A new report indicates that nearly half of enterprises lack a designated leader for their post-quantum cryptography (PQC) migration efforts, despite a general belief among organizations that they are prepared for the security implications of quantum computing. The research, conducted by Axiad, highlights potential gaps in ownership, testing, and visibility that could complicate the transition to PQC.
The report emphasizes that a clear understanding of where certificates, cryptographic keys, and algorithms are utilized is a prerequisite for effective PQC migration planning. While approximately 75% of respondents stated they maintain a continuously updated inventory of these assets, the findings on ownership and testing suggest that this visibility does not consistently translate into readiness for migration.
A significant finding is that 46% of organizations do not have a single individual responsible for leading their PQC migration. Among these, 39% reported that responsibility is distributed across a team without a singular owner overseeing the program. This lack of defined ownership is critical, as PQC migration can be a multi-year undertaking impacting systems used for encryption, digital signatures, and authentication. Without a dedicated coordinator, organizations may struggle to translate security objectives into concrete migration plans, budgets, and testing schedules.
Furthermore, about half of the surveyed organizations have not formally assessed whether their public-facing infrastructure supports post-quantum key exchange, limiting their insight into necessary changes. The research also uncovered a disparity in confidence levels, with executives generally more optimistic about cryptographic readiness than PKI specialists who manage certificates and keys. This gap suggests either that executives may be overestimating readiness or that practitioners lack visibility into inventories and assessments conducted elsewhere within the organization, which could directly impact PQC planning and timelines.
The urgency for PQC adoption is underscored by the "harvest now, decrypt later" threat model, where attackers collect encrypted data today with the intention of decrypting it using future quantum computers. This risk is particularly relevant for sensitive information requiring long-term confidentiality, such as healthcare, financial, and classified data. Two-thirds of respondents acknowledged this threat as an active priority and reported taking specific steps, while one-third had not yet taken any particular action.
Even organizations that consider themselves prepared face obstacles in advancing PQC projects. The most frequently cited challenges to migration included competing security priorities, budget constraints, and a perceived need for more regulatory guidance. The report concludes that true PQC readiness requires continuous visibility into the cryptographic environment to replace assumptions with verifiable evidence and actionable insights.
