Industries protecting critical infrastructure are most exposed to the cryptography-breaking threat of quantum computing, new research from F5 Labs has found.
For its 2026 State of Post-Quantum Cryptography (PQC) Report, F5 Labs scanned the world’s top one million websites to assess their readiness for the arrival of quantum computing that will threaten widely used public-key cryptography.
Industry and country analysis covered the top 100,000 domains. It found that just 34.5% of websites in the oil and gas industry, 35.2% in telecommunications, 35.4% in government, and 39.4% in utilities have adopted post-quantum cryptography (PQC) capable of resisting attacks by quantum computers. Across the full scan of the top one million websites, the global average was 54%.
Organizations in these industries safeguard critical assets, sensitive personal data, and classified state communications. Yet they are the least prepared for the looming threat of quantum computing that will upend decades of orthodoxy in encryption and cyber security.
“The dangerous paradox of quantum security is that the industries managing essential infrastructure are in the bottom quartile of readiness,” said report author David Warburton, Director of F5 Labs.
“Many organizations in these industries are constrained by a combination of data sovereignty requirements, supervisory control and data acquisition systems, and lengthy procurement cycles. The very control they exercise over their data and vendor base is limiting their agility and exposing them to the threat of quantum computing, with the potential it carries to overwhelm traditional encryption methods.”
Hidden dangers
Across the board, PQC adoption has increased significantly. It has effectively doubled since 2025 on a like-for-like scanning basis, while the enhanced 2026 methodology puts the global level at 54%.
Yet this aggregate figure conceals hidden vulnerabilities.
Industries such as consumer services (58.8%), technology (56.1%) and consumer goods (49.8%) have relatively high levels of adoption because they route inbound traffic through hyperscale edge platforms, including Fastly, AWS CloudFront and, most notably Cloudflare, which have enabled hybrid PQC key exchanges by default. The impact of this can be measured by removing Cloudflare-hosted domains from the dataset, at which point global PQC adoption falls to just 22%.
These platforms are also more utilized by smaller organizations, meaning PQC adoption peaks in the middle ranks of the top 1 million websites (80% for those ranked 80,000 to 220,000), while the top-ranking sites show lower levels of readiness.
Technical debt represents a further vulnerability: 10.51% of sites that responded to F5 Labs’ scan lack any support for TLS 1.3, which automatically excludes them from negotiating post-quantum connections and makes quantum readiness impossible without significant rearchitecting.
“The landscape of PQC readiness appears calm, but icebergs are lurking under the surface,” added Warburton. “While a majority of the world’s top million websites now support post-quantum key exchange, that has come about not through proactive engineering but passive reliance on a handful of edge platforms.
“This creates the illusion of quantum shielding but only guards the front door while leaving swathes of infrastructure and access points unprotected. While external pages and checkout flows may be well protected, internal application tiers, private API ecosystems and corporate databases frequently remain anchored to legacy cryptographic infrastructure and are as such vulnerable to future quantum decryption.”
Regional differences: a mixed picture
PQC readiness varies as much by region as it does industry, with cloud architecture choices, local hosting ecosystems and digital sovereignty regulations all having a significant bearing.
In the UAE, 56.7% of websites have adopted PQC, while in Saudi Arabia the figure is 53.66%, according to F5’s research.
The pace-setter is Ukraine, whose organizations showed the highest PQC success rate (65.12%). That has been the result of a comprehensive migration of public infrastructure to US-based platforms, undertaken to support operational resilience due to hybrid warfare with a significant cyber dimension.
The Five Eyes nations also performed strongly, with Australia (63.11%), the United States (62.05%) and the United Kingdom (60.95%) similarly benefiting from US infrastructure, alongside PQC migration timelines from national cybersecurity bodies which have been aligned across the Five Eyes.
By contrast, major EU nations lagged significantly, constrained from PQC adoption by a combination of the preference for on-premises data centers, European cloud providers that have not enabled PQC at the edge as a default, and cautious guidance from cybersecurity agencies about post-quantum algorithms. Denmark (48.79%), Netherlands (46.44%) and Spain (45.23%) were the continent’s stronger performers, some way ahead of Italy (39.74%), France (39.19%) and Germany (35.78%).
A reliance on on-premises infrastructure and domestic hosting providers also saw low levels of PQC adoption in Taiwan (38.26%), Japan (29.69%) and South Korea (29.08%), while the outliers at the low end of readiness were the Russian Federation (16.09%) and China (13.03%), both of which are more likely to utilize legacy domestic providers.
“Organizations lagging on quantum resilience are not simply storing up problems for the future: they face operational liabilities right now,” explained Warburton.
“Beyond mandatory regulatory timelines for post-quantum implementation, enterprises must recognize that their encrypted data is already being gathered by adversaries under Harvest Now, Decrypt Later (HNDL) campaigns.
“It means that the threat is already here, and the window for complacency has closed. To build resilience, organizations must conduct comprehensive audits of their cryptographic touchpoints, eradicate technical debt that leaves them vulnerable, provide transitional protection for legacy systems, overhaul their certificate lifecycle management and enforce crypto-agility throughout their supply chain.
“By leveraging the F5 Application Delivery and Security Platform (ADSP) with BIG-IP SSL Orchestrator, enterprises can immediately enable hybrid post-quantum key exchange on the public internet side while maintaining classical cryptography to legacy applications on the inside. This allows organizations to establish instant post-quantum protection for public-facing connections.
“Q-Day – the tipping point when quantum computing is capable of overwhelming traditional encryption – may not yet be imminent, but the deadline has already passed to be building resilience against that threat.”