Nearly half of enterprises have no one leading PQC migration
Enterprises believe they are prepared for the security challenges posed by quantum computing, but gaps in ownership, testing and visibility could complicate their transition to post-quantum cryptography (PQC), according to new research from Axiad.
Who owns PQC migration? (Source: Axiad)
Organizations need to know where certificates, cryptographic keys and algorithms are used before they can plan a PQC migration. About 75% of respondents said they maintain a continuously updated inventory of these assets. However, responses about ownership and testing indicate that visibility does not always translate into migration readiness.
“PQC readiness cannot be based on what an organization believes it has under control. It has to be based on what it can actually see, verify, and act on,” said David Canellos, CEO of Axiad.
“Organizations may believe they know where their certificates, keys, and cryptographic algorithms reside, but this research shows that confidence can fall apart when you ask who owns the migration, what has actually been tested, and where the organization remains exposed. The first step toward post-quantum readiness is establishing continuous visibility into the cryptographic environment so leaders can replace assumptions with evidence.”
PQC migration lacks defined ownership
Some 46% of organizations have no single person responsible for leading their PQC migration. Most of these organizations distribute responsibility across a team without assigning one person to oversee the program. The report found that 39% said responsibility was shared across a team with no single owner.
Defined ownership matters because PQC migration can span several years and affect systems used for encryption, digital signatures and authentication. Without someone responsible for coordinating the work, organizations may struggle to turn security goals into migration plans, budgets and testing schedules.
Around half of respondents have never formally assessed whether their public-facing infrastructure supports post-quantum key exchange, leaving them with limited insight into where changes may be required.
Executives are more confident than practitioners
Confidence increases with seniority, but optimism about cryptographic readiness falls sharply for PKI specialists who manage certificates and keys. The same pattern appears across the other measures of readiness. Axiad cautioned that the practitioner sample was small and that the results should be viewed as a directional pattern rather than a precise estimate.
The findings suggest either that executives are reporting a level of readiness their own teams cannot verify or that practitioners lack visibility into inventories and assessments conducted elsewhere in the organization. This gap has direct implications for PQC planning because migration timelines depend on an accurate understanding of existing cryptographic systems.
Harvest now, decrypt later raises pressure to act
The transition is also being driven by the “harvest now, decrypt later” threat. Attackers can collect encrypted data and retain it in the hope that future quantum computers will be capable of decrypting it.
The risk is especially relevant for information that needs to remain confidential for years, including healthcare, financial and classified data. About 67% of respondents said the threat was an active priority and that specific steps were underway, while one-third had taken no specific action.
Even organizations that consider themselves prepared encounter challenges in moving PQC projects forward. Competing security priorities were the most commonly cited obstacle to migration, followed by budget constraints and the need for more regulatory guidance.