Opinion · Hometown Post
Sectigo Research Finds 78% of IT and Security Leaders Expect PKI to Change Significantly to Support Post-Quantum Cryptography 2026 State of Crypto Agility Report reveals quantum-readiness and shorter certificate lifespans continue to put growing pressure on the same legacy trust infrastructure Sectigo , a global leader in automated Certificate Lifecycle Management (CLM), today released its 2026 State of Crypto Agility Report , which finds that organizations are moving beyond awareness of major cryptographic change and into the harder work of executing against it. Seventy-eight percent (78%) of IT and security leaders believe today’s public key infrastructure (PKI) – one of the most widespread applications of cryptography today – will need to change to a great or very great extent to support post-quantum cryptography (PQC), as organizations simultaneously adapt to shorter SSL/TLS certificate lifespans and the operational demands they create. This press release features multimedia.
View the full release here: https://www.businesswire.com/news/home/20261028952486/en/ Sectigo’s 2026 State of Crypto Agility Report examines how 500 global IT and security leaders are preparing for post-quantum cryptography (PQC), shorter certificate lifespans and evolving PKI requirements, including the need for greater crypto agility and automated certificate lifecycle management (CLM). The global study of 500 senior IT and cybersecurity decision-makers shows action is already underway: 38% have fully assessed systems vulnerable to quantum computing attacks, up from 14% in 2025, while another 44% say their assessment is mostly complete. 83% have budget allocated to quantum-readiness initiatives over the next year, and among those with allocated budgets, 93% expect PQC investment to increase over the next two to three years. The shift marks a new phase in crypto agility: In 2025, organizations were largely preparing for shorter certificate lifespans and the future transition to PQC.
In 2026, both are becoming active operational priorities. But as organizations move from awareness to implementation, the scale of the work ahead is becoming clearer across cryptographic discovery, automation, architecture, governance and investment. “Organizations have moved from asking whether they need to prepare for cryptographic change to confronting what that change actually requires,” said Nick France, CTO at Sectigo.
“PQC is not simply an algorithm swap, and shorter certificate lifespans are not simply a renewal problem. Both require organizations to rethink how they discover, manage, and adapt the cryptographic infrastructure they depend on, across both public and private PKI environments. That ability to execute continuously is what crypto agility looks like in practice.” PQC readiness moves beyond algorithms to PKI architecture PKI, across both public and private environments, turns cryptography into operational trust across certificates, authentication, encrypted communications, code signing and machine identity.
If PQC keys and signatures are larger or behave differently, the infrastructure that issues, transports, validates and manages them must adapt as well. The report also examines Merkle Tree Certificates (MTCs), a proposed certificate architecture under development through the Internet Engineering Task Force (IETF), as one example of the architectural thinking underway: Among respondents familiar with the proposed MTC architecture, only 40% believe they clearly understand the changes their systems, processes, and environments would require to support it. Shorter certificate lifespans test execution now While PQC presents an architectural transformation ahead, shorter certificate lifespans are already testing organizations’ ability to operationalize change now.
The maximum validity period for publicly trusted SSL/TLS certificates fell from 398 to 200 days in March 2026 and is scheduled to reach 100 days in March 2027 and 47 days in March 2029. Organizations report meaningful progress, but execution remains incomplete: 62% report a complete, up-to-date inventory of public SSL/TLS certificates, more than double the 28% reported in 2025. 40% say they are very prepared for monthly renewals because they already have automated systems in place, up from 19%. 73% plan to increase certificate-management automation because of shorter lifespans. Yet 61% experienced a certificate-related outage or incident in the past 12 months.
The findings expose a central tension in the move from awareness to action: progress does not necessarily mean resilience. Greater visibility, automation and investment are encouraging, but implementation is also revealing dependencies, architectural constraints and operational challenges that become more consequential as change accelerates. “We’ve entered a time where organizations can no longer manage cryptography as static infrastructure, yet at the same time, we need to make cryptography itself boring again,” adds France.
“As algorithms, standards and requirements change, organizations need to be able to adapt without turning every cryptographic transition into a major operational event. The next stage in crypto agility is about turning awareness into repeatable, testable, and scalable operations through an approach built around continuous cryptographic discovery, risk prioritization, migration planning and governed change.” The 2026 State of Crypto Agility Report is available here: https://www.sectigo.com/state-of-crypto-agility-report . Additional resources: Methodology Censuswide collected 500 global survey responses from C-level, vice-president and director-level leaders in IT, technical operations, cybersecurity and risk across a mix of industries and business sizes, North America, EMEA and APAC.
About Sectigo Sectigo is a leading provider of Certificate Lifecycle Management (CLM), helping organizations secure human and machine identities while reducing the hidden risks of modern digital trust. As certificate volumes grow and lifespans shrink, unmanaged certificates are becoming a source of outages, compliance exposure, and operational disruption. Sectigo uses orchestrated automation to deliver Simplicity at Scale through its cloud native CLM platform, bringing visibility, control, and lifecycle management together across complex environments.
With more than 700,000 customers, including 65% of the Fortune 500, Sectigo is one of the largest and longest standing certificate authorities, with over 20 years of delivering unparalleled digital trust. For more information, visit https://www.sectigo.com/ or follow us on LinkedIn . Media contact press@sectigo.com View source version on businesswire.com: https://www.businesswire.com/news/home/20261028952486/en/ The articles, information, and content displayed on this webpage may include materials prepared and provided by third parties.
Such third-party content is offered for informational purposes only and is not endorsed, reviewed, or verified by Morningstar. Morningstar makes no representations or warranties regarding the accuracy, completeness, timeliness, or reliability of any third-party content displayed on this site. The views and opinions expressed in third-party content are those of the respective authors and do not necessarily reflect the views of Morningstar, its affiliates, or employees.
Morningstar is not responsible for any errors, omissions, or delays in this content, nor for any actions taken in reliance thereon. Users are advised to exercise their own judgment and seek independent financial advice before making any decisions based on such content. The third-party providers of this content are not affiliated with Morningstar, and their inclusion on this site does not imply any form of partnership, agency, or endorsement.
Source: Morningstar
