Key points
- % of top websites support post-quantum key exchange, but this figure drops to 22% when excluding Cloudflare-hosted sites.
- Only 27% of CISOs are actively implementing post-quantum cryptography across their organisations, according to a KPMG survey.
- Protection at the web edge does not extend to internal servers, APIs, or service-to-service communications.
The short version
- F5 Labs research reveals that CDN providers are driving most visible post-quantum cryptography adoption on the web.
- Removing Cloudflare-hosted sites from the data set reduces the global support figure from 54% to just 22%.
- Internal enterprise connections remain largely unsecured, creating significant exposure to future quantum computing threats.
The details
Recent research from F5 Labs indicates that more than half of the world’s top one million websites now support post-quantum key exchange. This statistic appears positive, yet it contrasts sharply with internal organisational readiness. A June survey by KPMG found that only 27% of chief information security officers are actively implementing post-quantum cryptography within their businesses. This discrepancy suggests that many organisations may be mistaking protection at their website’s front door for comprehensive quantum readiness.
The apparent progress is largely attributed to content delivery network providers switching on protection by default. David Warburton, director of F5 Labs, noted that the 54% figure is misleading because it relies heavily on CDN defaults. When sites hosted by Cloudflare are removed from the calculation, the support rate drops significantly to 22%. This indicates that the visible layer of the web is becoming more secure, while the underlying infrastructure remains largely unchanged.
The study focused exclusively on the website’s front end, without assessing application servers located behind CDNs such as Akamai, Cloudflare, or Amazon CloudFront. Consequently, the research did not determine whether internal traffic uses post-quantum cryptography. Warburton warned that these internal connections could be prime targets for harvest now, decrypt later attacks, where adversaries collect encrypted data today with the intention of decrypting it once quantum computers become powerful enough.
The context
Independent experts agree that true readiness requires upgrading every layer of the technology stack. Serhii Nikolaichuk, founder of The Capital Index, explained that everything behind the CDN-enabled protection—including the hop to the origin, service meshes, VPNs, SSH, and code signing—is invisible from the outside. He argued that enterprise readiness actually resides in these hidden internal connections, not at the public-facing edge.
Anastazija Pažin, a senior cybersecurity consultant at Deloitte, stated that while edge adoption is meaningful, it is not a reliable measure of overall enterprise readiness. She clarified that CDN-enabled protection provides genuine security for the client-to-edge connection but does not automatically extend to the origin server, internal APIs, or enterprise public key infrastructure. This limitation leaves critical internal communications exposed despite the appearance of external security.
Defender's checklist
Organisations must look beyond public-facing website metrics to assess their true quantum posture. Security leaders should verify whether their internal service-to-service communications are protected by post-quantum algorithms. It is essential to distinguish between protection provided by third-party CDN defaults and security implemented within the organisation’s own infrastructure.
What to do and how to stay safe: F5 Labs
- Audit internal service-to-service communications to identify connections that rely on classical cryptography rather than post-quantum algorithms.
- Review CDN configurations to determine if post-quantum support is enabled by default or if it requires explicit organisational action.
- Assess the risk of harvest now, decrypt later attacks on sensitive data stored on internal servers behind the CDN.
- Monitor vendor updates regarding post-quantum cryptography implementations for internal APIs and enterprise PKI systems.
Step-by-step guide: Phishing vs Spear Phishing: Targeting Mechanics and Defence
General security guidance from the Cipher Insider newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What percentage of top websites support post-quantum key exchange?
According to F5 Labs research, 54% of the world’s top one million websites support post-quantum key exchange.
How does removing Cloudflare-hosted sites affect the adoption statistic?
Removing Cloudflare-hosted sites from the data set causes the support figure to drop from 54% to 22%.
Are internal enterprise connections covered by CDN post-quantum protection?
No, CDN protection does not automatically extend to internal APIs, service-to-service communications, or origin servers.
