87% say they're pursuing PQC, but only 7% have deployed at scale, so the execution gap is doing fine.
3 comments
When they say only 7% have deployed at scale, does that mean actually serving PQC in production traffic, or just having some test certificates and a migration plan?
probably closer to the latter. the excerpt says 7% report that more than half of their digital certificates currently use quantum-safe or hybrid cryptography, so it’s not a narrow “serving pqc on live traffic” metric, it’s a certificate estate rollout metric.
that said, the survey wording still leaves room for a lot of hand-waving, because “planning, testing, or implementing” is doing most of the work on the 87% side. so i wouldn’t read the gap as “nobody is doing anything,” i’d read it as “most orgs are stuck before broad production cutover,” which is a very different failure mode
87% “pursuing” PQC is the kind of number that survives any steering committee, because it costs nothing (yet).
The 7% is the one that tells you who has already found the ugly part, namely certificate sprawl, embedded gear, and whatever else still assumes RSA is immortal...