Research & Data
The State of Post-Quantum Readiness in 2026: We Externally Scanned 100 Major Organizations
We externally scanned 100 major organizations' TLS in 2026: 100% of certificates use quantum-vulnerable RSA/ECC, and 6% still allow deprecated TLS.
The State of Post-Quantum Readiness in 2026: We Externally Scanned 100 Major Organizations
Every encrypted connection on the public web today depends on cryptography that a future quantum computer is expected to break. To see what that looks like in practice — not in theory — we ran CipherReady's external, metadata-only readiness scan against the public-facing TLS of 100 large organizations across five sectors in June 2026. The single clearest finding: of the 95 organizations presenting a readable certificate, 100% used quantum-vulnerable public-key cryptography (RSA or ECC). Not most. All of them.
That is not an indictment of any one organization. It is the industry baseline — and it is exactly why building a cryptographic inventory is the first step every security team needs to take.
How we measured this
We assessed the apex domain of 100 well-known organizations — 20 each in financial services, healthcare, government, technology/SaaS, and retail/consumer. The assessment is external and metadata-only: the same kind of passive observation a web browser, a search-engine crawler, or a tool like Qualys SSL Labs performs. We complete a TLS handshake to read the certificate and the supported protocol versions, resolve DNS, and read the public HTTP security headers. There is no authentication, no intrusive testing, and no exploitation of any kind.
We report only aggregate, anonymized statistics — no individual organization is named or scored. Of the 100 domains, 96 were reachable over HTTPS and 95 presented a certificate we could read. The percentages below use those reachable/cert-bearing hosts as the denominator.
Want this picture for your own domains? Run a free CipherReady readiness scan and get a cryptographic inventory of your public TLS, certificates, and algorithms in about 3 minutes — the same external, metadata-only method, on the domains you own.
Finding 1: 100% of certificates rely on quantum-vulnerable cryptography
Across all 95 readable certificates, every single one used RSA or ECC — roughly 71% RSA and 29% ECC. Both are public-key algorithms whose security rests on math (integer factorization for RSA, discrete logarithms for ECC) that Shor's algorithm solves efficiently on a cryptographically relevant quantum computer (CRQC). Larger key sizes don't help: a 4096-bit RSA key buys a little time over 2048-bit, but it is the same broken-by-Shor's problem.
This is the headline precisely because it is unanimous. The world's best-resourced banks, hospitals, federal agencies, and technology companies are, today, 100% dependent on cryptography the post-quantum standards are designed to replace. The destination is already defined: on August 13, 2024, NIST finalized FIPS 203 (ML-KEM), 204 (ML-DSA), and 205 (SLH-DSA). The gap between that destination and the universal RSA/ECC reality above is the entire post-quantum migration — and you can't plan a migration you can't measure.
Finding 2: Modern TLS is winning — but deprecated protocols still linger
The protocol picture is healthier. 98% of reachable hosts supported TLS 1.2 and 69% supported TLS 1.3 — modern, well-regarded transport security. The concern is the tail: 6% still accepted deprecated TLS 1.0 or 1.1, protocols the IETF formally deprecated in 2021 (RFC 8996). That number isn't zero, and it wasn't evenly distributed — healthcare was the weakest at 11%, while government domains came in at 0%.
Deprecated TLS rarely shows up in a dashboard because the site still "works." It's exactly the kind of forgotten edge that an external scan surfaces and an internal spreadsheet misses — and it complicates a clean post-quantum transition. This is the crypto-agility review every organization should run.
Finding 3: Certificate hygiene is mostly solid; security headers are uneven
Basic certificate hygiene was good: no SHA-1 signatures appeared anywhere in the sample, and only 2% of certificates were within 30 days of expiry. Security headers, however, were inconsistent. Adoption across hosts that returned headers: HSTS 81%, X-Frame-Options 74%, X-Content-Type-Options 72%, and Content-Security-Policy just 54%. Headers aren't a quantum issue, but they're a fast read on overall cryptographic and web-security discipline — and the spread shows even mature organizations leave easy wins on the table.
Sector by sector
The aggregate hides meaningful variation. Two patterns stand out: government led on protocol hygiene (0% deprecated TLS) but trailed badly on Content-Security-Policy (26%), while consumer-facing tech and retail led on TLS 1.3 adoption.
| Sector | Deprecated TLS 1.0/1.1 | TLS 1.3 | RSA share of certs | HSTS | CSP | |---|---|---|---|---|---| | Financial Services | 5% | 70% | 85% | 95% | 74% | | Healthcare | 11% | 53% | 74% | 58% | 53% | | Government | 0% | 50% | 68% | 84% | 26% | | Technology / SaaS | 10% | 85% | 65% | 89% | 67% | | Retail & Consumer | 6% | 88% | 59% | 79% | 50% | | All sectors | 6% | 69% | 71% | 81% | 54% |
One constant cuts across every row: the quantum-vulnerable share of certificates was 100% in all five sectors. No sector is ahead on the metric that defines post-quantum readiness, because the migration has barely begun anywhere.
What this means for your 2026 roadmap
It's tempting to read "98% on TLS 1.2, clean certs, mostly good headers" as "we're fine." On classical security, many of these organizations are. On quantum readiness, all of them are at the starting line — because every certificate still rests on RSA or ECC.
That matters now, not in 2030, for two reasons. First, "harvest now, decrypt later": adversaries can capture encrypted long-lived data today and decrypt it once a CRQC exists — guidance from DHS, the UK's NCSC, ENISA, and Australia's ACSC is built on this premise. Second, Mosca's theorem: if your migration time plus your data's required secrecy lifetime exceeds the years until a CRQC (the Global Risk Institute's 2025 estimate puts the median at 2029–2032, 34% probability by 2030), your data is already exposed. Google's 2025 Willow chip was a real milestone in quantum error correction — not a break of RSA — which is precisely why "not yet, but prepare now" is the right posture.
The organizations that will navigate this well aren't the ones with the best score today. They're the ones who know where their cryptography lives and can show progress over time. That's also what regulators increasingly require: PCI DSS 4.0 Requirement 12.3.3 mandates a documented cryptographic inventory, DORA (effective January 2025) requires crypto-agility for financial entities, and NSA's CNSA 2.0 sets firm federal deadlines. The inventory is the artifact all of them start from. If you need a structure for the work that follows, our PQC readiness checklist turns the inventory into prioritized action.
How do you compare? Find out in about 3 minutes
The 100 organizations above didn't volunteer for this — we measured what's publicly visible, the same way an attacker or a partner could. The difference is that you can measure your own posture deliberately, and use the result to build a plan before someone else builds a harvested archive of your traffic.
Run a free CipherReady readiness scan on a domain you own or are authorized to assess. In about three minutes you'll get a Readiness Score, an inventory of your public TLS, certificates, and key algorithms, and an executive PDF you can take to leadership — the same external, metadata-only method behind this report.
Frequently Asked Questions
Is it really true that 100% of these organizations are quantum-vulnerable?
For their public TLS certificates, yes — every readable certificate in our 95-host sample used RSA or ECC, both of which a cryptographically relevant quantum computer would break with Shor's algorithm. This isn't unusual or negligent; it's the current state of essentially the entire web, because post-quantum certificates aren't in general production use yet. It's the baseline the NIST standards exist to change.
How was this scan performed, and is it intrusive?
It's external and metadata-only — a TLS handshake to read certificate and protocol data, a DNS lookup, and a read of public HTTP headers, exactly what a browser or SSL Labs does. There's no authentication, no exploitation, and no intrusive testing, which is why it can run in minutes and is safe for production domains.
Why do deprecated TLS 1.0/1.1 still matter if certificates are the bigger quantum issue?
They're different problems. RSA/ECC certificates are the long-term quantum-migration item; deprecated TLS is a present-day hygiene gap (formally deprecated by RFC 8996 in 2021) that widens attack surface and complicates a clean transition. A good inventory surfaces both.
Can I see where my own organization stands?
Yes — run a free scan on a domain you own or are authorized to assess. You'll get the same external posture view used in this report, scored and packaged into an executive report, with scheduled monitoring available to track improvement over time.
See your own baseline — free
You've seen how 100 major organizations look from the outside. The most useful number, though, is your own. Run a free CipherReady readiness scan to baseline your public cryptographic posture today — the free plan includes three scans a month — and see CipherReady pricing when you're ready to monitor more domains, track crypto-agility over time, and report progress to your board. The migration is universal; the advantage goes to whoever can see clearly first.