path to post-quantum algorithms rather than waiting for a forcing event.