Post-quantum key exchange · UK companies
What share of UK companies have tls-pq-readiness?
41.79% of UK companies (95% CI 39.38–44.24%), measured across 1,577 companies on 2026-10-01.
Measured every Wednesday since 2026-08-01 — 4 observations to date. Last measured 2026-10-01.
How this is measured
Tier 2. One TLS handshake offering X25519MLKEM768 ahead of the classical curves, then read which group the server actually chose. TLS 1.2 endpoints are excluded, not counted as classical — they have no post-quantum key exchange to decline, and "not on TLS 1.3" is already tls-legacy against a different denominator. Denominator: has_web.
Passive measurement: a single DNS lookup, TLS handshake, or homepage GET per domain. Aggregate-only; no individual company is named. 95% Wilson confidence intervals. Population: national company registries (Companies House, Brreg, SIRENE), sampled by size band and resolved to email-active domains. Parked domains excluded. Snapshot: uk-companies-house-per600-seed20260728.
Licensed CC BY 4.0 — reuse with attribution to Quiet Failures. Download: JSON · CSV.
Why it matters
The failure with no symptom at all. The padlock is green, the grade is an A, the protocol is current, and the key exchange is the one part that does not survive contact with a quantum computer — retrospectively, because traffic captured today can be decrypted years later once the capability exists. Nothing about the site will ever look wrong, and by the time it matters the recording has already been made. The 47-day certificate clock has a deadline; this one has a countdown nobody can see.
Limits of this measurement
Measures the key exchange only — a hybrid group protects the session key, not the certificate's signature, so hybrid_pq is not "quantum-safe" end to end and must not be reported as such. Server support is read as offered to our client: a server may prefer a PQ group with a browser that offers a different one. The rate reflects hosting and CDN defaults far more than any decision made by the domain's owner, which is much of the story. Capped at 2,000 domains per run because it needs its own handshake rather than sharing the one the certificate metrics already make.
The same check, other segments
- France medium companies54.62%
- Norway small companies54.11%
- France small companies51.37%
- global domains50.94%
- Norway micro companies50.86%
- Norway companies50.7%
- Norway medium companies50%
- France companies49.74%