F5 Labs report finds critical-infrastructure sectors lag in post-quantum encryption adoption

Industries responsible for protecting critical infrastructure are among the least prepared for the cryptography challenges expected from quantum computing, according to new research from F5 Labs.

In its 2026 State of Post-Quantum Cryptography (PQC) Report, F5 Labs said it scanned the world’s top one million websites to assess readiness for post-quantum cryptography, including review across the top 100,000 domains. The company’s analysis aims to measure how widely organizations have adopted PQC, which is designed to resist attacks from quantum computers.

Adoption rates lowest in oil and gas, telecoms and government

F5 Labs reported that adoption of PQC capable of resisting quantum attacks was relatively low in several sectors it described as handling sensitive systems and communications. The report cited adoption figures of 34.5% in oil and gas, 35.2% in telecommunications, 35.4% in government, and 39.4% in utilities, compared with a global average of 54% across the full top one million website scan.

F5 Labs also said PQC adoption has increased significantly, “effectively doubled” since 2025 on a like-for-like basis, while its enhanced 2026 methodology keeps the global level at 54%.

Global progress masks uneven protection

While the overall figures appear to show broad movement toward PQC, F5 Labs argued that the results hide additional risk. The report said consumer services (58.8%), technology (56.1%) and consumer goods (49.8%) have higher PQC adoption rates.

According to the report, this pattern is linked to how many of those sites route inbound traffic through major edge platforms. F5 Labs said Cloudflare is “most notably” among providers enabling hybrid PQC key exchanges by default. The company added that removing Cloudflare-hosted domains from its dataset reduces the global PQC adoption figure to 22%, suggesting that a portion of measured progress is concentrated among a smaller set of edge deployments.

F5 Labs also highlighted technical debt as another concern. It said 10.51% of websites that responded to its scan lack support for TLS 1.3, which it said automatically prevents organizations from negotiating post-quantum connections and would require “significant rearchitecting” to achieve quantum readiness.

Regional results show UAE ahead of several peers

F5 Labs reported mixed regional outcomes. In the UAE, it said 56.7% of websites had adopted PQC. It cited Saudi Arabia at 53.66%, and Ukraine as the top performer at 65.12%.

Australia (63.11%), the United States (62.05%), and the United Kingdom (60.95%) were also described as strong in the report, with F5 Labs attributing performance to the use of US infrastructure and aligned PQC migration timelines from national cybersecurity bodies.

By contrast, the report said major EU countries lagged, listing Denmark (48.79%), the Netherlands (46.44%) and Spain (45.23%) as stronger performers, while Italy (39.74%), France (39.19%) and Germany (35.78%) were cited as lower.

For parts of Asia, F5 Labs reported lower figures, including Taiwan (38.26%), Japan (29.69%), and South Korea (29.08%). At the low end, it cited the Russian Federation (16.09%) and China (13.03%).

Company warnings on “Harvest Now, Decrypt Later”

F5 Labs framed PQC readiness as an operational concern rather than a future-only planning exercise. The report’s author, David Warburton, said the industries most exposed to quantum computing are also in the bottom quartile of readiness, describing constraints related to data sovereignty requirements, supervisory control and data acquisition systems, and lengthy procurement cycles.

The report also referenced “Harvest Now, Decrypt Later” campaigns, saying encrypted data can be gathered by adversaries today with decryption occurring later when quantum capabilities become more capable.

F5 Labs said organizations should conduct audits of cryptographic touchpoints, address technical debt, and adjust certificate lifecycle management and supply-chain crypto-agility. The company also pointed to its F5 Application Delivery and Security Platform (ADSP) and BIG-IP SSL Orchestrator as tools it claims can enable hybrid post-quantum key exchange on public-facing connections while maintaining classical cryptography for legacy internal applications.

The research is dated November 9, 2026.