2026 State of Crypto Agility Report reveals quantum-readiness and shorter certificate lifespans continue to put growing pressure on the same legacy trust infrastructure
Sectigo, a global leader in automated Certificate Lifecycle Management (CLM), released its 2026 State of Crypto Agility Report, which finds that organizations are moving beyond awareness of major cryptographic change and into the harder work of executing against it. Seventy-eight percent (78%) of IT and security leaders believe today’s public key infrastructure (PKI) – one of the most widespread applications of cryptography today – will need to change to a great or very great extent to support post-quantum cryptography (PQC), as organizations simultaneously adapt to shorter SSL/TLS certificate lifespans and the operational demands they create.
Also Read: CIO Influence Interview with Srinivasan Panchapakesan, Chief Platform Officer at Hexaware
78% of IT and security leaders believe today’s PKI will need to change to a great or very great extent to support post-quantum cryptography (PQC).
The global study of 500 senior IT and cybersecurity decision-makers shows action is already underway:
- 38% have fully assessed systems vulnerable to quantum computing attacks, up from 14% in 2025, while another 44% say their assessment is mostly complete.
- 83% have budget allocated to quantum-readiness initiatives over the next year, and among those with allocated budgets, 93% expect PQC investment to increase over the next two to three years.
The shift marks a new phase in crypto agility: In 2025, organizations were largely preparing for shorter certificate lifespans and the future transition to PQC. In 2026, both are becoming active operational priorities. But as organizations move from awareness to implementation, the scale of the work ahead is becoming clearer across cryptographic discovery, automation, architecture, governance and investment.
“Organizations have moved from asking whether they need to prepare for cryptographic change to confronting what that change actually requires,” said Nick France, CTO at Sectigo. “PQC is not simply an algorithm swap, and shorter certificate lifespans are not simply a renewal problem. Both require organizations to rethink how they discover, manage, and adapt the cryptographic infrastructure they depend on, across both public and private PKI environments. That ability to execute continuously is what crypto agility looks like in practice.”
PQC readiness moves beyond algorithms to PKI architecture
PKI, across both public and private environments, turns cryptography into operational trust across certificates, authentication, encrypted communications, code signing and machine identity. If PQC keys and signatures are larger or behave differently, the infrastructure that issues, transports, validates and manages them must adapt as well. The report also examines Merkle Tree Certificates (MTCs), a proposed certificate architecture under development through the Internet Engineering Task Force (IETF), as one example of the architectural thinking underway:
- Among respondents familiar with the proposed MTC architecture, only 40% believe they clearly understand the changes their systems, processes, and environments would require to support it.
Shorter certificate lifespans test execution now
While PQC presents an architectural transformation ahead, shorter certificate lifespans are already testing organizations’ ability to operationalize change now. The maximum validity period for publicly trusted SSL/TLS certificates fell from 398 to 200 days in March 2026 and is scheduled to reach 100 days in March 2027 and 47 days in March 2029.
Organizations report meaningful progress, but execution remains incomplete:
- 62% report a complete, up-to-date inventory of public SSL/TLS certificates, more than double the 28% reported in 2025.
- 40% say they are very prepared for monthly renewals because they already have automated systems in place, up from 19%.
- 73% plan to increase certificate-management automation because of shorter lifespans.
- Yet 61% experienced a certificate-related outage or incident in the past 12 months.
The findings expose a central tension in the move from awareness to action: progress does not necessarily mean resilience. Greater visibility, automation and investment are encouraging, but implementation is also revealing dependencies, architectural constraints and operational challenges that become more consequential as change accelerates.
“We’ve entered a time where organizations can no longer manage cryptography as static infrastructure, yet at the same time, we need to make cryptography itself boring again,” adds France. “As algorithms, standards and requirements change, organizations need to be able to adapt without turning every cryptographic transition into a major operational event. The next stage in crypto agility is about turning awareness into repeatable, testable, and scalable operations through an approach built around continuous cryptographic discovery, risk prioritization, migration planning and governed change.”
Catch more CIO Insights: The Overlooked Security Risk Behind Enterprise AI Rollouts
[To share your insights with us, please write to psen@itechseries.com ]
