Sectigo warns of quantum shift in PKI & certificates

Sectigo has released its 2026 State of Crypto Agility Report, which found that 78% of IT and security leaders expect public key infrastructure to change significantly to support post-quantum cryptography.

The findings come as Australian organisations work towards guidance from the Australian Signals Directorate calling for a refined post-quantum cryptography transition plan by the end of the year. Only 38% of IT and security leaders had fully assessed which systems were vulnerable to quantum attacks, although that was up from 14% a year earlier.

The report was based on a global survey of 500 senior decision-makers in IT, technical operations, cybersecurity and risk. Another 44% said their assessment of vulnerable systems was mostly complete, suggesting many organisations are part-way through the work required before any large-scale migration.

Budget does not appear to be the main constraint. The survey found that 83% had budget allocated to quantum-readiness initiatives over the next year, while 93% of those with budget in place expected spending on post-quantum cryptography to rise over the next two to three years.

That points to a shift in focus from broad awareness to implementation. Public key infrastructure, or PKI, sits at the centre of that challenge because it underpins certificates, authentication, encrypted communications, code signing and machine identity across public and private environments.

If post-quantum cryptography brings larger keys or different signature behaviour, organisations may need to change not only algorithms but also the systems that issue, transport, validate and manage certificates. That makes the transition an architectural issue as well as a security one.

Nick France, Chief Technology Officer at Sectigo, described the transition as more than a limited technical swap. "Organisations have moved from asking whether they need to prepare for cryptographic change to confronting what that change actually requires," France said. "PQC is not simply an algorithm swap, and shorter certificate lifespans are not simply a renewal problem. Both require organisations to rethink how they discover, manage, and adapt the cryptographic infrastructure they depend on, across both public and private PKI environments. That ability to execute continuously is what crypto agility looks like in practice."

Operational strain

The report also linked long-term quantum preparation with a more immediate operational issue: shrinking SSL/TLS certificate lifespans. Publicly trusted certificate validity periods fell from 398 days to 200 days earlier this year and are scheduled to fall again to 100 days in March 2027, before moving to 47 days in March 2029.

For IT teams, that means more frequent certificate renewal cycles and less room for manual processes. Sectigo's data suggests many organisations are still exposed to disruption even as they improve inventory and automation.

Some progress is visible. The proportion of respondents reporting a complete, up-to-date inventory of public SSL/TLS certificates rose to 62%, more than double the 28% recorded in 2025. Separately, 40% said they were very prepared for monthly renewals because they already had automated systems in place, up from 19% a year earlier.

Yet 61% said they had experienced a certificate-related outage or incident in the past 12 months. At the same time, 73% said they planned to increase certificate-management automation because of shorter lifespans.

Those figures suggest better visibility has not yet translated into resilience. The combination of more certificates, shorter validity periods and legacy operating models appears to be putting pressure on teams already preparing for post-quantum migration.

Architecture questions

The report also examined Merkle Tree Certificates, a proposed certificate architecture under development through the Internet Engineering Task Force. Among respondents familiar with the proposal, only 40% said they clearly understood the changes their systems, processes and environments would require to support it.

That finding highlights how far some organisations may still have to go before they can judge the practical impact of newer cryptographic approaches. It also points to the challenge of translating standards work into operational planning inside large, complex technology estates.

France said the next stage would depend on making cryptographic change less disruptive to day-to-day operations. "We've entered a time where organisations can no longer manage cryptography as static infrastructure, yet at the same time, we need to make cryptography itself boring again," he said. "As algorithms, standards and requirements change, organisations need to be able to adapt without turning every cryptographic transition into a major operational event. The next stage in crypto agility is about turning awareness into repeatable, testable, and scalable operations through an approach built around continuous cryptographic discovery, risk prioritisation, migration planning and governed change."