Sectigo study: firms brace for post-quantum PKI shift

Sectigo has released research showing that 78% of IT and security leaders expect public key infrastructure to change significantly to support post-quantum cryptography. The findings are based on a global survey of 500 senior technology and cybersecurity decision-makers.

The report suggests organisations are moving from planning for cryptographic change to trying to implement it across systems and operations. It found that 38% of respondents have fully assessed systems vulnerable to quantum computing attacks, up from 14% a year earlier, while another 44% said their assessment was mostly complete.

Budgets are also being assigned to the issue. The study found that 83% of respondents have allocated spending to quantum-readiness initiatives over the next year, and 93% of those with budgets in place expect investment in post-quantum cryptography to rise over the next two to three years.

The findings also point to pressure on the same trust infrastructure from two directions. While organisations prepare for the longer-term implications of quantum computing, they are also dealing with shorter SSL/TLS certificate lifespans, which require more frequent renewals and tighter operational control.

Operational strain

That near-term pressure is already showing up in certificate management. The report found that 62% of respondents now have a complete and current inventory of public SSL/TLS certificates, more than double the previous 28%.

Preparedness for more frequent renewals has also improved. Some 40% said they were very prepared for monthly renewals because automated systems were already in place, up from 19%, while 73% said they planned to increase certificate-management automation because of shorter certificate lifespans.

Even so, disruption remains common. The survey found that 61% of organisations experienced a certificate-related outage or incident in the past 12 months, suggesting that greater visibility and investment have not yet removed operational risk.

The report argues that public key infrastructure is central to a wide range of trust functions, including certificates, authentication, encrypted communications, code signing and machine identity. As a result, changes linked to post-quantum cryptography are likely to extend beyond algorithms to the architecture and processes used to issue, transport, validate and manage cryptographic assets.

One area examined was Merkle Tree Certificates, a proposed certificate architecture being developed through the Internet Engineering Task Force. Among respondents familiar with the proposal, only 40% said they clearly understood the changes their systems, processes and environments would require to support it.

Nick France, Chief Technology Officer at Sectigo, said the work facing companies now is broader than a technical upgrade.

"Organisations have moved from asking whether they need to prepare for cryptographic change to confronting what that change actually requires," France said.

"PQC is not simply an algorithm swap, and shorter certificate lifespans are not simply a renewal problem. Both require organizations to rethink how they discover, manage, and adapt the cryptographic infrastructure they depend on, across both public and private PKI environments. That ability to execute continuously is what crypto agility looks like in practice," he added.

From awareness to execution

The year-on-year comparisons in the study suggest a shift in priorities. Earlier work focused more heavily on awareness and preparation, while the latest results indicate that implementation is becoming the immediate issue as organisations test whether existing systems, governance and staffing can cope with a faster pace of change.

The sample covered C-level, vice-president and director-level leaders in IT, technical operations, cybersecurity and risk across a range of industries and business sizes. The study noted that year-on-year comparisons should be treated as directional because the later sample expanded to include respondents in Asia-Pacific.

For businesses, the combination of quantum-readiness work and shorter certificate validity periods creates a dual challenge: adapting infrastructure for future cryptographic standards while reducing the risk of outages under today's certificate regime. The survey results indicate that many organisations have begun that work, but execution remains uneven.

France said the next stage will depend on making cryptographic change routine rather than exceptional.

"We've entered a time where organizations can no longer manage cryptography as static infrastructure, yet at the same time, we need to make cryptography itself boring again," he said.

"As algorithms, standards and requirements change, organizations need to be able to adapt without turning every cryptographic transition into a major operational event. The next stage in crypto agility is about turning awareness into repeatable, testable, and scalable operations through an approach built around continuous cryptographic discovery, risk prioritization, migration planning and governed change."