In April, banking was the least post-quantum-ready sector we measured

vradarvradar
in Security

We probe the same 350 public TLS endpoints for hybrid key agreement (codepoints 0x11EC and 0x11EB) and re-run it on the same list every few months. Third run finished this week: 23 Apr, 10 May, 3 Sep 2026.

Banking went from 28% to 94% on the fixed cohort. That is the largest sector move in the set, though not the highest figure — news and media finished at 96.4%.

The number we actually stand behind is the cohort one, not the headline. Only 293 of the 350 hosts answered in both runs, so every delta is computed on those 293: 50.2% PQ-safe in April, 86.0% in September. The all-350 comparison would read 42.6% to 73.1%, but the set of hosts that answered changed between runs, and a shifting denominator can manufacture a trend out of nothing.

105 hosts moved from classical to post-quantum hybrid. Across all three runs, zero moved the other way. That zero is the control — something could have regressed and nothing did.

Two limits worth stating up front: this is one public endpoint per host, so it is a front door and not an estate; and it cannot tell a deliberate migration apart from a CDN or load-balancer default rolling forward underneath someone who made no decision at all.

Write-up, method and the per-sector aggregate counts:
https://dev.to/xuxu298/in-april-banking-was-the-least-post-quantum-ready-sector-we-measured-it-is-now-second-from-the-29ad

Corrections wanted. If you can show a sector figure is wrong, that the cohort method hides an artefact rather than removing one, or that 0x11EB should be counted differently, say so and we will re-run and publish the correction with the same prominence as the original claim.

Comments

This discussion has been closed.