Rethinking Quantum Readiness: Beyond Edge Security to Comprehensive Preparedness

The looming quantum threat is increasingly on the radar of security leaders, yet many might confuse simple front-end protections with comprehensive quantum readiness.

Recent data from F5 Labs indicates that 54% of the world's top one million websites utilize post-quantum key exchange capabilities. This statistic is promising, especially considering that only 27% of Chief Information Security Officers (CISOs), according to a June KPMG survey, are actively putting post-quantum cryptography (PQC) into practice.

However, F5 Labs’ State of PQC on the Web report suggests that a significant portion of this progress stems from content delivery network (CDN) providers enabling PQC by default, rather than organizations enhancing their own infrastructures to address the top emerging threat perceived by 38% of CISOs in the same survey.

“While 54% seems to indicate we’re on the path to a quantum-safe web, it's vital to clarify what that means,” says David Warburton, director of F5 Labs. “Much of this support is attributed to CDN providers like Cloudflare, and if you eliminate those sites from the data, the percentage plummets to just 22%.”

The analysis conducted by F5 Labs focused only on the public-facing aspects of websites and didn't explore the status of internal application servers behind these CDNs. For instance, providers such as Akamai or Amazon CloudFront were not assessed for their internal traffic's PQC readiness.

“The internal links represent a potentially larger target vulnerable to 'harvest now, decrypt later' attacks,” warns Warburton.

Serhii Nikolaichuk, founder of The Capital Index, emphasizes this point: everything behind what CDNs activate—encompassing the hop to the origin, service meshes, VPNs, SSH, and code signing—remains largely unseen from external views, and herein lies the essence of true enterprise quantum readiness.

Beyond the Edge

Independent experts endorse F5 Lab's conclusion, stressing that genuine post-quantum readiness requires an overhaul at every layer of the tech stack. While progress on the edge is a good start, it doesn't provide a reliable measure of an organization's overall preparedness, asserts Anastazija Pažin, a senior cyber security consultant at Deloitte.

“PQC enabled through CDNs offers real protection for connections from clients to the edge, but it’s important to note that this safeguard doesn’t extend to origin servers, internal APIs, service communications, or enterprise public key infrastructures (PKI),” Pažin explains.

This discrepancy arises partly because central implementation guidance has only recently started aligning with foundational standards, notes Ben Packman, chief strategy officer at PQC specialist PQShield. “NIST’s initial PQC standards were finalized in 2024, and the IETF only published the standard for hybrid post-quantum key exchange mechanisms for TLS 1.3 recently in August,” he adds.

Technical Debt

Many organizations are constrained by legacy technologies and existing dependencies, complicating the upgrade path essential for quantum cryptography.

Factors such as outdated client systems, partner integrations, and sluggish change-control processes can significantly slow everything down. A number of vendors have yet to adapt their products for PQC.

“The 54% statistic pertains solely to PQC key exchange support. PQC certificates haven't been rolled out for the public internet yet,” Warburton points out. For example, Merkle Tree Certificates may aid desktop and mobile browsers, but many environments still require PQC certificates, which could lead to scalability issues due to their size.

Certificate management is yet another challenge organizations must overcome.

“Manual certificate provisioning will create significant hurdles as 47-day certificate lifetimes become enforced,” concludes Warburton.

The gap in PQC readiness becomes particularly concerning in sectors that deal with sensitive, long-held data. For instance, only 35% of government and telecommunications websites in the survey supported post-quantum key exchange capabilities.

Industry Differences

Organizations in government and critical infrastructure typically encounter longer procurement cycles, self-hosted systems, and operational technologies that have a longer lifecycle, complicating their quantum readiness.

Across the broader sample studied by F5 Labs, over 10% of responding websites still lacked TLS 1.3 support—the essential groundwork for post-quantum key exchanges tested by F5.

While safeguarding a website's public edge is a commendable step, F5 argues it does not guarantee that an organization’s internal servers and applications are also prepared for quantum threats.

However, Chris Hickman, CSO at digital trust infrastructure vendor Keyfactor, believes F5’s figures do not fully capture the complete picture of PQC initiatives. “The top sectors demonstrating full PQC readiness include financial services, telecommunications, and government, with healthcare rapidly advancing its efforts,” Hickman shares. “The disparity lies in the focus on web readiness versus overall organizational preparedness.”

Financial institutions and critical infrastructure entities are actively addressing PQC by conducting cryptographic inventories, performing risk assessments, and establishing migration roadmaps. Yet, as Deloitte’s Pažin highlights, planning and deployment maturity shouldn't be mistaken for each other.

“Financial entities deal with intricate dependencies tied to hardware security modules, payment systems, PKI, and external services,” Pažin notes. “Telecom firms have to navigate extensive network infrastructures while industrial settings present their challenges due to long-term operational technologies and finite chances for critical upgrades.”

Pažin further emphasizes, “Organizations that have relatively mature cybersecurity governance frameworks frequently encounter significant challenges in implementation.”

Preparing for PQC

To gear up for PQC, organizations should first conduct a thorough inventory of existing cryptographic practices, targeting data that needs to remain confidential for extended periods, and strategizing upgrades for their most challenging systems.

“This requires looking beyond just your public-facing website and examining internal applications, APIs, VPNs, identity management systems, and embedded libraries,” advises Warburton from F5 Labs. “Create a cryptographic inventory and ensure that someone is responsible for its continuous update.”

Organizations should make strides in eliminating legacy dependencies, enabling hybrid PQC solutions where feasible, and automating certificate management processes. “You must design your systems to switch algorithms and certificates without turning each change into a significant project,” Warburton urges.

Pažin of Deloitte wraps up with a critical insight: “A meaningful assessment of enterprise readiness should evaluate if an organization comprehends its cryptographic dependencies, prioritizes assets according to quantum-related vulnerabilities, and can substitute at-risk algorithms without major architectural upheavals.”