Sectigo finds 78% see PKI change for quantum era

Introduction

The 2026 State of Crypto‑Agility Report from Sectoor reveals a decisive shift in how organizations view public‑key infrastructure (PKI). Seventy‑eight percent of IT and security leaders now anticipate substantial changes to accommodate post‑quantum cryptography (PQC). This momentum is reflected in accelerated vulnerability assessments, increased budgeting for quantum‑readiness, and a surge in automation for short‑lived SSL/TLS certificates.

From Awareness to Action

Accelerating Vulnerability Discovery

• Full assessments up 38% – Organizations that have completed a comprehensive review of systems vulnerable to quantum attacks have risen from 14% in 2025 to 38% in 2026. The rapid increase signals that firms are moving beyond curiosity to concrete risk identification.
• Budgetary confidence – Over 90% of respondents allocating funds to quantum‑readiness expect to raise PQC investment in the next two to three years, indicating a sustained financial commitment.

Rethinking PKI Architecture

• Beyond algorithm swaps – The report stresses that adopting PQC is not a simple replacement of RSA or ECC with quantum‑resistant algorithms. Shorter certificate lifespans, emerging standards such as Merkle Tree Certificates (MTCs), and the need for continuous cryptographic discovery demand a fundamental redesign of PKI processes.
• Operational complexity – Even with higher automation, 61% of organizations reported at least one certificate‑related outage in the past year, underscoring the gap between tool adoption and operational resilience.

Automation and Certificate Management

Visibility Gains

• Inventory coverage doubled – The proportion of firms maintaining a complete, up‑to‑date inventory of public SSL/TLS certificates rose from 28% in 2025 to 62% in 2026. Greater visibility is a prerequisite for managing the rapid turnover of certificates.

Shorter Lifespans, Faster Renewals

• Validity periods shrinking – Trusted certificates fell from a 398‑day validity window to 200 days in March 2026, with plans to reach 100 days in 2027 and 47 days by 2029. This compression forces organizations to adopt automated renewal pipelines.
• Automation uptake – Monthly renewal automation grew from 19% to 40% of respondents, and 73% plan further investment in certificate‑management tools.

Challenges Ahead

• Knowledge gaps – Only 40% of those familiar with Merkle Tree Certificates feel they fully understand the systemic changes required for implementation, highlighting a need for clearer guidance and standards.
• Balancing agility and stability – While automation improves speed, the persistent rate of certificate‑related incidents shows that organizations must integrate robust testing, monitoring, and fallback mechanisms into their PKI workflows.

Practical Takeaways

1. Prioritize full vulnerability assessments – Identify quantum‑exposed assets early to inform migration roadmaps.
2. Allocate budget for both PQC algorithms and PKI redesign – Treat cryptographic change as an architectural project, not a one‑off upgrade.
3. Invest in automated inventory and renewal tools – Visibility and speed are essential as certificate lifespans shrink.
4. Develop operational playbooks – Include incident response for certificate failures and regular drills to ensure automation does not become a single point of failure.
5. Stay informed on emerging standards – Track IETF developments such as Merkle Tree Certificates and incorporate them into long‑term PKI strategies.

Conclusion

The data makes it clear: the quantum era is reshaping PKI. Organizations must move from asking if they need to prepare for post‑quantum threats to how they will redesign their cryptographic infrastructure. By coupling thorough risk assessments with strategic budgeting, automation, and a focus on operational resilience, firms can navigate the transition while keeping their security posture robust and their cryptographic processes “boringly reliable.”