Classical encryption only protects data for as long as no quantum computer can break it, and that window is closing. Post-quantum cryptography (PQC) is meant to prevent that, but it's spreading highly unevenly: while IT systems often become quantum-safe with a simple software update, operational technology (OT) and medical devices lag far behind.
Growth driven mainly by a version jump
Migration to quantum-safe encryption is progressing, but unevenly. Over the past twelve months, the number of internet-facing SSH servers that support post-quantum cryptography grew from 11.5 to over 19 million, a 72 percent increase. Measured against the total, though, the share of quantum-safe systems remains small: of the more than 160 million SSH hosts tracked by Forescout Research – Vedere Labs, only 11.88 percent support a quantum-resistant key exchange method. Nearly 90 percent don't.
The growth is driven mainly by a version jump: more than 80 percent of the tracked SSH servers run OpenSSH, and since versions 9.x and 10.x, the software ships with quantum-safe methods as standard, first SNTRUP and later ML-KEM. Around 40 percent of OpenSSH servers now support PQC out of the box. Where systems can simply be updated, the transition happens almost incidentally. That's exactly where the problem lies for anything that can't be updated so easily.
Specialized devices measurably lag behind
Within corporate networks, the gap widens further. While roughly half of IT devices already run PQC-capable OpenSSH versions, that figure drops to 28 percent for connected IoT devices. In operational technology it's 16 percent, and for medical devices just six percent. The gap is even more pronounced in embedded systems: of installations of Dropbear, the widely used SSH server found in many embedded devices, only three percent support PQC so far.
The causes are well known and can't be fixed overnight. Unlike SSH, TLS is usually deeply embedded in libraries and applications, and long-lived hardware plus strict certification requirements slow down every change. MITRE Corporation pointed to the particular hurdles facing medical devices in April, after CISA had previously flagged comparable problems in OT. Both categories of devices stay in the field for a long time and are hard to patch.
The risk sits where the least is happening
Adoption rates only become meaningful when combined with actual risk. Layering encryption status over an assessment that factors in vulnerabilities and asset criticality produces an uncomfortable picture: two-thirds of OT devices and nearly half of IoT devices in the networks studied are both highly critical and not quantum-safe at the TLS level, often exactly the equipment that production and utility supply depend on.
On the open internet, there's at least some movement on TLS: TLS 1.3, the only version that can even carry PQC, now runs on 30 percent of tracked servers, up from 19 percent a year earlier. In corporate networks the figures are lower, IT systems are most likely to be quantum-safe at around eight percent, while OT devices sit at just 0.8 percent.
The regulatory clock is already ticking
Waiting for the big quantum computer misjudges the logic of the threat. It weighs especially heavily for data that will still be valuable later, since encrypted data can be captured and stored today to be decrypted once sufficient computing power becomes available. This "harvest now, decrypt later" approach particularly threatens unmanaged, internet-reachable equipment. When a cryptographically relevant quantum computer will become operational remains disputed, but that question is secondary to the need for action.
The timeline is set regardless. In its technical guideline TR-02102, updated in February 2026, Germany's BSI set an expiration date for classical asymmetric methods for the first time: by the end of 2031 they should no longer be used on their own, and for especially sensitive applications already by the end of 2030, after which only hybrid use combined with post-quantum methods will be allowed. BSI President Claudia Plattner calls the transition "non-negotiable." The algorithms have been ready since NIST published the first standards in 2024 with ML-KEM for key exchange and two signature standards; what's lagging is their rollout into the devices themselves.
No crypto inventory, no migration plan
The first step is unspectacular yet the most important: organizations need a continuously maintained inventory of their assets that records which systems support quantum-safe methods and which don't. That inventory only becomes meaningful once it's linked to context like a device's criticality and exposure. That lets migration be prioritized by risk instead of following the path of least resistance. In parallel, the BSI recommends crypto-agility and hybrid use of classical and quantum-safe methods during the transition period.
For devices that can't be updated in the short term, upstream protection helps: secure remote access puts unmanaged equipment behind a gateway, so its vulnerable communication is no longer directly exposed to the internet. That reduces the attack surface while the actual migration is still underway. At the current pace, none of the device classes studied will be fully migrated by 2029, with OT and medical device systems remaining exposed the longest. Because the transition takes years in grown environments, the decision on meeting the BSI's 2030 and 2031 deadlines is effectively being made today.