For its 2026 State of Post-Quantum Cryptography (PQC) Report, F5 Labs scanned the world’s top one million websites to assess their readiness for the arrival of quantum computing that will threaten widely used public-key cryptography.

Industry and country analysis covered the top 100,000 domains. It found that just 34% of websites in the oil and gas industry, 35% in telecommunications, 35% in government, and 39% in utilities have adopted post-quantum cryptography (PQC) capable of resisting attacks by quantum computers. Across the full scan of the top one million websites, the figure was 54%.

Organisations in these industries safeguard critical assets, sensitive personal data, and classified state communications. Yet they are the least prepared for the looming threat of quantum computing that will upend decades of orthodoxy in encryption and cyber security.

“The dangerous paradox of quantum security is that the industries managing essential infrastructure are in the bottom quartile of readiness,” said report author David Warburton, Director of F5 Labs.

“Many organisations in these industries are constrained by a combination of data sovereignty requirements, supervisory control and data acquisition systems, and lengthy procurement cycles. The very control they exercise over their data and vendor base is limiting their agility and exposing them to the threat of quantum computing, with the potential it carries to overwhelm traditional encryption methods.”

“The landscape of PQC readiness appears calm, but icebergs are lurking under the surface,” added Warburton. “While a majority of the world’s top million websites now support post-quantum key exchange, that has come about not through proactive engineering but passive reliance on a handful of edge platforms.

“This creates the illusion of quantum shielding but only guards the front door while leaving swathes of infrastructure and access points unprotected. While external pages and checkout flows may be well protected, internal application tiers, private API ecosystems and corporate databases frequently remain anchored to legacy cryptographic infrastructure and are as such vulnerable to future quantum decryption.”

Regional differences: a mixed picture

PQC readiness varies as much by region as it does industry, with cloud architecture choices, local hosting ecosystems and digital sovereignty regulations all having a significant bearing.

The pace-setter is Ukraine, whose organisations showed the highest PQC success rate (65%). That has been the result of a comprehensive migration of public infrastructure to US-based platforms, undertaken to support operational resilience due to hybrid warfare with a significant cyber dimension.

The Five Eyes nations also performed strongly, with Australia (63%), the United States (62%) and the United Kingdom (61%) similarly benefiting from US infrastructure, alongside PQC migration timelines from national cybersecurity bodies which have been aligned across the Five Eyes.

By contrast, major EU nations lagged significantly, constrained from PQC adoption by a combination of the preference for on-premise data centers, European cloud providers that have not enabled PQC at the edge as a default, and cautious guidance from cybersecurity agencies about post-quantum algorithms. Denmark (49%), Netherlands (46%) and Spain (45%) were the continent’s stronger performers, some way ahead of Italy (40%), France (39%) and Germany (36%).

Harvest now - decrypt later

“Organisations lagging on quantum resilience are not simply storing up problems for the future: they face operational liabilities right now,” explained Warburton.

“Beyond mandatory regulatory timelines for post-quantum implementation, enterprises must recognise that their encrypted data is already being gathered by adversaries under Harvest Now, Decrypt Later (HNDL) campaigns.

“It means that the threat is already here, and the window for complacency has closed. To build resilience, organizations must conduct comprehensive audits of their cryptographic touchpoints, eradicate technical debt that leaves them vulnerable, provide transitional protection for legacy systems, overhaul their certificate lifecycle management and enforce crypto-agility throughout their supply chain.

By leveraging the F5 Application Delivery and Security Platform (ADSP) with BIG-IP SSL Orchestrator, enterprises can immediately enable hybrid post-quantum key exchange on the public internet side while maintaining classical cryptography to legacy applications on the inside. This allows organizations to establish instant post-quantum protection for public-facing connections", explains Warburton.

“Q-Day – the tipping point when quantum computing is capable of overwhelming traditional encryption – may not yet be imminent, but the deadline has already passed to be building resilience against that threat,” he concludes.