Post-Quantum Cryptography: The 2026 Enterprise Migration Is

The Encryption You Ship Today Will Be Broken Tomorrow

Somewhere in a data center right now, an adversary is capturing your encrypted traffic. Not to decrypt it today — today’s encryption holds. They are storing it, waiting for a sufficiently large quantum computer to exist, at which point every session they captured becomes readable plaintext.

This is called harvest-now, decrypt-later, and in 2026 it is no longer a theoretical concern tucked into academic papers. NIST has finalized the first post-quantum cryptographic standards. The NSA has issued hard compliance deadlines. Chrome, Firefox, Cloudflare, and Windows have all shipped quantum-resistant key exchange. And if you run an enterprise that handles anything with a shelf life longer than eight years — legal records, health data, intellectual property, classified material — you are already late.

Here is the state of post-quantum cryptography (PQC) migration in 2026, why it is happening faster than most cybersecurity transitions, and what the next eighteen months actually look like.

The Standards Are Finally Frozen

The moment everyone was waiting for came in August 2024, when NIST published three finalized standards:

• FIPS 203 (ML-KEM): The key encapsulation mechanism based on CRYSTALS-Kyber. This replaces RSA and Elliptic Curve Diffie-Hellman for establishing shared secrets.
• FIPS 204 (ML-DSA): The digital signature algorithm based on CRYSTALS-Dilithium. This replaces RSA and ECDSA for authentication and code signing.
• FIPS 205 (SLH-DSA): A hash-based signature scheme — SPHINCS+ — as a conservative backup option with a very different mathematical foundation.

A fourth algorithm, FALCON, is on track for standardization as FIPS 206. Further candidates are being evaluated for specialized use cases like firmware signing.

The significant detail is that these are not drafts anymore. Vendors had been hedging, waiting to see if final parameters would shift. That uncertainty is gone. Every major security vendor now has a concrete migration target.

The Deadlines That Are Forcing the Issue

Standards alone do not move enterprises. Deadlines do.

• NSA CNSA 2.0: All new US National Security System acquisitions must be compliant with the CNSA 2.0 post-quantum algorithm suite by January 1, 2027. Full mandatory compliance across most NSS system types is required by 2033.
• NIST transition guidance (NISTIR 8547): RSA-2048 and ECDSA-P256 are slated for deprecation by 2030 and disallowance by 2035 in US federal systems.
• UK NCSC timelines: The UK National Cyber Security Centre recommends organizations complete cryptographic inventory and hybrid key exchange deployment during 2024-2026, migrate to PQC certificates during 2027-2030, and complete migration by 2035.
• EU and allied guidance: The European Union Agency for Cybersecurity and BSI in Germany have issued broadly aligned timelines.

A full PQC migration in a large enterprise typically takes two to five years. If your organization is starting now, in 2026, you are at the outer edge of a responsible timeline. If you handle data with a shelf life longer than the projected arrival of a cryptographically relevant quantum computer — and most serious estimates now place that in the 2030-2035 window — you need to assume an adversary is already harvesting your traffic.

Hybrid Key Exchange: The Quiet Rollout

The most important development of the past twelve months is that hybrid post-quantum TLS has already shipped to hundreds of millions of end users, largely invisibly.

Chrome and Firefox default to the X25519MLKEM768 named group for TLS 1.3 key exchange. This is a hybrid construction: the client and server run both a classical X25519 key agreement and an ML-KEM-768 key agreement, then combine the two resulting shared secrets. As long as at least one of the two algorithms remains secure, the session is safe. If ML-KEM turns out to have an undiscovered flaw, X25519 still protects you. If a quantum computer breaks X25519, ML-KEM still protects you.

Cloudflare reported that by March 2025, over a third of human HTTPS traffic on its network was already using hybrid post-quantum handshakes. The company automatically enabled PQC on more than six million domains. This happened without any customer action. Most site owners have no idea their traffic is already quantum-resistant.

Microsoft added ML-KEM and ML-DSA to the Windows Cryptography API: Next Generation in Insider builds, with extension to Schannel (the TLS stack) and Active Directory Certificate Services on the roadmap. OpenJDK is implementing JEP 527 for hybrid key exchange in Java TLS. OpenSSL 3.5 ships ML-KEM support.

The pattern is consistent: the infrastructure layer is adopting hybrid PQC quietly and by default. Enterprises that do nothing will still inherit hybrid key exchange for their web traffic. That is the easy part.

What Enterprises Actually Have to Do

Inheriting hybrid TLS from your browser and CDN vendors covers exactly one slice of your cryptographic surface. Everything else requires active work.

1. Cryptographic inventory

Most organizations genuinely do not know where cryptography lives in their systems. A serious PQC migration starts with building a cryptographic bill of materials (CBOM) — an inventory of every place keys are generated, signatures are verified, and encrypted data is stored or transmitted. Tools like CryptoNext’s CBOM scanner, IBM’s Cryptography Discovery service, and various open-source alternatives are the current starting points.

The surprises hide in unexpected places: internal service-to-service mTLS, firmware signing keys embedded in manufactured devices, VPN configurations, database-at-rest encryption, code signing in CI/CD pipelines, and long-lived backup archives.

2. Hybrid deployment for active data

Any system handling data that must remain confidential beyond 2035 needs hybrid key exchange now, not later. This typically means:

• TLS 1.3 with hybrid key groups on internal and external endpoints
• SSH migration — OpenSSH 9.9 defaulted to hybrid PQC key exchange in late 2024
• VPN stack updates — Cisco, Palo Alto, and Fortinet have released PQC-enabled firmware
• Email encryption updates for S/MIME, though the ecosystem here lags

3. Certificate and PKI planning

This is the hard part, and where most migration plans quietly break. ML-DSA signatures are much larger than ECDSA signatures — on the order of 2.5 to 4.5 kilobytes versus 64 bytes. Certificates, certificate chains, and TLS handshakes grow accordingly. Some network hardware, constrained IoT devices, and legacy protocols simply do not handle payloads of that size gracefully. Performance testing of PQC-enabled TLS under real load is now mandatory before any production rollout.

Certificate authorities are moving more slowly than browser vendors. Public CAs are expected to start issuing PQC-enabled certificates in late 2026 and into 2027. Internal PKI — which most large enterprises run for their own service mesh — can move faster because it is under direct control.

4. Long-term data re-encryption

Any encrypted archive that needs to survive into the quantum era must eventually be re-encrypted with PQC-protected keys. For most enterprises this is a multi-year backfill project that should be running in parallel with active-traffic migration.

Why This Is Different From Previous Crypto Transitions

The migration from MD5 to SHA-1, or from SHA-1 to SHA-256, took roughly a decade each and dragged in large part because there was no hard deadline. The PQC migration is structurally different for three reasons.

First, there is an adversary model that implies ongoing damage from inaction. Every day of delay means another day of harvested ciphertext that will eventually be decrypted. Previous crypto transitions did not have retroactive exposure.

Second, federal procurement deadlines create a cascading commercial incentive. Vendors selling to NSS customers must support CNSA 2.0. Vendors selling to those vendors must support it. The chain propagates through the supply chain whether private sector buyers care or not.

Third, the cryptographic primitives themselves are large and awkward enough that drop-in replacement is rarely possible. Protocols, storage formats, and hardware expectations all have to be reconsidered. This makes PQC migration more like the IPv4-to-IPv6 transition than a routine algorithm upgrade.

The parallel is not flattering. IPv6 took thirty years and is still incomplete. PQC does not have thirty years.

The Boardroom Conversation

For CISOs and CTOs, the framing that actually moves budget is not quantum computers. Quantum computers remain a future threat whose arrival date is uncertain. The framing that moves budget is regulatory exposure and supply chain compliance:

• Your federal customers have firm deadlines.
• Your auditors are beginning to ask about PQC readiness.
• Your cyber insurance provider will start asking in the next renewal cycle.
• Your competitors who complete migration first will use it as a sales differentiator.

This is the same playbook that drove the SOC 2 rollout, the GDPR compliance rush, and the zero-trust architecture wave. It ties into the broader enterprise security shift we covered in Agentic AI Is the Biggest Enterprise Security Threat of 2026 and Deepfakes Broke Identity Verification. Now What? — the security stack is being rebuilt simultaneously on multiple fronts, and PQC is not a parallel project. It is a prerequisite for everything else.

The Practical Next Step

If you are a security leader reading this in 2026 and have not yet started, the realistic thirty-day plan is concrete:

1. Commission a cryptographic inventory of at least the top ten business-critical systems.
2. Audit your external TLS endpoints for PQC hybrid support (most CDNs now offer it as a toggle).
3. Map every long-lived signing key — code signing, firmware, internal PKI roots — with its expiration date.
4. Ask every major vendor for their PQC roadmap in writing.
5. Budget the migration as a multi-year line item starting in the 2026 plan.

The good news: the underlying standards are done, the algorithms have been battle-tested across years of public cryptanalysis, the infrastructure layer is doing most of the silent work for you, and the commercial tooling exists.

The harder news: there is no patch for data that has already been harvested. The window to protect anything with long-term confidentiality is now.

The encryption that kept your data safe last year is still safe this year. It will not be safe forever. And “forever” arrives on a schedule no one in cybersecurity fully controls.

—

*Related reading on the security transition: The Autonomous SOC: AI Now Runs Cybersecurity Operations and Agentic Browsers Hit Enterprises and Brought a New Attack.*