Industry executives and experts share their predictions for 2026. Read them in this 18th annual VMblog.com series exclusive.
By Tim Callan, Chief Compliance Office, Sectigo
The journey toward quantum-resistant security has reached a critical inflection point, defined by a rapid acceleration from theoretical research to enterprise-wide implementation. We can look at this transition through a clear, three-year timeline:
- 2024 was the year the industry woke up to the post-quantum cryptography (PQC) reality. This was the year the National Institute of Standards and Technology (NIST) finalized foundational standards like FIPS-203, 204, and 205, while major tech players like Apple and Cloudflare began integrating PQC protections into their core platforms.
- 2025 marks the year that enterprises woke up to the scale of the challenge. Faced with twin deadlines for PQC migration and the looming requirement for extreme certificate agility, 90% of organizations have now allocated budgets and recognized the monumental task ahead: the need to build comprehensive cryptographic inventories.
- As we look toward 2026, it will undeniably be the “year of projects.” Organizations are moving past the information-gathering stage and into the active execution of migration roadmaps to secure their digital foundations against the coming quantum era.
The Drivers
In the past year, Sectigo and Omdia introduced the inaugural State of Crypto Agility report, providing clear insight on organizations’ quantum readiness and the factors driving this change. The forces driving this massive shift are a combination of regulatory pressure and existential security threats. Chief among these is the Harvest Now, Decrypt Later (HNDL) attack, where adversaries intercept encrypted data today to decrypt it once quantum computers reach sufficient power-a threat that 60% of organizations now view with extreme concern. However, compliance remains the primary motivator; 57% of organizations cite compliance requirements for how they would prioritize systems for PQC migration.
Simultaneously, the CA/Browser Forum has catalyzed a shift toward “crypto agility” by mandating shorter certificate lifespans. This transition will eventually reduce public SSL/TLS certificate validity to just 47 days, with the first major milestone of a six-month renewal cadence arriving in March 2026. These shortened lifecycles force organizations to modernize their infrastructure, as manual certificate management simply won’t scale when renewals occur 12 times more frequently. This operational necessity for automation is directly intertwined with PQC readiness, as 90% of organizations recognize that the work done to achieve certificate agility also accelerates their broader post-quantum migration.
Benchmarking Progress
Despite high awareness, actual progress in the enterprise remains in its early stages. Based on our research, currently only 14% of organizations have conducted a full assessment of their quantum-vulnerable systems, leaving a vast majority still “flying blind” regarding their cryptographic exposure.
While 80% have some form of migration strategy in mind, a significant 43% remain in a “wait and see” pattern, often stalled by the sheer complexity of legacy infrastructure. Inventorying cryptographic assets is the top priority for 51% of teams, yet only 16% have successfully launched pilot projects. This gap between planning and execution is exacerbated by a massive skills shortage; an alarming 97% of organizations report significant PQC-related skills gaps, with the most acute needs found in implementation experience and deep cryptography expertise.
Furthermore, only 15% of IT leaders feel “extremely confident” in their current system’s ability to integrate PQC without major disruption. These figures highlight that while the budget and intent are finally present, the technical and operational hurdles of heterogeneous systems and decentralized teams remain the primary barriers to success.
The 2026 Roadmap
To become PQC-ready in 2026, organizations must pivot from reactive planning to proactive project management. The most successful enterprises will be those that treat PQC not as a one-time security patch, but as a permanent shift toward cryptographic agility by design.
A critical step in this journey is the establishment of a Cryptographic Center of Excellence (CryptoCOE). Gartner predicts that organizations with a centralized CryptoCOE will save 50% of their migration costs by 2028 compared to those operating without one.
In the coming year, the focus must shift toward full automation of the certificate lifecycle, which is the only way to mitigate the 12x increase in renewal risk and avoid widespread service outages. Leaders should prioritize systems based on data sensitivity and risk level, moving quickly to remediate legacy applications written in hardcoded languages that lack modular cryptographic design.
By March 2026, when the 200-day certificate deadline hits, organizations should already have their discovery and inventory processes automated. Ultimately, the choices made in 2026 will define a company’s resilience. By embracing automation and visibility now, enterprises can transform the “quantum apocalypse” into a manageable operational transition.
##
ABOUT THE AUTHOR
As Chief Experience Officer, Tim Callan leads efforts to optimize the customer journey across all aspects of the business. Tim has more than 20 years of experience as a strategic marketing and product leader for successful B2B software and SaaS companies, with 15 years of experience in the SSL and PKI technology spaces.
Tim Callan has over 20 years of experience in the SSL and PKI technology spaces. Tim leads Sectigo’s conformance with industry and regulatory requirements including browser root programs, WebTrust, CA/Browser Forum, and more. Tim is instrumental in driving initiatives to improve certificate agility and successful issuance. A founding member of the CA/Browser Forum and current vice-chair for one of its working groups, Tim is creator and co-host of Root Causes: A PKI and Security Podcast, the world’s most popular podcast dedicated to digital certificates. With 400+ episodes published, Tim is on the forefront of explaining trends that will be essential to the IT professionals, including shortening certificate lifespans and the coming change to post-quantum cryptography.
