- A 2026 measurement study of 32,011 domains found 49.3% now support hybrid post-quantum key exchange (MLKEM768 + X25519), but 0% have adopted hybrid post-quantum certificates — leaving the authentication layer fully exposed.
- 15.70% of domains still negotiate TLS 1.2, concentrated in banking and government, where Harvest-Now-Decrypt-Later (HNDL) exposure is highest.
- If your migration stops at key exchange, your certificate chain remains forgeable by a quantum adversary — partial migration is not resilience.
A new measurement study of the public Internet, “Measurement Study of Post-Quantum Readiness of Internet: 2026” (arXiv:2606.16473), quantifies exactly how far the migration to quantum-safe TLS has progressed — and where it has stalled. The headline is not the progress on key exchange. It is the zero. Across 32,011 domains, not a single one served a hybrid post-quantum certificate. For a CISO, that means the part of TLS that proves who you are talking to has no quantum defense deployed in the wild today.
Why Half-Migrated TLS Leaves Your Authentication Layer Exposed
Consider a regional bank that upgraded its load balancers in 2025 to support hybrid post-quantum key exchange. The security team checked the box: traffic is now protected against passive interception by a future quantum computer. But the bank’s certificates — the credentials a browser uses to verify it is genuinely connected to the bank and not an impostor — are still signed with RSA or ECC. A quantum-capable adversary does not need to decrypt that bank’s traffic to cause damage. They can forge the bank’s certificate, stand up a convincing clone, and intercept sessions in real time.
This is the structural gap the study measures. TLS resilience depends on two independent cryptographic functions: the key exchange that establishes a session secret, and the certificate/signature that authenticates the endpoint. The 2026 data shows the industry has moved on the first and ignored the second.
The risk is not hypothetical or purely future-tense. Harvest-Now-Decrypt-Later (HNDL) attacks are happening now: adversaries record encrypted traffic today and store it until a cryptographically relevant quantum computer can break the classical key exchange that protected it. Any data with a confidentiality lifetime longer than the runway to quantum — financial records, health data, state secrets, long-lived credentials — is already at risk the moment it crosses a classically-protected link.
The study reports 0% adoption of hybrid post-quantum certificates, observing that this leaves the authentication layer vulnerable to quantum-enabled attacks such as certificate forgery. (arXiv:2606.16473)
Technical Deep-Dive: What 32,011 Domains Actually Negotiated
The study analyzed live, negotiated TLS parameters — not self-reported configurations — including protocol versions, cipher suites, key exchange mechanisms, and certificates across 32,011 domains. That methodology matters: it captures what servers actually do during a handshake, not what they claim to support.
The key exchange picture is split almost evenly. 49.3% of domains support a hybrid post-quantum key exchange, exemplified by MLKEM768 combined with X25519. The hybrid construction is deliberate: it concatenates a NIST-selected lattice KEM (ML-KEM-768) with the battle-tested classical X25519 curve, so the session stays secure as long as either primitive holds. The remaining 50.7% still rely on purely classical key exchange — vulnerable to a quantum adversary running Shor’s algorithm against the underlying discrete-log or factoring problem.
Protocol version tells a parallel story of uneven progress. 15.70% of domains still negotiate TLS 1.2, a protocol with no native hybrid PQC handshake path, concentrated in legacy-dependent sectors like banking and government.
| TLS Resilience Dimension | Classical / Legacy State | Quantum-Safe Target | 2026 Measured Adoption |
|---|---|---|---|
| Key exchange | RSA / ECC (X25519 alone) | Hybrid MLKEM768 + X25519 | 49.3% hybrid / 50.7% classical |
| Protocol version | TLS 1.2 | TLS 1.3 (+ QUIC) | 15.70% still on TLS 1.2 |
| Certificate / signature | RSA / ECC signatures | Hybrid post-quantum certificates | 0% adoption |
| Net resilience | Forgeable + harvestable | Confidential + authenticated | Partial at best |
The asymmetry between the key-exchange column and the certificate column is the entire story. You can have 49.3% of the Internet protecting session confidentiality while 100% of it remains open to certificate forgery. The study is explicit that complete quantum resilience requires a coordinated transition across both key exchange mechanisms and certificate infrastructures — neither alone is sufficient.
Without comprehensive migration of both layers, Internet communication systems remain vulnerable to long-term threats including HNDL attacks — harvested traffic captured today becomes decryptable once large-scale quantum computers emerge.
Industry Context: A Widening Quantum-Readiness Divide
The study found adoption is uneven across sectors, with technology-driven platforms advancing faster than legacy-dependent infrastructures. That divide has compliance and competitive consequences.
The regulatory pressure is converging on a clear direction: hybrid key establishment first, signature migration close behind. The fact that the public Internet shows 0% certificate migration in 2026 signals that the hardest part of the transition — re-issuing and re-chaining certificates across PKI hierarchies — has barely begun. Certificate migration is operationally heavier than a key-exchange upgrade because it touches certificate authorities, chain-of-trust validation, and every client that pins or validates those chains.
The economic asymmetry favors early movers. A key-exchange upgrade is largely a configuration and library change on terminating infrastructure. A certificate migration is a multi-quarter program involving PKI inventory, CA coordination, and client-compatibility testing. Organizations that start the certificate workstream now convert a future emergency into a planned rollout. Those that wait inherit both workstreams at once — under whatever timeline a quantum breakthrough or a regulatory deadline imposes.
The BeQuantum Perspective: Treat Authentication as a First-Class Migration Target
The instinct across the industry has been to chase the key-exchange number because it is the easy win. The 2026 data shows where that instinct leaves you: confidential sessions terminating at forgeable identities. Here is how organizations like ours approach the gap.
BeQuantum’s PQC Layer is built around the principle the study validates — that resilience is a coordinated property of key exchange and authentication, not a single checkbox. Rather than bolting hybrid key exchange onto an unchanged PKI, the PQC Layer treats the certificate chain as an equal migration target, inventorying signature algorithms across the trust hierarchy and flagging every endpoint where a quantum-forgeable signature anchors a quantum-safe session.
For the harvest-now problem, our Digital Notary anchors a verifiable, timestamped record of authentication events to an immutable ledger. If a certificate is later forged against a classical signature, the discrepancy between the forged credential and the notarized record is detectable — adding a verification layer that does not depend solely on the signature algorithm’s strength. For environments where key material must never touch a quantum-exposed boundary, IceCase hardware isolates the root of trust so that the migration of signing keys happens inside a controlled, attestable enclave rather than across exposed infrastructure.
The point is not the products. It is the posture: if your roadmap has a line item for hybrid key exchange and no line item for certificate migration, you have replicated the exact gap this study measured across 32,011 domains.
What You Should Do Next
- Within 90 days, audit your certificate chain for quantum exposure. Inventory every signature algorithm across your PKI — leaf, intermediate, and root. The study’s 0% finding means you almost certainly have zero post-quantum certificates today; confirm it and scope the re-issuance effort before it becomes urgent.
- Within 60 days, eliminate TLS 1.2 on externally-facing endpoints. With 15.70% of the Internet still on TLS 1.2 — and that share concentrated in banking and government — verify your own posture. TLS 1.3 is the prerequisite for any hybrid PQC handshake path; staying on 1.2 forecloses the migration entirely.
- Classify data by confidentiality lifetime and prioritize HNDL-exposed flows. Any traffic that must stay secret for longer than your realistic quantum runway should move to hybrid key exchange first. Map those flows now so the deployment order follows risk, not convenience.
FAQ
Q: If hybrid post-quantum key exchange adoption is already at 49.3%, isn’t most of the migration done? A: No. Key exchange protects session confidentiality, but the 2026 study found 0% adoption of hybrid post-quantum certificates — meaning the authentication layer that proves endpoint identity has no quantum defense deployed anywhere. A quantum adversary can forge a classically-signed certificate to impersonate a server regardless of how strong the key exchange is. Migration is roughly half-done at best.
Q: Why is Harvest-Now-Decrypt-Later a present-tense risk if quantum computers can’t break RSA yet? A: Because the attack separates collection from decryption. An adversary records your classically-encrypted traffic today and stores it until a cryptographically relevant quantum computer exists. Any data with a confidentiality lifetime longer than that runway — financial, health, or state records — is effectively exposed the moment it crosses a classically-protected link.
Q: Which sectors are most exposed according to the study? A: Banking and government. The study found these legacy-dependent sectors disproportionately represented among the 15.70% of domains still running TLS 1.2, and adoption of post-quantum mechanisms lags behind technology-driven platforms across the board.
Last updated: June 17, 2026. Primary source: Measurement Study of Post-Quantum Readiness of Internet: 2026, arXiv:2606.16473.
[IMAGE: a fractured digital certificate seal splitting apart over a glowing TLS handshake, with intact lattice-pattern key exchange links on one side and shattered signature chains on the other]
