A fiber optic link can be tapped without being cut, without triggering an alarm, and without degrading the connection in any way a standard monitoring dashboard would notice. That’s not a hypothetical — it’s a documented capability using ordinary, commercially available telecom hardware. The harder question, and the one most comparisons of encryption, post-quantum cryptography, and physical-layer security skip past, is which of those defenses actually stops the interception itself, versus which ones only affect what happens to the data afterward. This guide breaks that distinction down and compares where each major approach actually sits.
What a fiber tap requires, in practice
The equipment involved is a clip-on optical coupler — typically a fused biconical taper coupler or a bend coupler, both standard components in the fiber-optics supply chain rather than specialized attack tools. A bend coupler works by bending an exposed section of fiber past the point where the cladding fully contains the transmitted light, letting a small fraction escape onto a photodetector. VIAVI Solutions’ technical overview of fiber tapping documents this exact mechanism and notes that it can be performed without visibly disrupting the active link.
That last detail is what makes this attack class difficult to catch. The insertion loss from a well-executed tap is small enough to sit inside the margin most fiber links already carry for ordinary connector wear and cable aging. Uptime and power-level monitoring, which is what most operators rely on, is built to catch outages and degradation — not a small, deliberate, engineered loss designed to look exactly like both.
What happens after a tap succeeds
A successful tap doesn’t hand the attacker plaintext. It hands them a real-time copy of whatever was traveling across that fiber — usually AES-encrypted ciphertext, alongside the key exchange that established the session. That distinction matters because of how the two halves of modern encryption respond differently to quantum computing.
NIST’s FAQ on post-quantum cryptography concludes that Grover’s algorithm offers a quantum computer only a modest advantage against AES, and expects AES-256 to remain secure for the foreseeable future. The exposure sits elsewhere: Shor’s algorithm can efficiently solve the mathematical problems behind RSA and ECDH, the asymmetric methods most systems use to establish that session key in the first place. A capable enough quantum computer doesn’t decrypt the AES payload directly — it breaks the handshake that protected the key, recovers the key, and only then decrypts everything that was recorded under it.
This is the mechanism behind harvest-now-decrypt-later (HNDL): capture the encrypted traffic and its key exchange today, wait for quantum capability to catch up, decrypt later. Forecasts on timing vary and shouldn’t be taken as settled, but they converge on a range of years rather than decades — which matters for any data that needs to stay confidential longer than that.
Do you know Why Encrypted Isn’t the Same as Safe on a Fiber Network? It’s a useful companion explanation of why that gap exists even on links that are already encrypted end to end.
Where each existing defense actually sits
Mapping the available approaches against two separate questions — does it stop the tap from capturing anything, and does it stop a captured recording from eventually being decrypted — clarifies a lot of otherwise-confusing vendor positioning.
Post-quantum cryptography (PQC) and quantum key distribution (QKD) both strengthen the key exchange itself, making it harder for a future quantum computer to recover the session key from a recorded handshake. Neither one stops the tap. The signal is still a coherent, capturable waveform; PQC and QKD just make what’s captured harder to eventually decrypt.
Layer-1 optical encryption — the category that includes products from Ciena and PacketLight Networks — encrypts the signal at the physical layer, which is a genuine improvement over transmitting plaintext. But the resulting signal remains a structured, recordable waveform. A tap still succeeds; what it captures is simply ciphertext instead of cleartext, which still feeds directly into the harvest-now-decrypt-later scenario above.
Physical-layer approaches, the category CyberRidge’s Carmel platform belongs to, target the capture step directly: rather than encrypting the signal further, they aim to strip it of the coherent structure a coupler would need to reconstruct anything usable. This doesn’t replace PQC, QKD, or Layer-1 encryption — CyberRidge is explicit that those remain necessary for securing the key exchange — but it addresses a step none of them touch.
For a closer look at how that capture-versus-decryption distinction plays out once quantum timelines enter the picture, Harvest Now, Decrypt Later: The Quiet Threat to Encrypted Data covers it well.
Carmel, Ciena, and PacketLight compared
The table below compares CyberRidge’s Carmel platform against two established Layer-1 optical encryption vendors, Ciena and PacketLight Networks, across the questions that actually determine whether a tapped link stays exposed.
| Question | Ciena (WaveLogic Encryption) | PacketLight Networks | CyberRidge (Carmel) |
|---|---|---|---|
| What does a clip-on coupler capture? | A complete copy of the encrypted optical signal | A complete copy of the encrypted optical signal | Incoherent optical noise, not a usable signal |
| Is the captured signal recordable and storable? | Yes — it’s a coherent, structured waveform | Yes — it’s a coherent, structured waveform | No coherent signal exists to record |
| Does interception require cutting the fiber? | No — passive tapping is sufficient | No — passive tapping is sufficient | No — tapping is equally easy, but the tap yields nothing recordable |
| Does it close the harvest-now-decrypt-later gap? | No — recorded ciphertext remains a future decryption target | No — recorded ciphertext remains a future decryption target | Yes, for the recording itself — nothing usable was captured to begin with |
| Basis of protection | Cryptographic encryption of the optical signal | Cryptographic encryption of the optical signal | Physical alteration of the transmitted light at Layer 1 |
Bottom line
If your fiber links carry data that needs to stay confidential for years, treating encryption as a complete answer skips over a real gap: encryption-based approaches, PQC, and QKD all still leave a recordable, storable signal sitting on the wire for anyone with a clip-on coupler. Closing that specific gap requires a physical-layer approach in addition to, not instead of, a strong key exchange. Evaluate vendors on which half of the problem they actually solve, because right now, most of the market solves only one.
FAQ
Q: Can a fiber optic cable really be tapped without cutting it?
A: Yes. Fused biconical taper couplers and bend couplers extract a small percentage of the light traveling through an intact fiber, and are standard, commercially available telecom components rather than specialized equipment. The fiber is never severed and the link continues carrying live traffic throughout.
Q: Does upgrading to post-quantum encryption stop this kind of interception?
A: No. Post-quantum cryptography strengthens the key exchange so a future quantum computer has a harder time breaking it, but it doesn’t change whether a tap can capture the signal in the first place. The signal remains a coherent, recordable waveform either way.
Q: What does CyberRidge’s Carmel platform do differently from Layer-1 optical encryption?
A: Layer-1 optical encryption, offered by vendors like Ciena and PacketLight Networks, encrypts the signal but leaves it as a structured, recordable waveform. Carmel instead alters the physical structure of the transmitted light so that a tap captures incoherent noise rather than a usable data stream, addressing the recording problem rather than the encryption problem.
Q: Is CyberRidge’s approach a replacement for PQC or QKD?
A: No, and CyberRidge doesn’t position it that way. Post-quantum cryptography and quantum key distribution secure the key exchange; Carmel is designed to complement both by addressing whether anything usable can be captured and stored in the first place.