DigiCert, a certificate authority based in Lehi, Utah, said on July 23, 2026, that 7% of organizations in its latest post-quantum survey had deployed quantum-safe or hybrid cryptography across most of their digital certificates. Digital certificates are the electronic credentials that websites and software present to prove their identity. Hybrid cryptography pairs a current algorithm with a post-quantum one.
In the same survey, 87% of respondents said their organizations were planning, testing, or implementing post-quantum cryptography (PQC), algorithms designed to withstand attack by a future quantum computer. According to DigiCert’s release, Propeller Insights, a research firm, ran the survey in May 2026 among 1,001 IT and cybersecurity decision-makers in the United States, the United Kingdom, and Australia.
The 7% and 87% figures are respondents’ own accounts of their organizations, collected for a company that sells digital certificates and software for managing them.
Comparison with 2025
In the release, DigiCert called the study its second annual global survey on PQC and said deployment had risen “by just two percentage points” since the first. In May 2025, DigiCert reported that 5% of organizations had “implemented quantum-safe encryption,” a measure with no stated scope. The 2026 figure covers deployment across most of an organization’s certificates, and DigiCert did not say whether it asked the same question in both years.
Propeller Insights ran that earlier survey among 1,042 senior and C-level cybersecurity managers in the same three countries. DigiCert described the 2026 respondents as IT and cybersecurity decision-makers.
Expectations and exposure
Eighty-five percent of respondents said they believed current encryption standards would be broken within the next decade, according to DigiCert’s report. Eighty-four percent said at least some encrypted data was already vulnerable to harvest-now, decrypt-later attacks.
In such an attack, an adversary records encrypted traffic today and decrypts it once a capable quantum computer exists. Respondents named financial transaction records and banking data as the information most likely to be targeted first once it can be decrypted, followed by cryptocurrency private keys and wallets. The threat to cryptocurrency works differently. A quantum attacker would derive a private key from a public key exposed on the blockchain and sign transactions with it, without needing stored traffic.
Progress and barriers
Half of the respondents said their organizations had conducted quantum risk assessments. In its release, DigiCert wrote that “44% have developed transition plans and created cryptographic inventories” among the organizations it surveyed.
Asked to name the biggest barrier to deployment, 25.6% of respondents chose legacy complexity, DigiCert said. The largest group, 39%, expected the move to quantum-safe cryptography to take three to five years.
By industry, respondents in retail reported the lowest levels of preparedness, DigiCert said. Those in MedTech and in telecommunications and media reported the highest confidence in their readiness. By country, the United Kingdom had the highest share of organizations describing themselves as leading edge in quantum readiness, at 18%, followed by the United States at 17% and Australia at 10%, according to the release.
Timing
Respondents answered before the White House issued Executive Order 14412 on June 22. Under the order, the Office of Management and Budget is to require federal agencies to move their high-value assets and high-impact systems to PQC by December 31, 2030, for key establishment and by December 31, 2031, for digital signatures. Key establishment is the step in which two parties agree on a shared encryption key at the start of a connection.
