Post-Quantum Readiness Statistics Guide: Migration Progress and Deadlines

Post-quantum cryptography (PQC) planning is full of confident predictions about "Q-Day" and very few numbers that can be traced to a named survey, measurement or audit. This page collects the readiness statistics that can be traced: organisational surveys from ISACA and the Capgemini Research Institute, internet measurement from Cloudflare, expert estimates from the Global Risk Institute Quantum Threat Timeline Report, the US Office of Management and Budget (OMB) migration cost estimate and the US Government Accountability Office (GAO) audit of federal agencies, plus the official timelines from the UK NCSC and NIST that readiness should be measured against. Each figure carries its publisher, report and date, and expert opinion is labelled as opinion. It is for CISOs, cryptography and PKI owners, architects and risk teams building a migration business case. Last reviewed: November 2026.

Key takeaways

• Most organisations have no plan yet. ISACA's 2025 Quantum Computing Pulse Poll of more than 2,600 professionals finds only 5% say their organisation has a defined quantum computing strategy, and 44% have never heard of the NIST post-quantum standards.
• Large enterprises are further ahead. The Capgemini Research Institute's 2025 survey of 1,000 organisations with revenue of at least USD 1 billion finds about 70% are early adopters working on, or planning, quantum-safe solutions within five years.
• The web is moving faster than enterprises. Cloudflare measured post-quantum encryption on 52% of human-generated web traffic in early December 2025, up from 29% at the start of the year, mostly because browsers and operating systems turned it on by default.
• Inventories are the bottleneck. GAO found that only one of 24 major US federal agencies fully addressed all applicable cryptographic inventory activities, and only five used automated discovery tools.
• Timelines are set, the threat date is not. The UK NCSC sets 2028, 2031 and 2035 milestones, while Global Risk Institute experts put the chance of a cryptographically relevant quantum computer within 10 years at 28 to 49%.

Headline statistics

Statistics by theme

Organisational awareness and strategy

• What the prepared minority does: among organisations that have started, ISACA finds 46% assessing regulatory implications, 38% exploring quantum-safe cryptography, 27% investing in proofs of concept and 27% training staff.
• Who answered: ISACA surveyed more than 2,600 digital trust, cyber security, IT audit, governance and risk professionals globally. It measures what practitioners know about their organisation, and 40% said they were not aware of their company's plans, so the strategy figure is a floor rather than a precise rate.

Enterprise adoption among large organisations

• Early adopters: Capgemini's "Future encrypted" report (10 July 2025) surveyed 1,000 organisations with revenue of at least USD 1 billion across 13 countries and 13 sectors in April and May 2025. About 70% are early adopters, defined as working on or planning quantum-safe solutions within five years.
• Stage of work: nearly half of early adopters are exploring, assessing or piloting PQC solutions, which means most have not deployed in production.
• Drivers: 70% cite regulatory mandates as a key driver, and 65% are concerned about harvest now, decrypt later attacks.
• Laggards: 30% are not addressing the quantum threat, mainly because of difficulty allocating budget and people.
• Expected timing: about six in ten early adopters expect a cryptographically relevant quantum computer within 5 to 10 years, and one in six within five years.

The gap between ISACA's 5% and Capgemini's 70% is mostly a population difference: ISACA asks a broad practitioner base about organisations of every size, Capgemini asks very large enterprises and counts plans as well as strategies. Neither is wrong, and quoting either without its population misleads.

Internet deployment

• Key exchange, not signatures: the traffic growth is hybrid key agreement, X25519MLKEM768, which combines X25519 with ML-KEM-768 and is enabled by default in recent major browsers and Apple operating systems. It protects data in transit against harvest now, decrypt later. It does nothing for authentication, which still relies on classical certificates. See the Hybrid Post-Quantum TLS Key Exchange Guide.
• What it does not show: Cloudflare's figure covers traffic between clients and its edge. Internal TLS, VPNs, SSH, code signing, PKI and machine-to-machine connections inside enterprises are not in this measure and are typically far behind.

Government readiness: the US federal picture

• Audit result: GAO-27-108740, "Quantum Computing: Federal Actions Needed to Prepare for Emerging Cyber Threat" (publicly released 6 October 2026, a public version of a September 2025 sensitive report), assessed all 24 CFO Act agencies against three PQC transition practices. None fully addressed them.
• Inventories: one agency fully addressed all applicable inventory activities, one had no inventory and 22 were partial. Only one documented an inventory maintenance process, and only five used automated discovery tools.
• Skills and funding: six agencies had trained staff on cryptography, while 18 reported a lack of expertise with no plan to close it. No agency fully addressed funding assessment, and 11 cited missing vendor cost data.
• Testing: no agency had tested PQC implementations; 16 said it was too early.
• Recommendations: the sensitive report made 89 recommendations to CISA and the agencies.
• Cost: OMB's July 2024 Report on Post-Quantum Cryptography estimates about USD 7.1 billion in 2024 dollars to migrate prioritised federal non-national security systems between 2025 and 2035, described as a rough order of magnitude with high uncertainty. Replacing systems that cannot accept new algorithms is a major cost driver.

The federal figures matter outside government because they are the only large, audited dataset on cryptographic inventory quality. If agencies with mandates since OMB M-23-02 (November 2022) struggle to inventory, most private organisations without a mandate are unlikely to be further ahead.

Threat timing estimates

• Expert survey: the Global Risk Institute's Quantum Threat Timeline Report 2025 by Michele Mosca and Marco Piani of evolutionQ, published in March 2026, surveyed 26 experts. Their aggregated estimates put a cryptographically relevant quantum computer (CRQC) within 10 years at 28 to 49%, "quite possible", and within 15 years at 51 to 70%, "likely".
• GAO's reading: GAO notes that most experts expect a CRQC possibly in the 2030s, and cites a December 2024 survey of 32 experts that mostly put the probability above 50% by 2040.
• How to use them: these are probability judgements, not forecasts of a date. Combine them with how long your data must stay confidential and how long migration will take (Mosca's inequality) rather than quoting a single year. See the Harvest Now Decrypt Later Risk Assessment Template.

Official timelines to measure readiness against

For dated milestones across more jurisdictions, use the Post-Quantum Cryptography Deadlines Tracker and the NIST IR 8547 PQC Transition Timeline Guide.

What the numbers mean for your programme

• Small versus large organisations: a small organisation mostly inherits PQC through browsers, operating systems, cloud providers and SaaS, so its job is supplier questions, keeping software current and finding the few in-house systems with hard-coded cryptography. A large enterprise needs automated discovery, a CBOM, a crypto-agility architecture and a funded multi-year plan. See the Post-Quantum Readiness Maturity Model.
• Where identity fits: certificates, SSH keys, code signing keys and the tokens issued to workloads are where quantum-vulnerable signatures live, and most belong to non-human identities. See the Post-Quantum Migration for NHIs Guide.

How to turn these statistics into a readiness plan:

1. Establish your own baseline: measure the share of external TLS endpoints already negotiating hybrid key exchange, the number of certificate authorities and signing keys, and the share of systems covered by automated discovery.
2. Discover and record: run discovery tools in read-only mode, reconcile with the CMDB and PKI records, and publish a CBOM with owners. See the Cryptographic Inventory and CBOM Guide.
3. Prioritise by data lifetime: rank systems by how long their data must remain confidential and how hard they are to change.
4. Pilot hybrid key exchange: enable X25519MLKEM768 on one external service, monitor handshake failures from middleboxes and old clients, and keep the classical-only configuration ready as a rollback.
5. Fix procurement: add PQC and crypto-agility questions to supplier reviews and renewals. See the PQC Supplier Readiness Questionnaire Template.
6. Review yearly against the NCSC milestones: discovery and plan by 2028, priority migrations by 2031, completion by 2035.

Metrics that show readiness is improving:

• Discovery coverage: share of systems scanned by automated cryptographic discovery.
• CBOM completeness: share of cryptographic assets with a named owner and algorithm recorded.
• Hybrid key exchange: share of external TLS connections negotiating a post-quantum hybrid group.
• Non-agile systems: count of systems that cannot accept new algorithms, with replacement dates.
• Supplier readiness: share of critical suppliers with a stated PQC roadmap.

Common failure patterns when using PQC statistics

• Reading web traffic as enterprise readiness: Cloudflare's 52% reflects browser defaults on public web traffic, not internal systems, PKI or signatures.
• Comparing ISACA and Capgemini directly: 5% with a strategy and 70% early adopters come from different populations and definitions.
• Quoting a Q-Day year: expert surveys give probability ranges. A single date presented as fact is not supported by any source on this page.
• Treating key exchange as the whole migration: signatures, certificates and code signing have no public post-quantum deployment yet and take longer.
• Using old draft status: NIST IR 8547 moved from initial public draft to final in October 2026. Check status before citing any transition document.

Methodology notes and caveats

Practitioner checklist

• Quote every figure with publisher, report, date and population.
• Separate key exchange readiness from signature and PKI readiness in all reporting.
• Run automated cryptographic discovery and publish a CBOM with owners.
• Enable hybrid ML-KEM key exchange on external TLS where your stack supports it, with a tested rollback.
• Record systems that cannot accept new algorithms and plan their replacement.
• Add PQC questions to supplier reviews and contract renewals.
• Use probability ranges and data lifetimes, not a single Q-Day year, in board papers.
• Track progress against the NCSC 2028, 2031 and 2035 milestones.
• Refresh this page's figures when ISACA, Capgemini, Cloudflare, GAO and the Global Risk Institute publish new editions.

Standards and references

• NIST: IR 8547, Transition to Post-Quantum Cryptography Standards
• NCSC: Timelines for migration to post-quantum cryptography
• GAO: Quantum Computing, Federal Actions Needed to Prepare for Emerging Cyber Threat (GAO-27-108740)
• OMB: Report on Post-Quantum Cryptography
• ISACA: Quantum Computing Pulse Poll press release
• Capgemini Research Institute: Future encrypted press release
• Cloudflare: Radar 2025 Year in Review
• Global Risk Institute: Quantum Threat Timeline Report 2025

Related NHI Mgmt Group resources: Post-Quantum Cryptography Migration Guide, Post-Quantum Readiness Guide, Crypto-Agility Guide, Post-Quantum Cryptography Executive Briefing, Cryptographic Discovery and PQC Readiness Tools Buyer's Guide.