Report by Sectigo
2026 State of Crypto Agility Report
Key Findings
38% have fully assessed systems vulnerable to quantum computing attacks, up from 14% in 2025.
44% say their assessment of systems vulnerable to quantum computing attacks is mostly complete.
83% have budget allocated to quantum-readiness initiatives over the next year.
Among organizations with allocated quantum-readiness budgets, 93% expect PQC investment to increase over the next two to three years.
The maximum validity period for publicly trusted SSL/TLS certificates fell from 398 days to 200 days in March 2026.
The maximum validity period for publicly trusted SSL/TLS certificates is scheduled to reach 100 days in March 2027 and 47 days in March 2029.
62% of organizations report a complete, up-to-date inventory of public SSL/TLS certificates, more than double the 28% reported in 2025.
40% say they are very prepared for monthly renewals because they already have automated systems in place, up from 19%.
73% plan to increase certificate-management automation because of shorter lifespans.
61% experienced a certificate-related outage or incident in the past 12 months.
78% of global IT and security leaders believe today’s public key infrastructure (PKI) will need to change to a great or very great extent to support post-quantum cryptography (PQC).
Among respondents familiar with the proposed Merkle Tree Certificates (MTC) architecture, only 40% believe they clearly understand the changes their systems, processes, and environments would require to support it.