A homeowner in a coastal region doesn't wait until the storm is on top of them to put up shutters. They watch the forecast. When a serious hurricane is named - even if it's still days out, still uncertain in path, still potentially turning away - they board up the windows.
That's roughly the position serious organisations are in with post-quantum cryptography in 2026.
The hurricane is the eventual arrival of a cryptographically relevant quantum computer - a machine capable of breaking the public-key cryptography that TLS, SSH, and most internet security currently rely on. The forecast is uncertain. It might be ten years away. It might be twenty. It might never happen. But the consensus among national security agencies and large platforms is that you don't wait.
Why? Because of "harvest now, decrypt later" - adversaries who can record encrypted traffic today and decrypt it whenever the quantum computer arrives. Anything you send today that needs to stay confidential in 2040 is already at risk.
NIST finalised the first set of post-quantum cryptography standards in August 2024. Chrome, Cloudflare, AWS, and Google have been rolling out hybrid post-quantum TLS since then. The work of migrating is underway whether your organisation has noticed or not. Here's what's actually happening, what your team should be doing now, and what to ignore for the moment.
What's actually happening
Three things, in chronological order.
August 2024 - NIST finalised the first standards. Three algorithms graduated: - ML-KEM (formerly known as CRYSTALS-Kyber) for key encapsulation - the part of TLS that establishes a shared secret. - ML-DSA (CRYSTALS-Dilithium) for digital signatures - used in certificates. - SLH-DSA (SPHINCS+) for digital signatures as a hash-based alternative.
2024–2025 - major platforms started deploying hybrid mode. Hybrid means classical + PQ combined: an X25519 key exchange in parallel with ML-KEM, so a connection is secure if either is unbroken. Chrome enabled X25519MLKEM768 by default for many connections. Cloudflare and AWS rolled out hybrid PQ on their edges.
2026 (now) - wider rollout, slow internal adoption. Public-facing TLS on big-platform edges is increasingly hybrid PQ. Internal infrastructure, machine-to-machine TLS, mobile apps, embedded devices - the rest of the iceberg - is mostly still classical. This is where most enterprises will spend the next five years.
The standards are done. The browsers are ready. The work that remains is the long tail.
The "harvest now, decrypt later" threat
The reason this matters before quantum computers exist:
An adversary records your TLS-encrypted traffic today. They cannot decrypt it. They store it. Years pass. A cryptographically relevant quantum computer arrives. They decrypt their stored traffic. They learn what your organisation was doing, who was talking to whom, what credentials were exchanged.
For a lot of data, this doesn't matter. The price of bread in 2026 is not state-secret-grade information. Nobody is going to spend quantum computer time on it.
For some data, it matters a great deal. Trade secrets with long lifespans. Source code. Diplomatic cables. Health records. Authentication tokens that might still be reused. Government communications.
If your organisation has data that needs to stay confidential past, roughly, 2040, you should assume an adversary can capture and store it now. The migration to post-quantum TLS isn't about today's threats. It's about today's data and tomorrow's attackers.
Why hybrid (and not just-PQ)
The current rollout is hybrid mode - classical + PQ together. There are two reasons.
One: the new algorithms are new. They've been studied intensively, but not for the decades that classical algorithms have. Some of the early PQ candidates have already been broken (SIKE, in 2022, by classical computers - embarrassing). Hybrid mode means that if the PQ algorithm turns out to be weaker than thought, you still have classical security.
Two: client compatibility. Many clients don't yet support PQ. Some never will (old devices, embedded systems). Hybrid lets you start using PQ where supported without breaking older clients. The classical half does the work for them.
The trade-off is bigger handshake sizes. ML-KEM keys are roughly 1KB each, versus 32 bytes for X25519. Hybrid handshakes are larger than classical ones, which has measurable effects on connection setup time, especially for connections with high round-trip latency. The performance cost is real but generally acceptable.
The expected path: hybrid for now, transitioning to PQ-only as the algorithms gain more confidence and old clients age out. Probably a decade-long process.
What enterprises should do now
Five things, in priority order.
One: inventory. You cannot migrate what you cannot enumerate. Find every TLS endpoint, every internal CA, every signing key, every mobile app cert pin. The cert inventory work we keep talking about isn't separate from PQ migration - it's a precondition.
Two: classify by sensitivity. Which data on each endpoint needs to remain confidential past 2040? That endpoint is high-priority for PQ migration. The marketing site is not.
Three: check what your platforms support. Cloudflare's edge, AWS Certificate Manager, your CDN, your load balancer, your service mesh, your VPN - what's their PQ roadmap? Most major platforms have one. Many can be configured today.
Four: test hybrid mode in non-critical paths. Pick one service. Enable hybrid PQ. Measure handshake size, connection times, error rates. Make sure your monitoring still works. Get the operational reps before it matters.
Five: keep an eye on standards activity. The CA/Browser Forum, NIST, and the IETF are all still working through the practical implementation details. Things will change. Subscribe to the relevant lists; don't lock in implementation details that are still in flux.
What this doesn't require: hiring a quantum cryptographer, rewriting your application code, or panicking. Most of the work is at the TLS layer, which is mostly maintained by the platforms you already use. Your job is to know what you have, prioritise correctly, and pull the lever when each platform is ready.
What to ignore for now
Three things that aren't worth attention yet, even though you'll see them in marketing materials.
"Quantum-proof" claims from small vendors. Quantum-proof means using NIST-finalised algorithms in well-reviewed implementations. The big platforms are doing this. A startup claiming "quantum-proof" without specifics is selling marketing.
Pure PQ-only deployments. Almost nobody is doing this. Hybrid is the responsible path for the next five to ten years.
Code signing PQ migration. Important but on a separate, slower timeline. The TLS migration matters more for now. Code signing will follow.
One small ask
The post-quantum migration is the longest, slowest, most boring infrastructure shift the internet has done in twenty years. It will happen mostly without drama. Your part is to know what you have, monitor what's running, and pull the lever when each platform is ready. TLS Radar inventories your certs, shows you which platforms they're on, and tracks TLS configuration over time - including the PQ side as more platforms roll it out. Free tier covers three domains, which is enough to see where you'd start.
Get the next post in your inbox
TLS monitoring tips and product updates. No spam, unsubscribe anytime.