The research found that although 87% of organisations report they are planning, testing or implementing PQC initiatives, deployment has increased by just two percentage points since last year's survey. As a result, only 7% of organisations have deployed quantum-safe or hybrid cryptography across most of their digital certificates, underscoring how much work remains to transition from planning to implementation.

The findings, published in the Digicert Quantum Readiness Outlook, suggest organisations have moved beyond awareness but are now facing an execution gap. More than half of organisations expect today's encryption standards to be broken within the next five years, while enterprise progress toward becoming quantum ready has only increased by 2% over the past year.

"The move to post-quantum cryptography is part of a broader modernisation journey versus just a technology upgrade," said Kevin Hilscher, Senior Director of Product Management at Digicert. "Organisations that invest in crypto-agility today are building the flexibility to evolve with changing standards, emerging technologies, and future business requirements. That's what creates long-term resilience. However, this is where the research suggests organisations are now struggling: how to translate strategy into enterprise-wide execution."

The urgency continues to grow. Eighty-four percent of organisations believe at least some encrypted data is already vulnerable to harvest now, decrypt later (HNDL) attacks, while the largest share of respondents (39%) expect the transition to quantum-safe cryptography to take three to five years, reinforcing that quantum is no longer viewed as a future technology challenge but a current business risk.

Methodology

The findings are based on an independent survey conducted by Propeller Insights on behalf of Digicert in May 2026. The study surveyed 1,001 IT and cyber security decision makers across the United States, United Kingdom and Australia.