Hybrid post-quantum key exchange by country

Country	Large caps	Banks and insurers	Public services
United Kingdom	97.5%92.3% without CDN	95.5%100% without CDN	95.2%50% without CDN
Brazil	77.5%58.3% without CDN	95.5%75% without CDN	42.9%14.3% without CDN
France	85.4%66.7% without CDN	70%25% without CDN	70%40% without CDN
Germany	79.5%53.3% without CDN	66.7%46.2% without CDN	68.2%66.7% without CDN
Italy	70%50% without CDN	71.4%45.5% without CDN	59.1%43.8% without CDN
Spain	80%46.2% without CDN	72.7%33.3% without CDN	40.9%29.4% without CDN
United States	90%66.7% without CDN	90.9%100% without CDN	90.9%77.8% without CDN

Second figure: the same measure excluding sites served through a CDN, which enables post-quantum on their behalf.

United Kingdom

Measured in November 2026

Large British listed companies (40 largest FTSE 100 members)

40 of 40 websites reachable

Hybrid post-quantum key exchange	97.5%	39/40
Hybrid PQ, excluding sites behind a CDN	92.3%	12/13
TLS 1.3 enabled	100%	40/40
Legacy TLS 1.0/1.1 still enabled	0%	0/40
HSTS enabled	67.5%	27/40
Served through a CDN	67.5%	27/40
Certificate with RSA-2048 or weaker	75%	30/40

Certificate keys

RSA 2048: 30
ECDSA p-256: 10

British retail banks and insurers (customer websites)

22 of 22 websites reachable

Hybrid post-quantum key exchange	95.5%	21/22
Hybrid PQ, excluding sites behind a CDN	100%	7/7
TLS 1.3 enabled	100%	22/22
Legacy TLS 1.0/1.1 still enabled	0%	0/22
HSTS enabled	90.9%	20/22
Served through a CDN	68.2%	15/22
Certificate with RSA-2048 or weaker	81.8%	18/22

Certificate keys

RSA 2048: 18
ECDSA p-256: 2
RSA 3072: 2

British public services (GOV.UK and major public bodies)

21 of 21 websites reachable

Hybrid post-quantum key exchange	95.2%	20/21
Hybrid PQ, excluding sites behind a CDN	50%	1/2
TLS 1.3 enabled	95.2%	20/21
Legacy TLS 1.0/1.1 still enabled	0%	0/21
HSTS enabled	71.4%	15/21
Served through a CDN	90.5%	19/21
Certificate with RSA-2048 or weaker	42.9%	9/21

Certificate keys

ECDSA p-256: 12
RSA 2048: 9

Brazil

Measured in November 2026

Large Brazilian listed companies (largest Ibovespa members)

40 of 40 websites reachable

Hybrid post-quantum key exchange	77.5%	31/40
Hybrid PQ, excluding sites behind a CDN	58.3%	7/12
TLS 1.3 enabled	97.5%	39/40
Legacy TLS 1.0/1.1 still enabled	2.5%	1/40
HSTS enabled	57.5%	23/40
Served through a CDN	70%	28/40
Certificate with RSA-2048 or weaker	65%	26/40

Certificate keys

RSA 2048: 26
ECDSA p-256: 12
RSA 4096: 2

Brazilian retail banks and insurers (customer websites)

22 of 22 websites reachable

Hybrid post-quantum key exchange	95.5%	21/22
Hybrid PQ, excluding sites behind a CDN	75%	3/4
TLS 1.3 enabled	100%	22/22
Legacy TLS 1.0/1.1 still enabled	4.5%	1/22
HSTS enabled	72.7%	16/22
Served through a CDN	81.8%	18/22
Certificate with RSA-2048 or weaker	54.5%	12/22

Certificate keys

RSA 2048: 12
ECDSA p-256: 10

Brazilian public services (gov.br and major public bodies)

21 of 21 websites reachable

Hybrid post-quantum key exchange	42.9%	9/21
Hybrid PQ, excluding sites behind a CDN	14.3%	2/14
TLS 1.3 enabled	66.7%	14/21
Legacy TLS 1.0/1.1 still enabled	33.3%	7/21
HSTS enabled	57.1%	12/21
Served through a CDN	33.3%	7/21
Certificate with RSA-2048 or weaker	76.2%	16/21

Certificate keys

RSA 2048: 16
ECDSA p-256: 4
RSA 4096: 1

France

Measured in November 2026

Large French listed companies (CAC 40 members and recent members)

41 of 41 websites reachable

Hybrid post-quantum key exchange	85.4%	35/41
Hybrid PQ, excluding sites behind a CDN	66.7%	12/18
TLS 1.3 enabled	95.1%	39/41
Legacy TLS 1.0/1.1 still enabled	0%	0/41
HSTS enabled	80.5%	33/41
Served through a CDN	56.1%	23/41
Certificate with RSA-2048 or weaker	58.5%	24/41

Certificate keys

RSA 2048: 24
ECDSA p-256: 14
RSA 4096: 3

French retail banks and insurers (customer websites)

20 of 20 websites reachable

Hybrid post-quantum key exchange	70%	14/20
Hybrid PQ, excluding sites behind a CDN	25%	2/8
TLS 1.3 enabled	85%	17/20
Legacy TLS 1.0/1.1 still enabled	0%	0/20
HSTS enabled	85%	17/20
Served through a CDN	60%	12/20
Certificate with RSA-2048 or weaker	65%	13/20

Certificate keys

RSA 2048: 13
ECDSA p-256: 4
RSA 4096: 3

French public services (major government websites)

20 of 20 websites reachable

Hybrid post-quantum key exchange	70%	14/20
Hybrid PQ, excluding sites behind a CDN	40%	4/10
TLS 1.3 enabled	100%	20/20
Legacy TLS 1.0/1.1 still enabled	5%	1/20
HSTS enabled	45%	9/20
Served through a CDN	50%	10/20
Certificate with RSA-2048 or weaker	45%	9/20

Certificate keys

RSA 2048: 9
RSA 4096: 4
RSA 3072: 3
ECDSA p-256: 2
ECDSA p-384: 2

Germany

Measured in November 2026

Large German listed companies (DAX 40)

39 of 40 websites reachable

Hybrid post-quantum key exchange	79.5%	31/39
Hybrid PQ, excluding sites behind a CDN	53.3%	8/15
TLS 1.3 enabled	94.9%	37/39
Legacy TLS 1.0/1.1 still enabled	0%	0/39
HSTS enabled	76.9%	30/39
Served through a CDN	61.5%	24/39
Certificate with RSA-2048 or weaker	66.7%	26/39

Certificate keys

RSA 2048: 26
ECDSA p-256: 9
RSA 4096: 4

German retail banks and insurers (customer websites)

21 of 22 websites reachable

Hybrid post-quantum key exchange	66.7%	14/21
Hybrid PQ, excluding sites behind a CDN	46.2%	6/13
TLS 1.3 enabled	95.2%	20/21
Legacy TLS 1.0/1.1 still enabled	0%	0/21
HSTS enabled	81%	17/21
Served through a CDN	38.1%	8/21
Certificate with RSA-2048 or weaker	42.9%	9/21

Certificate keys

RSA 2048: 9
RSA 4096: 5
ECDSA p-256: 4
RSA 3072: 2
ECDSA p-384: 1

German public services (major federal and state government websites)

22 of 22 websites reachable

Hybrid post-quantum key exchange	68.2%	15/22
Hybrid PQ, excluding sites behind a CDN	66.7%	14/21
TLS 1.3 enabled	95.5%	21/22
Legacy TLS 1.0/1.1 still enabled	9.1%	2/22
HSTS enabled	68.2%	15/22
Served through a CDN	4.5%	1/22
Certificate with RSA-2048 or weaker	9.1%	2/22

Certificate keys

RSA 4096: 11
ECDSA p-256: 7
RSA 2048: 2
ECDSA p-384: 1
RSA 3072: 1

Italy

Measured in November 2026

Large Italian listed companies (FTSE MIB)

40 of 40 websites reachable

Hybrid post-quantum key exchange	70%	28/40
Hybrid PQ, excluding sites behind a CDN	50%	12/24
TLS 1.3 enabled	92.5%	37/40
Legacy TLS 1.0/1.1 still enabled	5%	2/40
HSTS enabled	60%	24/40
Served through a CDN	40%	16/40
Certificate with RSA-2048 or weaker	87.5%	35/40

Certificate keys

RSA 2048: 35
ECDSA p-256: 5

Italian retail banks and insurers (customer websites)

21 of 21 websites reachable

Hybrid post-quantum key exchange	71.4%	15/21
Hybrid PQ, excluding sites behind a CDN	45.5%	5/11
TLS 1.3 enabled	90.5%	19/21
Legacy TLS 1.0/1.1 still enabled	0%	0/21
HSTS enabled	85.7%	18/21
Served through a CDN	47.6%	10/21
Certificate with RSA-2048 or weaker	81%	17/21

Certificate keys

RSA 2048: 17
ECDSA p-256: 3
RSA 4096: 1

Italian public services (major government websites)

22 of 22 websites reachable

Hybrid post-quantum key exchange	59.1%	13/22
Hybrid PQ, excluding sites behind a CDN	43.8%	7/16
TLS 1.3 enabled	90.9%	20/22
Legacy TLS 1.0/1.1 still enabled	9.1%	2/22
HSTS enabled	45.5%	10/22
Served through a CDN	27.3%	6/22
Certificate with RSA-2048 or weaker	68.2%	15/22

Certificate keys

RSA 2048: 15
ECDSA p-256: 6
RSA 4096: 1

Spain

Measured in November 2026

Large Spanish listed companies (IBEX 35)

35 of 35 websites reachable

Hybrid post-quantum key exchange	80%	28/35
Hybrid PQ, excluding sites behind a CDN	46.2%	6/13
TLS 1.3 enabled	94.3%	33/35
Legacy TLS 1.0/1.1 still enabled	0%	0/35
HSTS enabled	71.4%	25/35
Served through a CDN	62.9%	22/35
Certificate with RSA-2048 or weaker	65.7%	23/35

Certificate keys

RSA 2048: 23
ECDSA p-256: 11
RSA 4096: 1

Spanish retail banks and insurers (customer websites)

22 of 22 websites reachable

Hybrid post-quantum key exchange	72.7%	16/22
Hybrid PQ, excluding sites behind a CDN	33.3%	3/9
TLS 1.3 enabled	90.9%	20/22
Legacy TLS 1.0/1.1 still enabled	4.5%	1/22
HSTS enabled	68.2%	15/22
Served through a CDN	59.1%	13/22
Certificate with RSA-2048 or weaker	77.3%	17/22

Certificate keys

RSA 2048: 17
ECDSA p-256: 4
RSA 4096: 1

Spanish public services (major government websites)

22 of 22 websites reachable

Hybrid post-quantum key exchange	40.9%	9/22
Hybrid PQ, excluding sites behind a CDN	29.4%	5/17
TLS 1.3 enabled	81.8%	18/22
Legacy TLS 1.0/1.1 still enabled	13.6%	3/22
HSTS enabled	54.5%	12/22
Served through a CDN	22.7%	5/22
Certificate with RSA-2048 or weaker	68.2%	15/22

Certificate keys

RSA 2048: 15
ECDSA p-256: 5
RSA 4096: 2

United States

Measured in November 2026

Large US listed companies (40 largest S&P 500 members)

40 of 40 websites reachable

Hybrid post-quantum key exchange	90%	36/40
Hybrid PQ, excluding sites behind a CDN	66.7%	6/9
TLS 1.3 enabled	95%	38/40
Legacy TLS 1.0/1.1 still enabled	5%	2/40
HSTS enabled	80%	32/40
Served through a CDN	77.5%	31/40
Certificate with RSA-2048 or weaker	67.5%	27/40

Certificate keys

RSA 2048: 27
ECDSA p-256: 13

US retail banks and insurers (customer websites)

22 of 22 websites reachable

Hybrid post-quantum key exchange	90.9%	20/22
Hybrid PQ, excluding sites behind a CDN	100%	5/5
TLS 1.3 enabled	95.5%	21/22
Legacy TLS 1.0/1.1 still enabled	0%	0/22
HSTS enabled	63.6%	14/22
Served through a CDN	77.3%	17/22
Certificate with RSA-2048 or weaker	86.4%	19/22

Certificate keys

RSA 2048: 19
ECDSA p-256: 3

US public services (major federal government websites)

22 of 22 websites reachable

Hybrid post-quantum key exchange	90.9%	20/22
Hybrid PQ, excluding sites behind a CDN	77.8%	7/9
TLS 1.3 enabled	95.5%	21/22
Legacy TLS 1.0/1.1 still enabled	0%	0/22
HSTS enabled	86.4%	19/22
Served through a CDN	59.1%	13/22
Certificate with RSA-2048 or weaker	63.6%	14/22

Certificate keys

RSA 2048: 14
ECDSA p-256: 8

Method: standard TLS handshakes with our open methodology, at most two sites at a time. Only aggregated figures are published, never per-site results. Site owners can opt out. Read the methodology · opt-out