Over half of top websites now use post quantum key exchange, but the real picture is less rosy

[Woven Sarah]

F5 Labs has found that 54% of the world's top one million websites now support post quantum key exchange, CSO Online reports. That sounds like great progress. The catch is that much of it comes from content delivery networks switching it on by default. Leave out sites hosted on Cloudflare and the figure drops to 22%

Some sectors lag further behind. Only 35% of government and telecoms sites supported post quantum key exchange. More than one site in ten still did not support TLS 1.3, which post quantum key exchange needs. A KPMG survey from June found that 27% of security chiefs were actively implementing post quantum cryptography

The study only looked at public front ends. It did not cover origin servers, internal APIs, VPNs, SSH, code signing or traffic inside organisations. Those hidden areas may be more exposed to harvest now, decrypt later attacks than the public websites are. So the 54% figure measures the easiest part of the job

There are other complications. NIST finalised its first post quantum standards in 2024, but the IETF only published the hybrid post quantum TLS 1.3 key exchange standard in August 2026. Post quantum certificates are not yet available for the public internet, and certificate lifetimes are shrinking towards 47 days, which will strain anyone still doing renewals by hand. F5's David Warburton said 54% sounds like we are halfway to a quantum safe web, but people need to be clear about what is being measured

The expert advice is familiar. Build a cryptographic inventory, keep a cryptographic bill of materials up to date, use hybrid post quantum methods where possible and automate certificate management. Warburton put it simply, saying someone has to own the process of keeping the inventory current. Deloitte's Anastazija Pažin pointed out that CDN enabled post quantum protection does protect the link between the user and the edge, which is still worth having

Is the 54% figure good news or misleading? And are you seeing any post quantum work happening behind the scenes where you work?

Growing PQC at the edge belies deeper quantum-readiness challengeswww.csoonline.com