Miami, FL, January 19, 2026 –(PR.com)– Quantum Exposure Index, powered by QScout26, shows widespread reliance on cryptography vulnerable to harvest-now-decrypt-later attacks.
Qryptonic today released the Quantum Exposure Index, an independent analysis of publicly observable enterprise cryptographic posture and its exposure to future quantum decryption. The analysis was conducted using QScout26, Qryptonic’s quantum-readiness assessment platform.
Using QScout26, Qryptonic analyzed 528 publicly reachable enterprise endpoints, comprising 351 reachable domains from the Tranco Top 500 and 192 reachable endpoints across five sectors: Finance, Healthcare, Government, Energy, and Retail. The analysis found that zero observed endpoints have deployed post-quantum cryptography or hybrid post-quantum key exchange, and that all observed endpoints rely on key-exchange mechanisms vulnerable to future quantum attacks.
“What this data makes clear is that modern cryptography is not the same as quantum-safe cryptography,” said Mark Schrick, Vice President, Quantum Security at Qryptonic. “Even organizations using TLS 1.3 and Perfect Forward Secrecy remain exposed to harvest-now-decrypt-later attacks. From a security standpoint, encrypted data transmitted today should be assumed readable in the future.”
Key Findings
• 0% of analyzed enterprise endpoints are post-quantum ready.
• 100% rely on quantum-vulnerable key exchange, including ECDHE.
• 83.8% have adopted TLS 1.3, yet this does not mitigate quantum exposure.
• Finance and Healthcare show the lowest modern cryptography adoption, at approximately 67% TLS 1.3 usage, compared to roughly 88% in Retail.
• Perfect Forward Secrecy is universal, but does not protect against future mathematical breaks.
The Quantum Exposure Index does not assert when quantum decryption will occur. Instead, it evaluates exposure: whether encrypted data transmitted today could be decrypted retroactively if cryptographically relevant quantum computers become available.
Independent assessments, including research from the Global Risk Institute and government transition guidance, indicate a non-trivial probability of cryptographically relevant quantum capability emerging before 2030, with estimates ranging from single-digit to low-teens percentages by 2029. While timelines remain uncertain, the downside risk is asymmetric, as data harvested today retains its value regardless of when decryption becomes feasible.
“The risk is not that organizations migrate too early,” Schrick added. “The risk is discovering too late that sensitive data was already collected under cryptographic assumptions that no longer hold.”
Methodology Overview
The Quantum Exposure Index is derived solely from publicly observable TLS handshakes and does not involve exploitation, authentication bypass, traffic decryption, or access to private systems.
• Tooling: QScout26
• Domain selection: Tranco Top 500 plus curated sector-specific domain lists
• Reachability: Approximately two-thirds of candidate domains completed TLS negotiation
• Measurements: Protocol version, cipher suite, key-exchange mechanism, and presence of post-quantum or hybrid cryptography
• Scope limitation: Public-facing infrastructure only; no inference of internal compensating controls
Full methodology and limitations are documented at:
https://www.qryptonic.com/quantum-exposure-index/methodology
Disclosure
Qryptonic provides quantum-readiness assessment and post-quantum cryptography migration services, including QScout26. The Quantum Exposure Index is published to advance understanding of cryptographic risk and does not constitute a breach claim or security incident report.
About Qryptonic
Qryptonic is a post-quantum cybersecurity firm focused on measuring, validating, and reducing long-term cryptographic risk. Its QScout26 platform provides cryptographic discovery and quantum exposure analysis to support enterprise security, compliance, and migration planning.
Media Contact
press@qryptonic.com
https://www.qryptonic.com
