Post-Quantum Cryptography Statistics 2026
By Axis Intelligence Research
Co-author: Marcus Chen, Cybersecurity Analyst | Last updated: July 2, 2026 | License: CC BY 4.
Quick Answer: What Are the Most Important Post-Quantum Cryptography Statistics?
The post-quantum cryptography market reached an estimated $1.3–1.6 billion in 2025 — up from under $300 million in 2024 — with a CAGR ranging from 37% to 46% across major analyst forecasts, driven by NIST’s August 2024 finalization of three quantum-resistant standards and the U.S. President’s Executive Order 14412 signed June 22, 2026, which mandates federal agency migration to PQC key establishment by December 31, 2030.
According to Axis Intelligence Research’s cross-source analysis of market data and primary government documents:
- The PQC market is valued at approximately $1.3–1.6 billion in 2025, growing to an estimated $2.2–2.8 billion in 2026.
- NIST finalized its three foundational PQC standards — FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA) — on August 13, 2024.
- Executive Order 14412, signed June 22, 2026, sets December 31, 2030, as the deadline for U.S. federal High Value Assets to adopt PQC key establishment.
- A 2025 Keyfactor survey found 48% of organizations in North America and Europe report being unprepared for quantum cybersecurity risks.
- Only 3% of banking websites currently support any form of PQC, the lowest adoption rate of any regulated sector.
Key Findings
- According to Axis Intelligence Research’s synthesis of Grand View Research and Precedence Research data, the PQC market grew at a minimum 37% CAGR between 2024 and 2025, representing the fastest-growing segment within the broader cybersecurity market.
- Axis Intelligence Research calculates that the gap between the market’s $1.3–1.6 billion 2025 valuation and the $20–30 billion range projected for 2033–2034 implies a compounding 12–16x expansion over nine years — a growth rate with no modern cybersecurity market precedent at this scale.
- Per Axis Intelligence Research’s analysis of NIST’s timeline documentation and EO-14412, the U.S. now operates two coexisting PQC migration deadlines: December 31, 2030 for civilian high-value federal systems, and December 31, 2031 for National Security Systems under CNSA 2.0 — a dual-track structure that creates significant compliance complexity for federal contractors serving both tracks simultaneously.
- Axis Intelligence Research finds that the ISACA-cited shortage of fewer than 15,000 security professionals globally with demonstrated PQC implementation competency, measured against a market requiring hundreds of thousands of practitioners by 2030, represents a talent gap roughly 20x the current supply — the single most underreported constraint in PQC migration planning.
- According to Axis Intelligence Research’s analysis of Palo Alto Networks’ 2026 Unit 42 Global Incident Response Report, adversarial data exfiltration timelines shortened from 285 minutes median in 2024 to 72 minutes in the fastest quartile in 2025 — meaning the Harvest Now, Decrypt Later threat window compounds faster than PQC migration timelines for most organizations.
Post-Quantum Cryptography Market Size Statistics
The PQC market does not have a single authoritative valuation. Depending on scope (pure software, hardware security modules, migration services, or all three), and on how analysts draw the boundary between classical and quantum-resistant security spending, estimates diverge considerably. That divergence is itself a data point: no analyst consensus means the market is young and definitional standards are still settling.
Axis Intelligence Research assessed figures from five independent research providers. The range runs from $420 million (MarketsandMarkets, narrower scope) to $1.68 billion (Precedence Research, broader scope) for 2025, with a central cluster around $800 million to $1.6 billion. All five agree on a CAGR between 37% and 48%. The ceiling disagreement is more interesting than the floor — firms projecting 48% tend to include managed migration services and PQC-enabled hardware security modules in their perimeter; those projecting 37% do not.
| Research Firm | 2025 Market Estimate | 2030/2033 Projection | CAGR | Scope Note |
|---|---|---|---|---|
| Grand View Research | $1.58 billion | $20.5B (2033) | 37.8% | Includes PQC hardware, software, services |
| Mordor Intelligence | $880 million | $4.60B (2030) | 39.2% | Excludes some legacy migration services |
| MarketsandMarkets | $420 million | $2.84B (2030) | 46.2% | Narrower scope: algorithms and libraries |
| Precedence Research | $1.68 billion | $29.9B (2034) | 37.7% | Broadest scope including QKD-adjacent |
| Research and Markets | N/A (2025 not stated) | $3.41B growth 2025–2030 | 43.4% | Focused on new spending increment |
Sources: Grand View Research (2026), Mordor Intelligence (2025), MarketsandMarkets (2025), Precedence Research (2025), Research and Markets (2026). Note: scope differences explain valuation variance; all firms agree on the 37%–48% CAGR range.
The 46.2% CAGR figure from MarketsandMarkets is probably the most cited. It’s also the one with the narrowest denominator — starting from $420 million makes percentage gains easier to generate. Organizations building procurement cases should use the $800 million–$1.6 billion band as a more defensible baseline.
According to Axis Intelligence Research’s 2026 synthesis of these five sources, the market’s most reliable characteristic is not any single valuation but its direction: every independent analyst with published data in 2025–2026 projects sustained compound growth above 35% for at least a decade.
Post-Quantum Cryptography Market Size by Region (2025)
North America leads by revenue share across all major research firms. The underlying drivers are concrete: the largest concentration of defense contractors under CNSA 2.0 obligations, the Federal Reserve’s July 2025 identification of quantum computing as a “significant emerging risk area,” and the EO-14412 contractor compliance clause requiring PQC readiness from any federal supplier by December 31, 2030.
| Region | 2025 Revenue Share | Key Driver | CAGR (2025–2030) |
|---|---|---|---|
| North America | 38–42% | Federal mandates, DoD contractor base | ~38% |
| Europe | 25–28% | NIS2, EU PQC roadmap (2030 critical infra deadline), DORA | ~23% |
| Asia-Pacific | 22–25% | China sovereign PQC standards (GM/T series), Japan, South Korea programs | ~41–47% |
| Middle East & Africa | 7–9% | UAE/Saudi smart city programs | ~35% |
| Latin America | 3–5% | Nascent, regulatory-led | ~28% |
Source: Axis Intelligence Research synthesis of Grand View Research, Precedence Research, and Mordor Intelligence regional data (2025–2026). Asia-Pacific CAGR range reflects divergence between firms including China sovereign spending and those excluding it.
Asia-Pacific’s CAGR is worth watching. China is not following NIST — it is building its own post-quantum standards under the GM/T series, specifically to prevent what it considers foreign algorithm dependency. If those standards gain regional adoption among Belt and Road participants, the market fragments. A fragmented market is a harder migration for multinational enterprises, not an easier one.
NIST Post-Quantum Cryptography Standards: The Technical Baseline
What Are the Three Finalized NIST PQC Standards?
NIST published FIPS 203, FIPS 204, and FIPS 205 as finalized Federal Information Processing Standards on August 13, 2024, concluding an eight-year evaluation process that began with a global call for submissions in 2016. Eighty-two candidates from 25 countries were submitted. Three survived to standardization.
| Standard | Algorithm | Purpose | Replaces | Key/Signature Size |
|---|---|---|---|---|
| FIPS 203 | ML-KEM (formerly CRYSTALS-Kyber) | Key encapsulation (key exchange) | RSA, ECDH, Diffie-Hellman | Public key: 800–1,568 bytes; Ciphertext: 768–1,568 bytes |
| FIPS 204 | ML-DSA (formerly CRYSTALS-Dilithium) | Digital signatures | RSA-PSS, ECDSA | Public key: ~1,312 bytes; Signature: 2,420–4,595 bytes |
| FIPS 205 | SLH-DSA (formerly SPHINCS+) | Hash-based signatures (conservative backup) | RSA, EdDSA | Signature: 7,856–49,856 bytes |
Source: NIST FIPS 203, FIPS 204, FIPS 205 (August 2024). Size ranges reflect the three parameter sets per standard (security levels 1, 3, 5, equivalent to AES-128, AES-192, AES-256 respectively).
For comparison: an RSA-2048 public key is 256 bytes. ML-KEM-768 (NIST’s recommended general-purpose parameter set) requires a 1,184-byte public key. The size increase is real — TLS handshakes with ML-KEM + ML-DSA add approximately 5–10 KB overhead compared to ECDH + ECDSA. AWS measures the overhead at roughly 1,600 additional bytes and 80–150 microseconds of compute per TLS handshake, a cost most cloud-hosted applications absorb without measurable user impact.
SLH-DSA is the outlier. Its 7,856–49,856 byte signatures are one to two orders of magnitude larger than ML-DSA. The tradeoff is that SLH-DSA’s security depends only on hash function properties — if a mathematical breakthrough compromises lattice-based schemes (ML-KEM and ML-DSA both rely on lattice problems), SLH-DSA survives intact. It is insurance, not a default.
FIPS 206 (FN-DSA/Falcon) and the HQC Backup: What Is Still Pending
FIPS 206 — FN-DSA (formerly Falcon): NIST flagged a fourth digital signature standard based on the Falcon algorithm for draft release. As of mid-2026 it is still progressing through the standardization pipeline. Its value is compact signatures (~1 KB) suitable for constrained environments; its complication is implementation difficulty — Falcon requires floating-point arithmetic in its signing path, raising the bar for constant-time, side-channel-resistant implementations.
HQC (Hamming Quasi-Cyclic): Selected on March 11, 2025, as a code-based backup KEM alongside ML-KEM. The draft standard is expected in early 2027 with final publication following. HQC is insurance against lattice cryptanalysis: if a future quantum or classical attack compromises the Module-Learning With Errors problem underpinning ML-KEM, organizations running HQC in hybrid mode retain an independent safety margin. NIST’s Migration to Post-Quantum Cryptography project provides tooling and interoperability guidance for organizations tracking both the finalized standards and forthcoming ones.
Neither FIPS 206 nor HQC is required for current CNSA 2.0 or EO-14412 compliance. They are roadmap items, not production mandates.
Post-Quantum Cryptography Adoption Statistics
Enterprise and Organizational Readiness
The headline number here is uncomfortable: most organizations have not started. A 2025 survey by Keyfactor found that 48% of organizations in North America and Europe describe themselves as unprepared for quantum cybersecurity risks. That’s the self-reported number — which typically understates the problem.
The sector-by-sector picture is worse than the aggregate suggests:
| Sector | Current PQC Deployment | Readiness Assessment | Primary Driver |
|---|---|---|---|
| Banking & Financial Services | 3% of banking websites support PQC | Low — highest-risk sector, lowest website adoption | Regulatory (OCC, Federal Reserve guidance); HNDL risk for transaction archives |
| Government / Defense | Highly variable; NSS acquisitions must be CNSA 2.0-compliant from January 1, 2027 | Moderate for DoD; Low for civilian agencies | CNSA 2.0, NSM-10, EO-14412 |
| Healthcare | Sub-5% estimated; industry lags on TLS 1.3 adoption | Low — long data retention requirements make HNDL exposure severe | HIPAA + HNDL risk for patient records with lifetime retention |
| Telecommunications | 5G pilots underway; SandboxAQ partnered with major telecoms 2025 | Early-stage | 5G/6G infrastructure refresh cycles |
| Cloud / IT | Hyperscalers (AWS, Google, Microsoft) deploying in production | Advanced — leaders deploying PQC as default | Technical maturity + customer demand |
Source: Keyfactor 2025 survey (48% unprepared); banking adoption rate per Capture the Bug analysis of TLS scanning data (2025); sector assessments per Axis Intelligence Research synthesis of MarketsandMarkets and Grand View Research vertical data (2025–2026).
That 3% banking website figure deserves a closer look. The financial sector carries the highest nominal quantum risk — decades-long data retention on transaction records creates massive HNDL exposure, the OCC identified quantum computing risk in its Fall 2022 Semiannual Risk Perspective, and the Federal Reserve’s July 2025 Cybersecurity and Financial System Resilience Report upgraded it to a “significant emerging risk area.” But website-level PQC is a lagging indicator. The large banks — JPMorgan Chase, Bank of America, Mastercard, Visa — have active internal migration programs and quantum-resistant pilots that do not surface in public TLS scans. The 3% figure captures the absence of production deployment on customer-facing infrastructure, not the absence of internal programs.
Healthcare is probably the more alarming number. Patient records carry lifetime confidentiality requirements. An adversary harvesting encrypted healthcare data in 2025 gets material that remains exploitable until PQC migration completes. If migration does not complete until 2030–2035, today’s unprotected healthcare records are already at risk.
PQC Adoption by Protocol and Technology Stack
The Encryption Consulting monthly protocol heatmap (tracked from March 2025) provides one of the more granular pictures of where PQC is actually integrating into production systems. Scoring runs from 0 (no progress) to 9 (broad real-world adoption).
| Protocol | Hybrid PQC Score (March 2025) | Trend (as of mid-2026) |
|---|---|---|
| TLS 1.3 | 8 | Active deployment; IETF PLANTS working group advancing PQC certificates |
| SSH | 6 | Proposals active; not yet broadly deployed |
| X.509 / PKI | 6 | Draft certificate formats; hybrid certificates in testing |
| S/MIME | 5 | Proposals active |
| IKE/IPSec (VPN) | 3–4 | Early-stage; proposals in progress |
| TLS 1.2 | 0 | Industry consensus: PQC will not be backported; organizations on TLS 1.2 are structurally excluded from the migration path |
| DNSSEC | 2 | Significant challenges; core internet infrastructure complexity |
Source: Encryption Consulting Protocol Migration Heatmap (March 2025), referenced by Axis Intelligence Research.
TLS 1.2’s zero score is the quiet emergency. According to independent TLS scanning data, 25% of websites still do not support TLS 1.3 at all, with 16% failing to implement quantum-resistant symmetric ciphers. Organizations still running TLS 1.2-only infrastructure cannot receive a PQC migration — they need a protocol upgrade first, before any PQC work can begin. The migration queue has a prerequisite queue.
Harvest Now, Decrypt Later: The Statistics Behind the Immediate Threat
Harvest Now, Decrypt Later (HNDL) is the attack model that makes PQC migration a current-year problem rather than a future-decade problem. Nation-state adversaries intercept and archive encrypted traffic today, storing it until quantum computers capable of retroactive decryption become available. The attack requires no quantum capability in 2026 — only network access, storage, and patience.
The DHS, UK NCSC, EU ENISA, and Australian Cyber Security Centre all base their official post-quantum guidance on the explicit premise that HNDL operations are currently underway. CISA’s Post-Quantum Cryptography Initiative coordinates U.S. critical infrastructure operator guidance on exactly this threat.
What has changed in the 2025–2026 period is the estimated quantum resource requirement for breaking today’s encryption:
| Year | Estimated Qubits to Break RSA-2048 | Source |
|---|---|---|
| 2019 | ~20 million physical qubits | Baseline estimate |
| 2025 | Under 1 million physical qubits | Revised academic research (multiple papers) |
| Early 2026 | Potentially ~100,000 qubits (specific architectures) | Three papers published May 2025–March 2026 |
| For ECC (Bitcoin, most digital signatures) | Potentially under 500,000 qubits | Google researcher estimates |
Source: The Quantum Insider summary of published research (May 2026). These are theoretical architectural estimates; no fault-tolerant quantum computer of this scale currently exists. The direction of revision — consistently downward — is the relevant data point.
According to Axis Intelligence Research’s reading of this research trajectory, the consistent downward revision in qubit requirements does not mean Q-Day is imminent — it means the confidence interval around “when” is shrinking, which is itself a risk management signal. Organizations whose sensitive data retains value past 2030 cannot wait for a definitive Q-Day announcement before beginning migration.
From the 2026 Unit 42 Global Incident Response Report (Palo Alto Networks): the fastest quartile of intrusions reached data exfiltration in 72 minutes in 2025, compared with 285 minutes in 2024. The share of incidents reaching exfiltration in under one hour rose from 19% to 22%. This acceleration matters for HNDL specifically: adversaries are capturing and sorting encrypted data faster than ever, compressing the window between breach and HNDL storage.
Government Mandates and Regulatory Timeline Statistics
This is the section that actually moved enterprise procurement in 2025–2026. PQC was a research discussion until government mandates created contractual deadlines. The U.S. now has four coexisting and overlapping federal PQC frameworks.
U.S. Federal PQC Timeline
| Directive | Issued | Key Deadline | Who It Covers |
|---|---|---|---|
| NSM-10 | May 2022 | 2035 (migration complete) | All federal civilian agencies; annual cryptographic inventory reporting |
| CNSA 2.0 | September 2022 (updated December 2024) | January 1, 2027 (new NSS acquisitions must be PQC-compliant) | National Security Systems, DoD contractors |
| OMB M-23-02 | 2022/2023 | Annual inventories through 2035 | All federal agencies; designates migration leads |
| Quantum Computing Cybersecurity Preparedness Act | December 2022 | Annual Congress reporting | Federal agencies (statute — cannot be overridden by executive order) |
| NIST IR 8547 (draft) | 2024 | 2030: deprecate 112-bit classical algorithms; 2035: disallow all quantum-vulnerable algorithms | Federal systems (baseline technical guidance) |
| Executive Order 14412 | June 22, 2026 | December 31, 2030 (HVA key establishment); December 31, 2031 (HVA digital signatures) | Federal High Value Assets, High Impact Systems, AND federal contractors (FAR rule by December 31, 2030) |
Source: whitehouse.gov (EO-14412 full text, June 22, 2026), NSA CNSA 2.0 (media.defense.gov), NIST IR 8547, Quantum Computing Cybersecurity Preparedness Act (December 2022 statute).
The most consequential provision in EO-14412 is not the 2030 federal agency deadline — it is Section 6(c), which directs the Federal Acquisition Regulatory Council to publish a proposed FAR rule requiring all covered federal contractors to comply with NIST PQC FIPS by December 31, 2030. This extends the PQC obligation well beyond the federal perimeter. Any company supplying goods or services to the U.S. government will need PQC readiness as a procurement condition. A European company in a supply chain that terminates at a U.S. agency inherits the deadline.
The U.S. now also operates two coexisting migration horizons, which creates operational complexity for organizations working across both tracks:
- 2030–2031: Civilian federal High Value Assets and High Impact Systems (EO-14412)
- 2035: National Security Systems under CNSA 2.0 and NSM-10
Per Axis Intelligence Research’s analysis, the 2030 civilian deadline is more aggressive than the 2035 NSS deadline in one respect: the 42–54 month realistic enterprise migration timeline (per industry estimates) means organizations should already be in active planning and cryptographic inventory phases to meet a December 2030 deadline starting in mid-2026.
International PQC Regulatory Deadlines
| Jurisdiction | Framework | Key Deadline |
|---|---|---|
| European Union | EU PQC Coordinated Roadmap (June 2025, 18 member states) | End 2026: national PQC strategies published; End 2030: critical infrastructure high-risk migration complete; End 2035: medium-risk migration complete |
| Germany | BSI TR-02102-1 (updated January 2025) | Advocates hybrid approach for government PKI by 2027 |
| France | ANSSI PQC Transition Roadmap | Critical national infrastructure: quantum-safe algorithms mandated by 2026 |
| United Kingdom | NCSC roadmap (March 2025) | Phased approach; no single hard deadline but active guidance in effect |
| NSA CNSA 2.0 (U.S. DoD/NSS) | September 2022, updated December 2024 | January 2027: new NSS acquisitions PQC-compliant; December 2030: legacy NSS equipment phased out; December 2031: CNSA 2.0 mandatory across all NSS |
Source: EU NIS Cooperation Group PQC Roadmap (June 2025); BSI TR-02102-1 (January 2025); ANSSI roadmap; UK NCSC (March 2025); NSA CNSA 2.0 v2.1 (December 2024).
Post-Quantum Cryptography Adoption by Industry
Financial Services
The BFSI (Banking, Financial Services, Insurance) sector commands the largest vertical share of PQC spending — 28% of the market as of 2024, per Market.us research. This is driven by regulatory pressure and not, yet, by production deployment on customer-facing systems.
The gap between spending and deployment is notable. According to Axis Intelligence Research’s analysis of available TLS scanning data and regulatory filings, large banks are running internal PQC pilots (JPMorgan Chase and Bank of America disclosed cryptographic inventory programs in 2024; Mastercard ran a quantum-resistant algorithm pilot in its payment network in 2023; Visa tested PQC digital signatures with IBM for payment authentication) while public-facing infrastructure remains predominantly classical.
Mastercard’s 2025 white paper on PQC migration identifies one key reason: the payment network processes through 15,000+ cryptographic endpoints per major institution. A direct replacement approach is costly and disruptive. A hybrid approach (running classical and PQC algorithms in parallel, which is what NIST and CNSA 2.0 both permit during transition) is the practical path, but it doubles cryptographic overhead during the transition period.
A 2024 Gartner report estimated that large enterprises would need to spend $10–50 million over 5–7 years to complete PQC migration. For a large financial institution, the upper end of that range is a conservative number.
Healthcare
Healthcare data has a longer confidentiality horizon than almost any other sector — patient records carry lifetime retention requirements, genomic data can be sensitive for generations, and clinical research may remain embargoed for years. This makes the HNDL threat uniquely severe for healthcare.
The 2025 NSA Cybersecurity Information Sheet on AI data security, co-signed by CISA and the FBI, specifically flagged AI systems in healthcare as elevated HNDL risk due to the combination of high-value data and long operational system lives.
Despite this exposure, healthcare shows among the weakest PQC adoption rates by measurable indicators (website TLS posture, public disclosures). The reason is straightforward: healthcare IT runs on legacy infrastructure, regulatory capital is consumed by HIPAA compliance and EHR modernization, and PQC is a new obligation on top of existing backlogs. The sector’s migration timeline may be the longest of any regulated industry.
Government and Defense
The U.S. defense and intelligence community is the most advanced PQC adopter by mandate architecture if not by completed deployment. CNSA 2.0 has been in effect since September 2022, and the January 1, 2027, new-acquisition deadline for National Security Systems is now less than 18 months away.
Government sector accounts for approximately 57% of global quantum security purchases, per Capture the Bug’s 2025 analysis. Defense spending on PQC is not disclosed by country at any meaningful level of granularity, but the combination of NSM-8, NSM-10, CNSA 2.0, and EO-14412 makes the U.S. federal government the single largest institutional PQC buyer through 2030.
Federal agencies evaluating PQC algorithms increased their evaluation activity by 41%, per Global Growth Insights data (2025). Whether “evaluation” translates to deployment by the 2030 EO deadline is a different and more open question.
Hyperscaler and Major Tech Deployments
This is where production PQC deployment is actually happening in 2026. The cloud hyperscalers did not wait for enterprise customers to drive demand — they began deploying PQC because their infrastructure at scale provides the testing ground and because federal contracts require it.
| Organization | PQC Deployment Status (as of mid-2026) | Specifics |
|---|---|---|
| AWS | Production | ML-KEM integrated into KMS, certificate management, and sensitive information storage (April 2025). AWS-LC FIPS 3.0 was the first cryptographic library to include ML-KEM in FIPS 140-3 validation. ML-KEM overhead measured at ~1,600 additional bytes and 80–150 microseconds per TLS handshake. |
| Microsoft | Production | SymCrypt ships ML-KEM and ML-DSA in production across Azure, Microsoft 365, Windows 11, and Windows Server 2025 (since November 2025 update). SLH-DSA support following in subsequent updates. |
| Google Cloud | Production | Quantum-safe digital signatures available in Cloud KMS. Announced internal 2029 deadline for full post-quantum migration. |
| Cloudflare | Production / Expanding | “Majority of human-generated traffic” on its network achieved post-quantum encryption by late 2025. Launched PQC-enabled SASE platform (February 2026). Targeting 2029 for full post-quantum security including authentication. |
| Apple | Production (iMessage) | Integrated PQC into iMessage via PQ3 protocol. One of the earliest consumer-scale PQC deployments. |
| Signal | Production | PQXDH (Post-Quantum Extended Diffie-Hellman) deployed across the Signal protocol. |
Source: AWS Security Blog (April 2025); Microsoft SymCrypt release notes (November 2025); Google Cloud KMS announcements; Cloudflare Blog (post-quantum EO analysis, June 2026); Quantum Insider analysis (April 2026). All URLs verified by Axis Intelligence Research.
A pattern emerges: security-forward technology companies and cloud providers are running production PQC. Banks, healthcare systems, and most enterprises are running pilots or planning phases. The enterprise mainstream is 3–7 years behind the leading edge.
PQC Algorithm Type Statistics
Lattice-based cryptography — the mathematical foundation of both ML-KEM and ML-DSA — commands the dominant market position and the largest research investment. This is a function of the NIST selections, not a coincidence of market preference.
| Algorithm Type | Market Share (2025) | Primary NIST Standard | CAGR (2025–2030) | Notes |
|---|---|---|---|---|
| Lattice-based | ~50–55% | ML-KEM (FIPS 203), ML-DSA (FIPS 204) | ~45–47% | Dominant; performance-efficient; both primary NIST KEMs are lattice-based |
| Hash-based | ~20–22% | SLH-DSA (FIPS 205) | ~38% | Conservative backup; large signatures limit use cases |
| Code-based | ~12–15% | HQC (selected 2025, not yet final standard) | ~45% | Niche to growing; Classic McEliece still in discussion |
| Multivariate | ~8–10% | None finalized by NIST | ~28% | NIST Round 2 additional signature schemes still evaluating |
| Other / hybrid | ~5–8% | N/A | ~34% | Hybrid classical+PQC deployments during transition |
Source: Axis Intelligence Research synthesis of Grand View Research, MarkNtel Advisors, and Market.us data (2025–2026). Share ranges reflect scope variation across research firms; CAGR figures are directional estimates from multiple sources.
Lattice-based cryptography’s dominance is real but not a perfect substitute for algorithm diversity. The cryptographic community’s concern — shared explicitly by NIST — is concentration risk: if a mathematical breakthrough compromises the Module-LWE problem (the hard problem underlying both ML-KEM and ML-DSA), the entire lattice portfolio falls simultaneously. That is the explicit rationale for HQC’s selection on March 11, 2025, and for the continued evaluation of non-lattice signature schemes in NIST’s additional digital signature process.
The Talent Gap: PQC Skills Statistics
Per Axis Intelligence Research’s analysis of a 2025 ISACA survey cited by MarketIntelo, fewer than 15,000 security professionals globally have demonstrated PQC implementation competency. The same analysis projects that market demand will require hundreds of thousands of PQC-capable practitioners by 2030.
That is a 20x talent gap in under five years.
Only 5% of CISOs currently list PQC as a prioritized initiative in any publicly cited survey data. The remaining 95% are prioritizing threats with nearer-term detection and attribution characteristics — ransomware, credential theft, cloud misconfigurations — over a threat whose exploitation date is uncertain. This is rational under conventional risk models and dangerous under the HNDL model, where the exploitation may already be occurring in storage.
The 42–54 month enterprise migration timeline (per AxelSpire’s framework analysis) implies that organizations starting in July 2026 would complete migration in late 2030 to mid-2031 — at the boundary of, or slightly past, EO-14412’s December 31, 2030, deadline for federal contractors. Start dates slip. Cryptographic inventories take longer than planned. The talent gap creates additional delay. Per Axis Intelligence Research’s analysis, the organizations that begin PQC migration planning in Q3 2026 are not early — they are on the boundary of on-time for federal contractor compliance.
Methodology
Data collection: Axis Intelligence Research collected primary-source market data, government documentation, and technical research published between January 2024 and July 2026. Primary sources include: NIST FIPS 203, 204, 205 full standards text; EO-14412 full text (whitehouse.gov); NSA CNSA 2.0 (media.defense.gov); the Palo Alto Networks Unit 42 Global Incident Response Report 2026; the Mastercard PQC migration white paper (October 2025); the NIST NCCoE Migration to PQC project documentation; EU NIS Cooperation Group PQC Coordinated Roadmap (June 2025); and peer-reviewed papers from arXiv (2025–2026) on HNDL risk quantification.
Market size: Five independent market research firms were cross-referenced. Where estimates diverge materially (as they do for 2025 valuations), Axis Intelligence Research presents the full range rather than selecting one figure. The $1.3–1.6 billion central estimate reflects the cluster of three firms with disclosed methodology; the outlier at $420 million (MarketsandMarkets) reflects a narrower scope definition.
Adoption statistics: Website-level TLS scanning data (banking sector) sourced from Capture the Bug’s 2025 analysis. Protocol readiness scores from Encryption Consulting’s monthly heatmap methodology (March 2025). Talent gap estimate from the 2025 ISACA survey as cited by market research secondary sources; the 15,000 figure is ISACA’s stated finding.
Qubit requirement estimates: All figures cited from published academic and research papers as summarized by The Quantum Insider (May 2026) and individual paper references. These are theoretical architectural estimates under specific assumptions and should not be read as operational timelines.
Limitations: No independent primary survey was conducted by Axis Intelligence Research for this publication. Market valuations reflect analyst estimates, not audited revenue figures. PQC deployment statistics for non-public infrastructure (internal banking systems, classified government systems) cannot be verified from public sources. CAGR projections beyond 2030 carry substantial uncertainty given the immaturity of the market and the dependence on Q-Day timeline scenarios.
About This Dataset
Update approach: This article is updated when: (a) NIST publishes the final HQC standard or FIPS 206, (b) EO-14412 agency compliance reports are submitted to OMB, (c) a major market research firm publishes an updated PQC market sizing with disclosed methodology, or (d) a material cryptographic advance narrows the qubit-to-Q-Day timeline. No fixed calendar schedule.
License: Dataset available for download under Creative Commons Attribution 4.0 International (CC BY 4.0). Attribution: Axis Intelligence Research, Post-Quantum Cryptography Statistics 2026, axis-intelligence.com/post-quantum-cryptography-statistics/
Cite This Research
APA: Axis Intelligence Research. (2026, July 2). Post-quantum cryptography statistics 2026: Market size, adoption, and migration data. Axis Intelligence. https://axis-intelligence.com/post-quantum-cryptography-statistics/
MLA: Axis Intelligence Research. “Post-Quantum Cryptography Statistics 2026: Market Size, Adoption, and Migration Data.” Axis Intelligence, 2 July 2026, axis-intelligence.com/post-quantum-cryptography-statistics/.
Chicago: Axis Intelligence Research. “Post-Quantum Cryptography Statistics 2026: Market Size, Adoption, and Migration Data.” Axis Intelligence, July 2, 2026. https://axis-intelligence.com/post-quantum-cryptography-statistics/.
Frequently Asked Questions
How big is the post-quantum cryptography market in 2026?
Estimates for the PQC market in 2026 range from approximately $1.1 billion to $2.3 billion, depending on how broadly researchers define the market boundary (whether hardware security modules, managed migration services, and QKD-adjacent spending are included). The most commonly cited range clusters around $1.3–1.6 billion for 2025 growing to $2.0–2.2 billion for 2026. All major analysts agree on a CAGR between 37% and 48% through 2030.
What is Q-Day and when will it happen?
Q-Day refers to the moment a cryptographically relevant quantum computer (CRQC) becomes capable of breaking widely-used public-key encryption — specifically RSA, Elliptic Curve Cryptography, and Diffie-Hellman. Most expert estimates place Q-Day between 2030 and 2035, though some recent architectural research suggests the qubit requirement could be lower than previously thought. The U.S. government’s EO-14412 (June 22, 2026) implicitly acknowledges Q-Day as plausible before 2031 by setting that as the authentication migration deadline.
What is the Harvest Now, Decrypt Later (HNDL) threat?
HNDL describes an attack strategy where adversaries intercept and store currently encrypted data with the intention of decrypting it once quantum computers become available. The attack requires no quantum capability today — only network access and storage. The NSA, CISA, DHS, UK NCSC, EU ENISA, and Australian Cyber Security Centre all officially state that HNDL operations are likely already underway by nation-state actors. Data encrypted today with RSA or ECC that remains sensitive past Q-Day is already at risk.
What NIST PQC standards should organizations deploy now?
For key exchange, NIST recommends ML-KEM (FIPS 203), with the ML-KEM-768 parameter set as the default for most applications. For digital signatures, ML-DSA (FIPS 204) is the primary recommendation. SLH-DSA (FIPS 205) provides a conservative hash-based backup for high-assurance applications where algorithm independence is more important than signature size. The NSA’s CNSA 2.0 additionally requires ML-KEM-1024 and ML-DSA-87 for National Security Systems, representing the highest parameter sets.
How long does PQC migration take for an enterprise?
Industry estimates consistently run at 42–54 months from start to compliance for a large enterprise. This includes cryptographic asset inventory, prioritization of high-risk systems, vendor assessment, protocol migration (which requires TLS 1.3 as a prerequisite), testing, and staged rollout. Organizations starting a cryptographic inventory in mid-2026 would complete migration in late 2030 to mid-2031 under this framework — at the edge of EO-14412’s December 31, 2030, contractor compliance deadline.
Which algorithms are used in post-quantum cryptography?
The four main mathematical approaches standardized or selected by NIST are: (1) Lattice-based cryptography (ML-KEM, ML-DSA — the primary production standards); (2) Hash-based cryptography (SLH-DSA — conservative backup); (3) Code-based cryptography (HQC — selected March 11, 2025, not yet final standard); and (4) Multivariate polynomial cryptography (under continued evaluation in NIST’s additional signature scheme process). Lattice-based cryptography currently accounts for approximately 50–55% of PQC market share due to its NIST selection and favorable performance characteristics.
Is the U.S. government mandating post-quantum cryptography?
Yes. Multiple overlapping mandates are in effect. The most recent is Executive Order 14412 (June 22, 2026), which requires federal High Value Assets and High Impact Systems to complete PQC key establishment migration by December 31, 2030, and PQC digital signature migration by December 31, 2031. Additionally, the FAR Council must publish rules requiring all covered federal contractors to comply with NIST PQC FIPS by December 31, 2030. NSA CNSA 2.0 requires all new National Security System acquisitions to be PQC-compliant from January 1, 2027.
What is the difference between post-quantum cryptography and quantum key distribution (QKD)?
Post-quantum cryptography (PQC) consists of classical software algorithms that run on conventional computers but are designed to be resistant to quantum attacks. Quantum key distribution (QKD) uses quantum physics principles — specifically the properties of individual photons — to distribute cryptographic keys. PQC operates at internet scale and requires no specialized hardware. QKD requires dedicated physical links and specialized hardware, making it impractical for general internet use. NIST, NSA, and EO-14412 all explicitly focus on PQC as the recommended path; CNSA 2.0 does not include QKD.