Axiad Research Finds Enterprises Are More Confident Than Ready for Post-Quantum Cryptography

Nearly half lack a named PQC migration leader, and 51% have never formally tested public-facing infrastructure for post-quantum key exchange

SANTA CLARA, Calif., Aug. 19, 2026 /PRNewswire/ -- Axiad, a leader in identity security and identity risk intelligence, today released new research revealing a significant gap between how prepared enterprise security leaders believe their organizations are for post-quantum cryptography (PQC) and the steps they have actually taken to prepare.

The survey of 315 U.S. security and IT leaders found that 75% say their organizations maintain a continuously updated inventory of cryptographic assets, and 63% are very confident that ownership of those assets is fully mapped. Yet nearly half (46%) cannot name a single individual responsible for leading their PQC migration, and 51% have never formally assessed whether their public-facing infrastructure supports post-quantum key exchange.

The research also found that 22% of respondents contradicted their own readiness claims within the same survey. For example, some respondents who said they were highly confident cryptographic ownership was mapped later identified unclear ownership as a top obstacle to migration.

Confidence also rose sharply with seniority. Ninety percent of CISOs and CIOs reported a continuously updated cryptographic inventory, compared with 74% of security and IT directors and 33% of the security architects and PKI engineers who manage those assets day to day. The practitioner sample is small and the finding should be read as a directional pattern rather than a precise estimate, but the gradient held across every readiness measure in the study.

"PQC readiness cannot be based on what an organization believes it has under control. It has to be based on what it can actually see, verify, and act on," said David Canellos, CEO of Axiad. "Organizations may believe they know where their certificates, keys, and cryptographic algorithms reside, but this research shows that confidence can fall apart when you ask who owns the migration, what has actually been tested, and where the organization remains exposed. The first step toward post-quantum readiness is establishing continuous visibility into the cryptographic environment so leaders can replace assumptions with evidence."

Awareness Is High, but Action Is Lagging

Awareness of the "harvest now, decrypt later" threat is widespread, but action has not kept pace. While 67% of respondents consider it an active organizational priority, 1 in 3 organizations has taken no specific action, and 30% are waiting for clearer regulatory guidance before moving forward.

Other key findings include:

• 25% say their cryptographic inventory is stale, partial or nonexistent.
• 22% contradicted their own PQC readiness claims elsewhere in the survey.
• 42% cite competing security priorities and 36% cite budget constraints as leading obstacles.
• Even among the 27% who report meeting every readiness measure examined, 48% still cite competing priorities, and 40% cite budget as a major obstacle.

The findings suggest that PQC migration is as much an operational challenge as a technical one, and an identity problem before it is purely a cryptographic one. Knowing where cryptographic assets live is only the starting point. The harder work is deciding which ones matter first, tying each to an accountable owner, understanding what each protects, and driving the change through the systems that depend on it without causing an outage. Organizations need a clear, current view of their cryptographic assets: where they reside, what they protect, and who owns the migration. Readiness comes from acting on that evidence: knowing which cryptographic risks matter first, tying each to an accountable owner, and driving the fix through the systems you already run.

The full report can be found here: https://engage.axiad.com/pqc-confidence-gap-report-2026?utm_source=guyer&utm_medium=pr&utm_campaign=pqc-confidence-gap-report

Organizations can also assess whether their public-facing infrastructure currently supports post-quantum key exchange using Axiad's PQC Readiness Tester at quantum.axiad.io.

Survey Methodology

The survey was fielded July 15 to 28, 2026 by Centiment, an independent research panel provider, on behalf of Axiad. Respondents were security and IT leaders at U.S. organizations with 500 or more employees. All respondents passed an embedded attention check. The 315 security and IT leaders who responded to the survey included CISOs, CIOs, security and IT executives and directors, security architects, and PKI/cryptography specialists. Seventy-six percent identified as primary decision-makers for cybersecurity tools and practices related to encryption, certificates, or cryptographic infrastructure.

About Axiad

Axiad is a leader in identity security and identity risk intelligence and Axiad Mesh is the decision and action layer for identity risk. Security teams can already see more identity findings than they can rank or act on; Mesh sits above the tools they already run and turns that flood into a plan. It connects every identity - human, non-human, workload, and agentic - plus cryptographic assets into one trustworthy picture, ranks each risk by what it would cost the business, names the owner, and routes the fix into systems like ServiceNow, IGA, and PAM. Built for large, regulated, multi-IdP enterprises by a team that has run identity where failure was never an option. Trusted by Fortune 500 companies and federal agencies, Axiad maintains a 95% customer retention rate. Learn more at axiad.ai.

SOURCE Axiad IDS, Inc.