Measuring Post-Quantum TLS Deployment Across UK Internet Sectors

Abstract

Post-quantum cryptography (PQC) is becoming an important component of long-term trust in Internet-facing infrastructure. Publicly observable PQC support provides evidence of externally visible deployment, but does not necessarily reflect the overall progress of an organisation's post-quantum migration. This distinction matters when observable deployment is used as an indicator of organisational readiness or progress towards migration deadlines. We present a measurement study of observable PQC deployment across 4,665 UK organisations spanning ten sectors. We measure post-quantum key-exchange support across HTTPS and SMTP STARTTLS endpoints, attribute reachable endpoints to their underlying infrastructure providers where possible, and statistically examine protocol-, sector-, and provider-level deployment patterns. Among reachable endpoints, 44.0\% of HTTPS services supported at least one evaluated PQC key-exchange group, compared with 6.4\% of SMTP services. Among organisations reachable over both protocols, HTTPS support was significantly more common than SMTP support (matched odds ratio 16.89). Although deployment varied across sectors, infrastructure provider identity was substantially more predictive than organisational sector, and observable deployment was highly concentrated among a small number of providers. Only 144 organisations supported PQC across both web and email infrastructure, highlighting an uneven and fragmented migration landscape. No post-quantum certificate signatures were observed across the measured endpoints. These findings show that observable PQC deployment is currently shaped predominantly by infrastructure-provider deployment decisions and should not be interpreted as a complete measure of organisational migration readiness.