IT leaders are concerned that public key infrastructure (PKI) – one of the most widespread applications of cryptography today – will need to change significantly to support post-quantum cryptography (PQC).
Research from Sectico found that as organizations adapt to shorter SSL/TLS certificate lifespans and the operational demands they create, 78% of IT and security leaders believe that PKI will need to change too.
Organizations are making progress in assessing the systems that might be vulnerable to quantum attacks, up from 14% in 2025, the study found. Another 44% say their assessment is mostly complete.
Meanwhile, 83% have allocated budget to quantum-readiness initiatives over the next year. Of those, 93% expect PQC investment to increase over the next two to three years.
Post-quantum preparations accelerate
Last year, researchers said organizations were mostly preparing for shorter certificate lifespans and the future transition to PQC.
Now, though, both are becoming active operational priorities – priorities that mean a great deal of work across cryptographic discovery, automation, architecture, governance, and investment.
“Organizations have moved from asking whether they need to prepare for cryptographic change to confronting what that change actually requires,” said Nick France, CTO at Sectigo.
Sign up today and you will receive a free copy of our Future Focus 2026 report - the leading resource for IT decision-maker insight on priorities and investment areas in AI, security and more.
“PQC is not simply an algorithm swap, and shorter certificate lifespans are not simply a renewal problem. Both require organizations to rethink how they discover, manage, and adapt the cryptographic infrastructure they depend on, across both public and private PKI environments. That ability to execute continuously is what crypto agility looks like in practice.”
The report examines Merkle Tree Certificates (MTCs), a proposed certificate architecture under development by the Internet Engineering Task Force (IETF), as one example of the architectural thinking underway.
Yet even among those familiar with the proposed MTC architecture, only 40% believe they clearly understand the changes their systems, processes, and environments would require to support it.
Certificate lifespans are getting shorter, with the maximum validity period for publicly trusted SSL/TLS certificates having fallen from 398 to 200 days in March, and scheduled to drop to 100 days in March 2027 and 47 days in March 2029.
This is already presenting problems, the study noted. While 62% report a complete, up-to-date inventory of public SSL/TLS certificates, more than double the 28% reported in 2025 say they are ‘very prepared’ for monthly renewals – largely because they already have automated systems in place.
Nearly three-quarters (73%) said they plan to increase certificate-management automation because of shorter lifespans, and 61% said they'd experienced a certificate-related outage or incident in the past 12 months.
“We’ve entered a time where organizations can no longer manage cryptography as static infrastructure, yet at the same time, we need to make cryptography itself boring again. As algorithms, standards and requirements change, organizations need to be able to adapt without turning every cryptographic transition into a major operational event," said France.
"The next stage in crypto agility is about turning awareness into repeatable, testable, and scalable operations through an approach built around continuous cryptographic discovery, risk prioritization, migration planning and governed change.”
NIST publishes quantum timeline guidance
The research comes after the National Institute of Standards and Technology (NIST) released advice on the best approach and timelines for transitioning away from quantum-vulnerable algorithms to quantum-resistant standards.
"We lay out how certain encryption algorithms people are using today will get phased out,” said NIST mathematician Dustin Moody, who heads the PQC standardization project.
“It’s important to know how a given algorithm might be disallowed in federal systems after a certain date, for instance, or whether it will be allowed but at the user’s own risk. Factors like this can help an organization plan.”