AI summaryⓘ
The authors studied how many UK organisations are using post-quantum cryptography (PQC), which helps keep internet connections safe from future quantum computers. They looked at two types of services: websites (HTTPS) and email (SMTP), finding that HTTPS was much more likely to use PQC than email. Most of the PQC use came from a few big infrastructure providers rather than being spread evenly among different sectors or companies. The authors also noticed that very few organisations supported PQC on both email and web services, showing the adoption is uneven. They emphasize that just seeing PQC use publicly doesn't fully show how ready an organisation really is for the transition to quantum-safe security.
Post-quantum cryptographyQuantum-safe securityHTTPSSMTP STARTTLSKey-exchangeInfrastructure providersOrganisational readinessMigrationPublic deployment
Abstract
Post-quantum cryptography (PQC) is becoming an important component of long-term trust in Internet-facing infrastructure. Publicly observable PQC support provides evidence of externally visible deployment, but does not necessarily reflect the overall progress of an organisation's post-quantum migration. This distinction matters when observable deployment is used as an indicator of organisational readiness or progress towards migration deadlines. We present a measurement study of observable PQC deployment across 4,665 UK organisations spanning ten sectors. We measure post-quantum key-exchange support across HTTPS and SMTP STARTTLS endpoints, attribute reachable endpoints to their underlying infrastructure providers where possible, and statistically examine protocol-, sector-, and provider-level deployment patterns. Among reachable endpoints, 44.0\% of HTTPS services supported at least one evaluated PQC key-exchange group, compared with 6.4\% of SMTP services. Among organisations reachable over both protocols, HTTPS support was significantly more common than SMTP support (matched odds ratio 16.89). Although deployment varied across sectors, infrastructure provider identity was substantially more predictive than organisational sector, and observable deployment was highly concentrated among a small number of providers. Only 144 organisations supported PQC across both web and email infrastructure, highlighting an uneven and fragmented migration landscape. No post-quantum certificate signatures were observed across the measured endpoints. These findings show that observable PQC deployment is currently shaped predominantly by infrastructure-provider deployment decisions and should not be interpreted as a complete measure of organisational migration readiness.