eBook: The 47-day survival guide Go to eBook: The 47-day survival guide
SSL/TLS certificate lifespans have shrunk from three years to one...
State of Crypto Agility 2026: From awareness to action
One year ago, shorter certificate lifespans and post-quantum cryptography were future challenges. Today, they're operational priorities. Our survey of 500 senior IT and cybersecurity leaders shows who's moving, who's stalling, and what real readiness takes.
The 2026 findings at a glance
Only 38%
have fully assessed systems vulnerable to quantum attacks, up from 14% in 2025
62%
have a complete inventory of public SSL/TLS certificates, more than double 2025's 28%
61%
still experienced a certificate-related outage or incident in the past 12 months
What's new in 2026
The 2025 report measured awareness. The 2026 report measures execution.
01
Outcomes, not just intent
For the first time, we measure what happens in practice: outages, automation across the full lifecycle, and how the 200-day certificate era is landing.
02
The architecture question
Post-quantum cryptography (PQC) is no longer just an algorithm swap. We explore the concept of Merkle Tree Certificates (MTCs) and the future of PKI.
03
A new deadline landscape
Google and Cloudflare's 2029 PQC targets, U.S. Executive Order 14412, and NIST's 2030/2035 milestones, mapped in one place.
04
A third pressure
Agentic AI is creating a new class of identity that must be authenticated, constrained, monitored and revoked.
05
A bigger, global view
500 senior IT and cybersecurity leaders across North America, EMEA and APAC, nearly double the surveyed responses from 2025.
One year on: 2025 vs 2026
*2025 and 2026 samples differ in size and geography, so year-over-year comparisons are directional.
| 2026 | 2025 | ||
|---|---|---|---|
| Complete certificate inventory | 62% | 28% | |
| Very prepared for monthly renewals | 40% | 19% | |
| Fully assessed quantum exposure | 38% | 14% | |
| Extremely confident in PQC integration | 28% | 15% | |
| Very or extremely concerned about 47-day lifespans | 61% | 52% | |
Why this year's report matters for your readiness
Progress doesn't equal resilience.
Certificate visibility more than doubled, yet 61% still had a certificate-related incident. Confidence in PQC integration nearly doubled, yet only 38% have fully assessed their exposure. And the next cut to certificate validity, 100 days on March 15, 2027, is less than five months away.
This report helps you separate confidence from capability, benchmark your program against 500 peers, and focus investment on the capabilities that serve every pressure at once.
What you'll learn
PQC readiness
Where your peers stand on PQC assessment, budget and migration timelines
The future of PKI
Why 78% expect PKI itself to change, and what Merkle Tree Certificates mean for your architecture
Life at 200 days
How the 200-day era is affecting outages, automation and confidence
Agentic AI identity
What agentic AI means for identity, authorization and revocation
Capabilities that scale
The capabilities that serve all three pressures: discovery, end-to-end automation, centralized policy, algorithm flexibility and rapid revocation
Who's this report for?
For security & business leaders
Benchmark risk, budget and readiness against 500 peers, and see why the earliest applicable deadline may become your effective one.
For PKI & infrastructure teams
See where automation is advancing across provisioning, deployment, revocation and DCV, and where the lifecycle still breaks.
Crypto agility has entered its execution era.
Webinar: Inside the 2026 State of Crypto Agility report: Learnings from 500 security leaders
Join Sectigo's Jason Soroko and Nick France as they unpack what changed since 2025, what the 200-day certificate era is revealing about operational readiness, why Merkle Tree Certificates point to the architectural choices ahead, and how to build one digital trust foundation for continuous change, before validity drops to 100 days in March 2027.
November 17, 2026 at 11 EST.
Explore more
Get the full 2026 report
Full findings, the complete survey appendix and a year-over-year view against our 2025 research.