Key takeaways
- Post-quantum readiness has moved from awareness to implementation.
- Shorter certificate lifespans are already creating operational pressure.
- Organisations need visibility, automation and governance across their cryptographic estate.
Sectigo has released its 2026 State of Crypto Agility Report, finding that 78% of IT and security leaders believe today’s public key infrastructure will need to change to a great or very great extent to support post-quantum cryptography.
The global study of 500 senior IT and cybersecurity decision-makers found that 38% have fully assessed systems vulnerable to quantum-computing attacks, up from 14% in 2025, while another 44% said their assessment was mostly complete.
Some 83% have budget allocated to quantum-readiness initiatives over the next year and, among those with allocated budgets, 93% expect investment in post-quantum cryptography to increase over the next two to three years.
“PQC is not simply an algorithm swap.”
Nick France, CTO at Sectigo
Nick France, CTO at Sectigo, said: “Organizations have moved from asking whether they need to prepare for cryptographic change to confronting what that change actually requires. PQC is not simply an algorithm swap, and shorter certificate lifespans are not simply a renewal problem.”
Shorter certificate lifespans
The maximum validity period for publicly trusted SSL/TLS certificates fell from 398 to 200 days in March 2026 and is scheduled to reach 100 days in March 2027. The report found that 61% of respondents had experienced a certificate incident in the previous year.
Sectigo said crypto agility depends on organisations being able to discover, manage and adapt the cryptographic infrastructure they rely on across public and private PKI environments.
