Sectigo survey shows quantum threat driving PKI change

Sectigo has published research suggesting most IT and security leaders expect major changes to public key infrastructure, or PKI, to support post-quantum cryptography. The survey also found that many rank the quantum threat above risks linked to artificial intelligence.

The study of 500 senior IT and cybersecurity decision-makers found that 78% believe current PKI will need to change to a great or very great extent for post-quantum cryptography. Some 45% said the threat from quantum computing ranks higher than AI-related threats, while 63% said they are highly concerned about "harvest now, decrypt later" attacks, in which encrypted data is collected today and decrypted later when more powerful systems become available.

The findings suggest a shift from planning to implementation. Among those surveyed, 38% said they had fully assessed systems vulnerable to quantum computing attacks, up from 14% a year earlier, while another 44% said that assessment was mostly complete.

Budgeting also appears to have moved up the agenda. The report found that 83% have allocated budget to quantum-readiness initiatives over the next year, and 93% of those with budgets expect investment in post-quantum cryptography to rise over the next two to three years.

Pressure on PKI

The report argues that the challenge goes beyond replacing one set of algorithms with another. PKI underpins certificates, authentication, encrypted communications, code signing and machine identity. Any move to quantum-resistant cryptography would require changes to the systems that issue, transport, validate and manage credentials across public and private environments.

That complexity is reflected in the findings on newer certificate models. Among respondents familiar with Merkle Tree Certificates, a proposed certificate architecture under development through the Internet Engineering Task Force, only 40% said they clearly understand the changes needed across their systems, processes and environments to support it.

The study also highlights a more immediate operational strain from shorter SSL/TLS certificate lifespans. The maximum validity period for publicly trusted certificates has already fallen from 398 days to 200 days, with further reductions scheduled. That is increasing the frequency with which organisations must renew and manage digital certificates.

Many organisations reported progress in gaining a clearer view of their estate. Some 62% said they now have a complete, up-to-date inventory of public SSL/TLS certificates, more than double the 28% reported in the previous year's research.

Automation remains uneven, however. While 40% said they are very prepared for monthly renewals because automated systems are already in place, 73% said they plan to increase certificate-management automation as certificate lifespans shorten.

Operational risks

The risks of weak certificate management are not theoretical. The survey found that 61% of respondents had experienced a certificate-related outage or incident in the past 12 months, suggesting many technology teams are still dealing with basic operational gaps even as they prepare for broader cryptographic change.

That overlap between current operational pressure and longer-term quantum readiness is central to the report's message. Organisations are being asked to manage more certificates, renew them more often and prepare for changes in cryptographic standards at the same time, all within infrastructure often designed for slower, less frequent change.

Nick France, Chief Technology Officer at Sectigo, said the work facing organisations is broader than a technical refresh. "Organisations have moved from asking whether they need to prepare for cryptographic change to confronting what that change actually requires," he said.

He said the shift affects both technology design and day-to-day operations. "PQC is not simply an algorithm swap, and shorter certificate lifespans are not simply a renewal problem. Both require organizations to rethink how they discover, manage, and adapt the cryptographic infrastructure they depend on, across both public and private PKI environments. That ability to execute continuously is what crypto agility looks like in practice," France said.

The survey was conducted globally and included C-level, vice-president and director-level leaders in IT, technical operations, cybersecurity and risk across a range of industries and company sizes. Year-on-year comparisons are described as directional because the latest sample was expanded to include respondents from the Asia-Pacific region.

France said the goal for many organisations is to make cryptography less disruptive to manage, even as external requirements become more demanding. "We've entered a time where organizations can no longer manage cryptography as static infrastructure, yet at the same time, we need to make cryptography itself boring again," he said. "As algorithms, standards and requirements change, organizations need to be able to adapt without turning every cryptographic transition into a major operational event. The next stage in crypto agility is about turning awareness into repeatable, testable, and scalable operations through an approach built around continuous cryptographic discovery, risk prioritization, migration planning and governed change."