Cloudflare Drives 54% of Top Sites to Use Post-Quantum Cryptography

F5 Labs research indicates that 54% of the world’s top one million websites now support post-quantum key exchange. This statistic suggests widespread adoption of quantum-resistant security measures at the web edge. However, the study reveals that this progress is largely driven by content delivery network providers enabling protection by default. Organizations are not necessarily upgrading their own infrastructure to meet this emerging threat.

Why does the 54% figure misrepresent enterprise readiness?

The apparent high adoption rate masks a significant gap in internal security upgrades. According to F5 Labs, much of the support comes from CDN providers rather than organizations securing their own backend systems. When researchers removed sites hosted by Cloudflare from the dataset, the support figure dropped sharply to 22%. This discrepancy highlights that edge protection does not equate to full organizational readiness for quantum computing threats.

What do security leaders say about internal adoption?

A June survey by KPMG found that only 27% of CISOs are actively implementing post-quantum cryptography. Despite this low internal adoption, 38% of those leaders view quantum computing as a top high-impact emerging threat. David Warburton, director of F5 Labs, noted that the 54% figure can be misleading. He emphasized the need to clarify what is being measured, as default CDN settings create a false sense of comprehensive security coverage.

Where are the remaining security gaps located?

F5 Labs examined only the website front end, without accessing application servers behind CDNs like Akamai or Amazon CloudFront. The study did not determine whether internal traffic uses post-quantum cryptography. Warburton warned that internal connections could be targets for "harvest now, decrypt later" attacks. Serhii Nikolaichuk of The Capital Index added that service meshes, VPNs, and code signing remain invisible from the outside, representing the true locus of enterprise readiness.

How do experts view the scope of CDN protection?

Independent experts agree that edge adoption is not a reliable measure of overall readiness. Anastazija Pažin of Deloitte stated that CDN-enabled protection secures the client-to-edge connection. However, she noted this protection does not automatically extend to origin servers, internal APIs, or enterprise PKI. True post-quantum readiness requires upgrading every layer of the technology stack, not just the public-facing perimeter.

What to do and how to stay safe: F5 Labs

• Audit internal service-to-service communications to verify if post-quantum algorithms are used.
• Check if your CDN provider enables post-quantum cryptography by default for your domain.
• Review internal PKI and code signing processes for quantum-resistant standards.
• Monitor vendor roadmaps for updates on origin server and API security upgrades.

Step-by-step guide: 7 Phishing Mistakes That Bypass Your Defenses

General security guidance from the Firewall Scoop newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Does using a CDN mean my entire business is quantum-safe?

No, F5 Labs found that CDN providers enable protection at the edge, but internal servers and APIs may remain unprotected.

Which CDN provider has the biggest impact on these statistics?

Removing Cloudflare-hosted sites from the F5 Labs study caused the support figure to drop from 54% to 22%.

How many CISOs are actively implementing post-quantum cryptography?

According to a KPMG survey, only 27% of CISOs are actively implementing post-quantum cryptography.