The 2026 State of Crypto Agility Report: What PQC and shorter certificate lifespans mean for organizations
Post-quantum cryptography (PQC) is often described as an algorithm swap, but the 2026 State of Crypto Agility Report shows why the change reaches much further. Seventy-eight percent (78%) of IT and security leaders believe today’s public key infrastructure (PKI), one of the most widespread applications of cryptography today, will need to change to a great or very great extent to support PQC.
In 2025, organizations were largely preparing for shorter certificate lifespans and the future transition to PQC. In 2026, both are becoming active operational priorities. As organizations move from awareness to implementation, the scale of the work ahead is becoming clearer across cryptographic discovery, automation, architecture, governance, and investment.
PKI itself must change for PQC
PQC migration is not simply about replacing vulnerable algorithms with quantum-resistant alternatives. PKI, across both public and private environments, turns cryptography into operational trust across certificates, authentication, encrypted communications, code signing, and machine identity. If post-quantum keys and signatures are larger or behave differently, the infrastructure that issues, transports, validates, and manages them must adapt as well.
Public and private PKI environments serve different purposes. Publicly trusted certificates operate within external industry requirements, while private PKI enables organizations to use certificates that serve their own environments. PQC readiness therefore requires organizations to understand the cryptography and PKI they depend on across both.
What PQC readiness increasingly requires:
- Cryptographic discovery: Organizations need to understand what cryptography is in use and where.
- Visibility across public and private PKI: PQC readiness needs to account for the PKI environments an organization relies on.
- PKI architecture that can evolve: PQC affects more than algorithms. The infrastructure surrounding them must adapt too.
- Moving from assessment to execution: 38% have fully assessed systems vulnerable to quantum computing attacks, while another 44% say their assessment is mostly complete.
Shorter certificate lifespans are testing execution now
While PQC presents an architectural transformation ahead, shorter certificate lifespans are already testing organizations’ ability to operationalize change.
The maximum validity period for publicly trusted SSL/TLS certificates fell from 398 to 200 days in March 2026 and is scheduled to reach 100 days in March 2027, and 47 days in March 2029.
Private PKI is not subject to those same public certificate requirements. But private PKI still involves issuing, deploying, renewing, and replacing certificates used within enterprise environments. As organizations prepare for broader cryptographic change, those environments are also part of the PKI landscape they need to understand and manage.
Shorter certificate lifespans are testing execution now
While PQC presents an architectural transformation ahead, shorter certificate lifespans are already testing organizations’ ability to operationalize change.
The maximum validity period for publicly trusted SSL/TLS certificates fell from 398 to 200 days in March 2026 and is scheduled to reach 100 days in March 2027, and 47 days in March 2029.
Private PKI is not subject to the same requirements as public PKI for shrinking certificate lifecycles, but leading organizations are adopting shorter lifecycles for their private PKI as an early tactic against quantum threats like Harvest Now Decrypt Later. As organizations prepare for broader cryptographic change, those environments are also part of the PKI landscape they need to understand and manage.
What shorter certificate lifespans are revealing:
Certificate visibility is improving: 62% report a complete, up-to-date inventory of public SSL/TLS certificates, more than double the 28% reported in 2025.
Incidents remain common: 61% experienced a certificate-related outage or incident in the past 12 months.
Automation is becoming a priority: 73% plan to increase certificate-management automation because of shorter lifespans.
The findings expose a central tension: progress does not necessarily mean resilience.
Crypto agility means building for continuous change
PQC and shorter certificate lifespans are putting pressure on the cryptographic infrastructure organizations depend on. The report points to capabilities that can help organizations adapt as algorithms, standards, and requirements change:
- Continuous cryptographic discovery
- Automated certificate lifecycle management
- Centralized visibility and governance
- Algorithm flexibility
- Migration planning and risk prioritization
- Repeatable, testable processes
The goal is to turn cryptographic change into repeatable, testable, and scalable operations rather than treating every transition as a major operational event.
Want to go deeper?
The full 2026 State of Crypto Agility Report explores:
- How organizations are progressing toward PQC readiness
- How shorter certificate lifespans are changing certificate operations
- Where organizations are investing in automation
- What emerging approaches such as Merkle Tree Certificates (MTCs) could mean for PKI
State of Crypto Agility 2026: From awareness to action
Full findings, the complete survey appendix and a year-over-year view against our 2025 research.