Growing PQC at the edge belies deeper quantum-readiness challenges

What happened

More than half (54%) of the world’s top 1 million websites now support post-quantum key exchange, according to research from F5 Labs, an encouraging statistic given that just 27% of CISOs in a June KPMG survey said they are actively implementing post-quantum cryptography (PQC). But F5 Labs’ State of PQC on the Web study found that much of that apparent progress comes from content delivery network (CDN) providers switching on protection, rather than organizations upgrading their own infrastructure for what 38% of CISOs see as top high-impact emerging threat, according to KPMG’s survey.

The quantum threat is becoming an increasing concern for security leaders, but many may be mistaking protection at their website’s front door for quantum readiness across their business. “Much of that support comes from CDN providers switching PQC on by default. Remove Cloudflare-hosted sites and the figure drops to 22%.” “CDN-enabled PQC provides genuine protection for the client-to-edge connection,” says Pažin.

Key facts

• But F5 Labs’ State of PQC on the Web study — found: that much of that apparent progress comes from content delivery network (CDN) providers switching on protection, rather than organizations upgrading their own infrastructure for what 38% of CISOs see as top high-impact emerging threat, according to KPMG’s survey
• “CDN-enabled PQC — provides: genuine protection for the client-to-edge connection,” says Pažin