Sectigo research reveals that 78% of IT and security leaders anticipate substantial changes to Public Key Infrastructure (PKI) to accommodate Post-Quantum Cryptography (PQC). The 2026 State of Crypto Agility Report indicates a shift from awareness to active implementation of cryptographic updates, with vulnerability assessments accelerating; 38% of organizations have now fully assessed systems vulnerable to quantum computing attacks, an increase from 14% in 2025.
“Organizations have moved from asking whether they need to prepare for cryptographic change to confronting what that change actually requires,” said Nick France, CTO at Sectigo, as organizations simultaneously address shorter certificate lifespans and the demands they create.
78% Anticipate PKI Changes for Post-Quantum Cryptography (PQC)
Thirty-eight percent of organizations have now completed a full assessment of systems vulnerable to attacks from quantum computing, a substantial increase from the 14% reporting the same in 2025, indicating a rapidly accelerating focus on identifying cryptographic weaknesses. This surge in vulnerability identification coincides with a broader expectation of significant changes to existing Public Key Infrastructure (PKI) as organizations prepare for post-quantum cryptography (PQC).
The study reveals that 93% of organizations allocating budgets to quantum-readiness initiatives anticipate further increases in PQC investment over the coming two to three years, demonstrating sustained financial commitment beyond initial exploratory phases. The anticipated shifts in PKI are not merely algorithmic replacements, but require a fundamental rethinking of cryptographic management, according to the report.
Eighty-three percent of organizations have allocated budget to quantum-readiness initiatives over the next year, yet implementation is revealing dependencies and operational challenges that grow more critical as the pace of change accelerates. The report explains that PQC is not simply an algorithm swap, and shorter certificate lifespans are not simply a renewal problem, highlighting the complexity of transitioning to quantum-resistant solutions. Both require organizations to rethink how they discover, manage, and adapt the cryptographic infrastructure they depend on, across both public and private PKI environments.
The study also examined familiarity with Merkle Tree Certificates (MTCs), an evolving certificate architecture proposed by the Internet Engineering Task Force (IETF), finding that only 40% of respondents familiar with the technology believe they fully understand the systemic changes required for its implementation. This suggests that while organizations recognize the need for architectural innovation, translating that awareness into actionable plans remains a challenge.
“As algorithms, standards and requirements change, organizations need to be able to adapt without turning every cryptographic transition into a major operational event,” the report adds. The report concludes that the goal is to move beyond simply achieving cryptographic security to making it a consistently reliable and manageable process, stating, “We’ve entered a time where organizations can no longer manage cryptography as static infrastructure, yet at the same time, we need to make cryptography itself boring again.”
Organizations have moved from asking whether they need to prepare for cryptographic change to confronting what that change actually requires.
Nick France, CTO at Sectigo
Shorter SSL/TLS Certificates Drive Automation & Discovery
The operational demands of increasingly short SSL/TLS certificate lifespans are driving rapid gains in cryptographic discovery and automation, according to new data. Sectigo reports that 62 percent of organizations now maintain a complete, up-to-date inventory of public SSL/TLS certificates, a figure more than double the 28 percent reported in 2025, demonstrating a significant acceleration in visibility into deployed cryptographic assets.
This heightened awareness is not merely academic; it’s a direct response to the shrinking validity periods for publicly trusted certificates, which fell from 398 to 200 days in March 2026 and will continue to shorten to 100 days in 2027 and 47 days in 2029. While the transition to post-quantum cryptography (PQC) represents a longer-term architectural shift, the immediate challenge of frequent certificate renewals is already forcing organizations to invest in automation.
Forty percent report having automated systems in place to handle monthly renewals, a substantial increase from 19 percent last year, and 73 percent are planning further investment in certificate-management automation. However, this progress is not translating directly into operational stability, as 61 percent of organizations still experienced a certificate-related outage or incident in the past twelve months, revealing that increased automation does not automatically equate to resilience.
This disconnect between progress and reliability emphasises a central tension in the move toward greater cryptographic agility. The findings suggest that while organizations are investing in the tools and processes needed to manage cryptographic change, architectural constraints and operational dependencies continue to pose significant challenges.
We’ve entered a time where organizations can no longer manage cryptography as static infrastructure, yet at the same time, we need to make cryptography itself boring again.
Nick France, CTO at Sectigo
See today’s quantum computing news on Quantum Zeitgeist for the latest breakthroughs in qubits, hardware, algorithms, and industry deals.
