Sectigo research reveals that 38% of organizations have now fully assessed systems vulnerable to quantum computing attacks, a substantial increase from 14% in 2025. The 2026 State of Crypto Agility Report, based on a global study of 500 IT and security leaders, demonstrates a shift from awareness to active implementation of post-quantum cryptography initiatives.
Eighty-three percent of organizations have already budgeted for these initiatives, and 93% anticipate increased investment over the next two to three years. “Organizations have moved from asking whether they need to prepare for cryptographic change to confronting what that change actually requires,” said Nick France, CTO at Sectigo.
78% of Leaders Anticipate Significant PKI Changes for Post-Quantum Cryptography
The anticipated shift to post-quantum cryptography will demand substantial changes to existing public key infrastructure (PKI), with 78 percent of IT and security leaders expecting alterations to a great or very great extent. This expectation signals a move beyond theoretical preparation toward recognizing the operational challenges inherent in transitioning foundational security technologies, as organizations grapple with both algorithmic updates and the architectural implications of post-quantum keys and signatures.
Sectigo’s research indicates that adapting PKI is not merely a matter of swapping algorithms but fundamentally rethinking how cryptographic infrastructure is discovered, managed, and adapted across public and private environments, the company says. The need for change extends beyond the algorithms themselves, impacting the very architecture of trust systems.
The report highlights Merkle Tree Certificates (MTCs), currently under development by the Internet Engineering Task Force (IETF), as an example of the architectural considerations underway. However, only 40 percent of respondents familiar with MTCs believe they fully understand the systemic changes required for implementation.
This lack of clarity highlights the complexity of integrating new cryptographic approaches into existing systems, and the need for organizations to proactively assess the impact on their processes and environments. A Sectigo representative stated, “As algorithms, standards and requirements change, organizations need to be able to adapt without turning every cryptographic transition into a major operational event.” Beyond the long-term architectural shifts, organizations are already facing immediate pressures from the need for shorter SSL/TLS certificate lifespans, which further complicates PKI management.
This demand for increased agility is driving investment in automated certificate lifecycle management (CLM) platforms, as companies seek to gain visibility, control and streamlined management of complex cryptographic environments. Sectigo’s data shows a strong financial commitment to these initiatives, with 83 percent of organizations having already allocated budget for quantum-readiness in the coming year. The report frames this evolution as a move away from static cryptographic infrastructure toward a more dynamic and responsive approach.
“PQC is not simply an algorithm swap, and shorter certificate lifespans are not simply a renewal problem,” the representative continued. “We’ve entered a time where organizations can no longer manage cryptography as static infrastructure, yet at the same time, we need to make cryptography itself operationally simple.” This sentiment reflects the desire for a security posture that is both robust against emerging threats and operationally sustainable in the face of constant change.
Organizations have moved from asking whether they need to prepare for cryptographic change to confronting what that change actually requires.
Nick France, CTO at Sectigo
Quantum Attack Assessments & Budget Allocation Rise Among IT Security Leaders
An additional 44 percent report their assessments are largely complete, indicating a broad and rapidly expanding effort to identify potential weaknesses before the advent of scalable quantum computers. That investment is not expected to plateau, with 93 percent of those already budgeting anticipating further increases in spending over the subsequent two to three years. Sectigo’s data reveals a sustained commitment to fortifying defenses against future threats, even as organizations grapple with more immediate challenges.
The report highlights that while post-quantum cryptography represents a long-term architectural shift, the need to adapt to shorter SSL/TLS certificate lifespans is already creating operational pressures. This suggests that while organizations are willing to invest in future-proof solutions, a significant knowledge gap remains regarding the practical implications of adopting these new standards.
Sectigo’s research demonstrates a clear shift in focus, from simply acknowledging the need for cryptographic agility to actively pursuing strategies for achieving it, according to the company. The company notes that organizations are now facing the immediate demands of managing certificates with increasingly short lifespans, requiring robust automation and streamlined processes.
We’ve entered a time where organizations can no longer manage cryptography as static infrastructure, yet at the same time, we need to make cryptography itself boring again.
Nick France, CTO at Sectigo
See today’s quantum computing news on Quantum Zeitgeist for the latest breakthroughs in qubits, hardware, algorithms, and industry deals.
