Sectigo research finds 78% of organizations expect PKI to change significantly to support PQC

October 28, 20264 min read

SCOTTSDALE, Ariz., October 28, 2026 — Sectigo, a global leader in automated Certificate Lifecycle Management (CLM), today released its 2026 State of Crypto Agility Report, which finds that organizations are moving beyond awareness of major cryptographic change and into the harder work of executing against it. Seventy-eight percent (78%) of IT and security leaders believe today’s public key infrastructure (PKI) – one of the most widespread applications of cryptography today – will need to change to a great or very great extent to support post-quantum cryptography (PQC), as organizations simultaneously adapt to shorter SSL/TLS certificate lifespans and the operational demands they create.

The global study of 500 senior IT and cybersecurity decision-makers shows action is already underway:

38% have fully assessed systems vulnerable to quantum computing attacks, up from 14% in 2025, while another 44% say their assessment is mostly complete.
83% have budget allocated to quantum-readiness initiatives over the next year, and among those with allocated budgets, 93% expect PQC investment to increase over the next two to three years.

The shift marks a new phase in crypto agility: In 2025, organizations were largely preparing for shorter certificate lifespans and the future transition to PQC. In 2026, both are becoming active operational priorities. But as organizations move from awareness to implementation, the scale of the work ahead is becoming clearer across cryptographic discovery, automation, architecture, governance and investment.

“Organizations have moved from asking whether they need to prepare for cryptographic change to confronting what that change actually requires,” said Nick France, CTO at Sectigo. “PQC is not simply an algorithm swap, and shorter certificate lifespans are not simply a renewal problem. Both require organizations to rethink how they discover, manage, and adapt the cryptographic infrastructure they depend on, across both public and private PKI environments. That ability to execute continuously is what crypto agility looks like in practice.”

PQC readiness moves beyond algorithms to PKI architecture

PKI, across both public and private environments, turns cryptography into operational trust across certificates, authentication, encrypted communications, code signing and machine identity. If PQC keys and signatures are larger or behave differently, the infrastructure that issues, transports, validates and manages them must adapt as well. The report also examines Merkle Tree Certificates (MTCs), a proposed certificate architecture under development through the Internet Engineering Task Force (IETF), as one example of the architectural thinking underway:

Among respondents familiar with the proposed MTC architecture, only 40% believe they clearly understand the changes their systems, processes, and environments would require to support it.

Shorter certificate lifespans test execution now

While PQC presents an architectural transformation ahead, shorter certificate lifespans are already testing organizations’ ability to operationalize change now. The maximum validity period for publicly trusted SSL/TLS certificates fell from 398 to 200 days in March 2026 and is scheduled to reach 100 days in March 2027 and 47 days in March 2029.

Organizations report meaningful progress, but execution remains incomplete:

62% report a complete, up-to-date inventory of public SSL/TLS certificates, more than double the 28% reported in 2025.
40% say they are very prepared for monthly renewals because they already have automated systems in place, up from 19%.
73% plan to increase certificate-management automation because of shorter lifespans.
Yet 61% experienced a certificate-related outage or incident in the past 12 months.

The findings expose a central tension in the move from awareness to action: progress does not necessarily mean resilience. Greater visibility, automation and investment are encouraging, but implementation is also revealing dependencies, architectural constraints and operational challenges that become more consequential as change accelerates.

“We’ve entered a time where organizations can no longer manage cryptography as static infrastructure, yet at the same time, we need to make cryptography itself boring again,” adds France. “As algorithms, standards and requirements change, organizations need to be able to adapt without turning every cryptographic transition into a major operational event. The next stage in crypto agility is about turning awareness into repeatable, testable, and scalable operations through an approach built around continuous cryptographic discovery, risk prioritization, migration planning and governed change.”

The 2026 State of Crypto Agility Report is available here: https://www.sectigo.com/state-of-crypto-agility-report.

Methodology
Censuswide collected 500 global survey responses from C-level, vice-president and director-level leaders in IT, technical operations, cybersecurity and risk across a mix of industries and business sizes. Year-over-year comparisons are directional, as the 2026 sample expanded to include APAC.