Three quarters of security leaders say they maintain a continuously updated inventory of every certificate, key, and algorithm in their environment. Then you read the rest of their answers.
New research from Axiad reveals a gap between what leadership believes about post-quantum readiness and what their own teams, testing history, and contradictions show. One in five respondents contradicted their own readiness claims within the same eleven-question survey. And the closer a respondent sits to the actual cryptography, the less confident they are.
90% vs. 33%
C-suite leaders who claim a current crypto inventory vs. the hands-on practitioners who agree
46%
have no single named individual responsible for leading PQC migration
51%
have never formally tested public-facing infrastructure for post-quantum key exchange support
1 in 3
has taken no specific action on harvest now, decrypt later
Five findings inside the report
01
Confidence collapses under its own weight
22% of security leaders contradicted their own readiness claims within a single survey, claiming a capability in one answer and citing its absence as a top obstacle in the next.
02
The closer you get to the keyboard, the worse it looks
Readiness optimism rises with seniority. 90% of CISOs and CIOs claim a continuously updated crypto inventory. Among the architects and PKI engineers who manage those assets, it's 33%.
03
Nobody owns the migration
46% of enterprises can't name the person responsible for PQC migration. In government, the segment facing the hardest deadlines, it's 66%.
04
Awareness has outrun action on HNDL
98% know about harvest now, decrypt later. A third have done nothing specific about it, and 30% are waiting for regulators before they move.
05
Even the most prepared are under-resourced
Among the 27% who claim every readiness marker, nearly half say the migration is still losing the fight for priorities and budget.
Who should read this
- CISOs and CIOs setting post-quantum migration timelines and budgets
- Security architects and PKI leaders building the cryptographic inventory those timelines depend on
- GRC and compliance teams tracking EO 14409, CNSA 2.0, and sector-specific PQC mandates
- Federal and DIB security leaders facing the December 2030 and 2031 migration deadlines