A new report from Sectigo reveals widespread concern among organisations regarding the future of digital trust. The inaugural State of Crypto Agility Report, with data and insights from global research firm Omdia, highlights the dual threats of shrinking SSL/TLS certificate validity and the looming migration to post-quantum cryptography.
According to the research, a staggering 96% of organisations are worried about the impact of shorter SSL/TLS certificate lifespans on their business. As enterprises face the dual threats of shrinking certificate validity and the looming quantum risk, the report shows that despite the high level of concern, readiness remains critically low.
Key findings from the state of crypto agility report
on 47-day ssl/tls certificates:
- Widespread concern, low preparedness: a staggering 96% of organisations are concerned about the impact of shorter certificate lifespans, yet fewer than one in five (19%) feel very prepared for the shift to 47-day renewal cycles.
- Automation gap: only 5% of organisations have fully automated certificate management, meaning 95% are still at least partially reliant on manual processes. this dramatically increases the risk of operational disruption as renewals become more frequent.
- Poor visibility: just 28% of organisations have a complete certificate inventory, and only 13% are extremely confident they are tracking all their certificates.
On post-quantum cryptography (PQC) migration:
- Implementation challenges: almost all organisations (98%) expect to face challenges with pqc implementation, with 92% anticipating some form of barrier.
- Assessment deficit: only a small minority of organisations (14%) have conducted a full assessment of their quantum-vulnerable systems.
- Low confidence: just 15% of businesses are extremely confident in their ability to integrate PQC without major disruption.
- Investment on the rise: despite the low readiness, the majority of organisations (90%) have allocated budgets for PQC preparedness initiatives over the next 12 months, and 92% expect to increase that investment over the next two to three years.
We spoke with Tim Callan, Sectigo’s Chief Compliance Officer, to unpack the report’s key findings and what they mean for the future of enterprise cybersecurity.
The report shows that despite significant budgets, most companies have not assessed their systems for quantum risk. What are the immediate and tangible security risks of this disconnect?
The most immediate risk is the ‘Harvest Now, Decrypt Later’ attack. There is every reason to believe that well-resourced threat actors are harvesting data today for future decryption. The longer it takes for enterprises to harden themselves against this attack, the greater risk they run that business-critical secrets are revealed to malicious parties.
Migration to PQC will of necessity take some time. The CCO needs to mobilise the enterprise around this migration, including the allocation of priority, roadmap, and budget.
With so few organisations confident in their migration capabilities, what is the single biggest operational barrier preventing them from getting ready?
Migration to PQC will be a multi-year process for even the most astute organisations. Organisations at risk of falling behind are those that haven’t yet prioritised preparation for this migration, starting with establishing a CBOM and creating a migration plan.
How do companies move from simply allocating a budget for post-quantum cryptography to executing a practical, no-nonsense strategy that protects their business?
Adopting PQC is a multi-step process that starts with understanding the scope of the task. Enterprises can be working today on establishing a Cryptographic Bill of Materials (CBOM), which is a thorough accounting of the cryptographic and digital identity assets in use.
Alongside the CBOM, companies need to understand which software and hardware will require updates to support PQC, when those updates are expected to be available, and what they plan to do about unsupported or home-grown software for which updates are not forthcoming. Based on this information, the enterprise can build a pragmatic action plan to move to PQC as soon as is reasonable.
From a compliance officer’s perspective, what is the greatest unseen risk of the quantum transition and what new compliance frameworks or regulatory changes should businesses be monitoring right now?
Most organisations have cryptographic assets that are unknown to the office of the CIO or other centralised control hubs in the organisation. This is because encryption and digital certificates are such foundational building blocks in digital operations that many technical people simply use them. This can make it difficult to monitor use of cryptographic assets and ensure that specific standards are met. Certificate discovery is a key component in combating rogue cryptography in the modern enterprise. Businesses should identify and monitor all certificates in their environments as the first step in monitoring compliance with PQC directives.
