F5 Labs Study Reveals CDN Drives Most Web Post-Quantum Adoption
Over half of top sites support post-quantum key exchange, but research shows this edge protection masks deeper enterprise infrastructure gaps.
Key points
- % of top million websites support post-quantum key exchange, per F5 Labs.
- Removing Cloudflare-hosted sites drops that support figure to 22%.
- Only 27% of CISOs report actively implementing post-quantum cryptography.
Research from F5 Labs indicates that 54% of the world’s top one million websites now support post-quantum key exchange. This statistic suggests significant progress toward quantum safety, yet it largely reflects default settings enabled by content delivery network providers rather than comprehensive upgrades to enterprise infrastructure.
The study, titled State of PQC on the Web, examined only the front-end connections of websites. It did not assess whether application servers behind CDNs or internal traffic channels use post-quantum cryptography. This distinction is critical because the protection visible at the website’s front door does not guarantee security for the rest of the business.
The Illusion of Readiness
David Warburton, director of F5 Labs, noted that the 54% figure can be misleading. He explained that much of the support comes from CDN providers switching on post-quantum cryptography by default. If sites hosted by Cloudflare are removed from the calculation, the support rate drops sharply to 22%.
This discrepancy highlights a gap between perceived and actual readiness. While edge adoption is meaningful for client-to-edge connections, it does not automatically extend to origin servers, internal APIs, or service-to-service communications. The study did not measure these deeper layers of the technology stack.
Enterprise Gaps and Risks
A June survey by KPMG found that only 27% of CISOs are actively implementing post-quantum cryptography. However, 38% of those surveyed view quantum threats as a top high-impact emerging risk. This mismatch suggests many organizations may be underestimating the work required to secure their internal networks against future quantum computing capabilities.
Serhii Nikolaichuk, founder of The Capital Index, emphasized that the connections behind CDN protections are invisible from the outside. He pointed out that the hop to the origin, service meshes, VPNs, SSH, and code signing remain unmeasured in these external studies. That is where true enterprise readiness lives.
Expert Perspectives on Scope
Anastazija Pažin, a senior cybersecurity consultant at Deloitte, agreed that edge adoption is not a reliable measure of overall readiness. She stated that while CDN-enabled post-quantum cryptography provides genuine protection for external connections, it leaves internal systems exposed.
Pažin noted that this protection does not automatically cover enterprise PKI or internal traffic. Independent experts back the conclusion that true readiness requires upgrading every layer of the stack. Relying solely on CDN defaults leaves organizations vulnerable to harvest-now, decrypt-later attacks targeting internal data flows.
What should you do?
Security leaders should verify if their organization’s post-quantum readiness relies solely on CDN providers. It is essential to map out all internal connections, including service meshes and VPNs, to identify gaps. Teams should prioritize upgrading infrastructure behind the edge to ensure comprehensive protection against quantum threats.
What to do and how to stay safe: F5 Labs
- Audit internal traffic paths to confirm post-quantum cryptography usage beyond the CDN edge.
- Review current infrastructure to identify unsecured hops to origin servers and service meshes.
- Align implementation plans with the 38% of CISOs who view quantum threats as high-impact.
- Monitor vendor updates for tools that measure readiness across the entire technology stack.
Step-by-step guide: Social Engineering Warning Signs and How to Respond
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What percentage of top websites support post-quantum key exchange?
According to F5 Labs research, 54% of the world’s top one million websites support post-quantum key exchange.
How does removing Cloudflare affect the post-quantum adoption rate?
Removing Cloudflare-hosted sites from the F5 Labs study causes the support figure to drop from 54% to 22%.
Do CDN protections cover internal enterprise traffic?
No, CDN-enabled protection covers client-to-edge connections but does not automatically extend to origin servers or internal APIs.
