Sectigo, a certificate authority and certificate lifecycle management vendor based in Scottsdale, Arizona, released its 2026 State of Crypto Agility Report on October 28, 2026. In a survey of 500 senior IT and cybersecurity decision-makers, 78% said today’s public key infrastructure (PKI) will need to change “to a great or very great extent” to support post-quantum cryptography (PQC).
Thirty-eight percent said their organization had fully assessed its systems for vulnerability to quantum attacks, up from 14% in Sectigo’s 2025 edition. Four percent said their certificate management was already fully automated.
Under a CA/Browser Forum ballot adopted in April 2025, now part of the forum’s Baseline Requirements, publicly trusted TLS certificates issued from March 15, 2027, may be valid for at most 100 days. For certificates issued from March 15, 2029, the maximum is 47 days. An organization that renews certificates by hand will have to replace each public TLS certificate issued from March 15, 2027, within 100 days, while it is also planning its move to post-quantum certificates.
Method and caveats
The research firm Censuswide collected the responses between July 2 and July 21, 2026, from directors, vice presidents, and C-suite executives in North America, Europe, the Middle East and Africa, and Asia-Pacific. For its 2025 report, Sectigo used 272 responses from the United States and EMEA, collected by Omdia in June 2025. In its methodology note, Sectigo wrote that the two samples are not strictly like for like and that year-over-year comparisons should be read as directional.
Sectigo sells the certificate-management software that several of the survey’s questions concern.
Post-quantum readiness
Of all respondents, 38% reported a full assessment, 44% a mostly complete one, and 14% a partial one. The remaining 4% planned to start within 12 months.
Eighty-three percent said they had budget for quantum-safe work over the next year. Sixty-three percent were extremely or very concerned about “harvest now, decrypt later” attacks, in which adversaries store encrypted data to decrypt once a capable quantum computer exists.
Twenty-eight percent were extremely confident they could integrate PQC without major disruption, up from 15% a year earlier. Seventy percent knew before the survey that Google had set 2029 as its own migration target.
Sectigo devoted a section of the report to Merkle Tree Certificates, a format under development in an Internet Engineering Task Force working group. The company said cryptographers at Google and Cloudflare have been developing the format, with contributions from Sectigo.
In that design, a website presents a short proof that its certificate appears in a public log, in place of a full post-quantum signature. Sectigo put a single ML-DSA signature (the scheme standardized from CRYSTALS-Dilithium) at roughly 2.4 kilobytes, the size for ML-DSA-44, the smallest of the standard’s three parameter sets, and a typical inclusion proof at under 1 kilobyte.
Certificate lifetimes and automation
Sixty-two percent of respondents said they had a complete, up-to-date inventory of their public TLS certificates, up from 28%. Sixty-one percent had a certificate-related outage or incident in the previous 12 months. Because of shorter lifetimes, 73% planned to increase automation.
Sectigo reported higher automation rates for provisioning, deployment, revocation, and domain validation than in 2025, but did not say in the 2026 report how it combined respondents’ answers into those rates.
Asked to rank three challenges by risk, 45% of respondents put quantum threats first, 28% put shorter certificate lifetimes first, and 27% chose identity for AI agents. Ninety-six percent saw at least some overlap between preparing for 47-day certificates and preparing for PQC.
“PQC is not simply an algorithm swap, and shorter certificate lifespans are not simply a renewal problem,” Nick France, Sectigo’s chief technology officer, said in a company announcement.
