On 23 September 1999 NASA lost the Mars Climate Orbiter as it arrived at Mars. The investigation found that ground software from the spacecraft's builder reported thruster impulse in pound-force seconds, while the navigation team's software read the same figures as newton-seconds, understating each thruster firing by a factor of about 4.45. NASA's Mishap Investigation Board reported that cause on 10 November 1999. The interface specification required metric units; the delivered software did not follow it, and the checks did not catch the mismatch before arrival.
Post-quantum cryptography now has the same problem in a milder form. Several careful measurements of how far the internet has moved to quantum-resistant key exchange were published this autumn, and they report rates from under 1% to 54%. Each figure is defensible within its own method, and the methods measure different populations in different ways.
Practical takeaway. A post-quantum adoption figure means little without four details: the population scanned, whether the algorithm was offered or negotiated, whether a content-delivery edge or the origin server answered, and which algorithm was counted. On SSH, counting only hybrids that incorporate NIST-standardized ML-KEM turns 45.2% of hosts into about 6%.
What the two arXiv papers of 6 November 2026 measured: 1.52 million SSH hosts and 70,000 TLS targets
Md Ariful Haque, Sander Vinberg, Ben Edwards and João Cruz posted both papers on 6 November. Both rely on Bitsight's GROMA scanning platform, so they share one data source and one research team, and they should be read as a pair, with no independent confirmation of each other.
The SSH study (arXiv 2611.09703) takes GROMA's records for port 22 from a full scan day, 16 February 2026. It marks a server as post-quantum enabled when any post-quantum variant appears in the key exchange algorithms the server lists. By that test, 688,814 of 1,523,998 hosts, or 45.2%, support post-quantum key exchange. At the level of organizations, 10,788 of 27,012 entities, or 39.9%, have at least one such host. Education and telecommunications exceed 50%; most industrial and professional sectors sit between 25% and 35%.
The TLS study (arXiv 2611.09707) works differently. It draws 10,000 IPv4 addresses per service for seven services, scans them from a cloud instance, and records the key exchange group each server selects in its TLS 1.3 reply. The only post-quantum group it observes is the hybrid X25519MLKEM768. The paper does not state its scan dates.
Why 45.2% of SSH hosts shrinks to 5.79% when only hybrids incorporating ML-KEM count
The SSH paper's own table explains most of its headline. The variant sntrup761x25519-sha512@openssh.com appears on 681,490 hosts, or 44.86%, and its unsuffixed form on another 11.08% (the variants overlap). That is the Streamlined NTRU Prime hybrid, which OpenSSH added in version 8.5 in 2021 and made its default in version 9.0 in 2022, before any post-quantum standard existed. NIST did not select NTRU Prime; its key establishment standard of August 2024, FIPS 203, specifies ML-KEM. The hybrid mlkem768x25519-sha256, which OpenSSH 10.0 made its default for key agreement on 9 April 2025, appears on 88,088 hosts, or 5.79%. Other ML-KEM variants add about a thousand more.
Both hybrids aim to protect a session against later decryption, provided the post-quantum half holds. The difference matters when an organization reports its progress against NIST's transition. NIST's final IR 8547, published in October 2026, says NIST will deprecate all quantum-vulnerable cryptography after 2030 and disallow it under NIST standards and guidelines after 2035, as organizations migrate "to ML-KEM or other approved quantum-resistant techniques." Counting only offered hybrids that incorporate ML-KEM gives roughly one SSH host in seventeen, where counting any post-quantum hybrid gives almost one in two. Either figure describes algorithm support on offer; neither shows a conforming implementation or a session actually negotiated.
The population matters too. The Forescout measurement Quentir covered on 3 September counted more than 19 million post-quantum SSH servers among about 160 million, or 11.8%. Bitsight's 1.52 million hosts come from one scan day and its own selection, and the paper does not say how GROMA chose them. Sampling is one possible explanation for the distance between 11.8% and 45.2%, and neither paper resolves it.
Why F5 Labs counts 54% of websites and the TLS server scan counts 9.1%: the content-delivery edge
F5 Labs' 2026 State of PQC on the Web, published on 22 September by David Warburton with Kevin Stewart and Chase Abbott, finds that 54% of the top one million websites support post-quantum key exchange, almost all through X25519MLKEM768. Its method collects every key exchange a site offers. It then removes Cloudflare-hosted domains, and average adoption falls from 54% to 22%. In the top 100,000 domains, government sites reach 35.4% and utilities 39.4%.
The TLS paper explains the gap from the other side. Its own scans found about 83.6% of Cloudflare-hosted domains post-quantum enabled, but only about 4% of Cloudflare-hosted IP addresses. It also cites Cloudflare Radar at 57.3% of human HTTPS traffic and 7.4% of origin connections. A visitor's browser talks to the edge, which a provider upgraded for millions of customers at once, as Quentir described in its August reading of the post-quantum web as a platform setting. The TLS paper's own figure measures something else: 816 of the 8,960 HTTPS server addresses that answered its scanner, or 9.1% of scanned servers, selected the hybrid in a connection from the researchers' client. It does not trace connections between a content-delivery network and the servers behind it; Cloudflare's separate 7.4% figure for origin traffic is the closer measure of that link.
Which services lag: mail under 1%, LDAPS at 7.39% and remote desktop at one server in 8,602
Outside the web the TLS paper finds little movement. Among servers that answered, SMTPS reached 0.45%, IMAP over TLS 0.64% and POP3 over TLS 0.51%. LDAPS, which carries directory lookups and often credentials, reached 7.39%. TELNETS reached 13 servers out of 8,486, and RDP one of 8,602. At the level of organizations, 308 of 4,636 entities had post-quantum key exchange on at least one scanned server.
These channels are exposed to harvest-now-decrypt-later risk wherever their content must stay confidential for years. Mail carries contracts, medical letters, payroll and personal correspondence with long confidentiality lives. Remote desktop and directory traffic carry the access that protects everything else. On these figures, a household's bank or a patient's clinic can show a post-quantum handshake in the browser while its mail and staff logins still run classical key exchange.
How Quentir Reads It
The studies cover different protocols, populations and methods, so they cannot be merged into one adoption rate, and their definitions explain only part of the spread. Read side by side, they point in one direction: provider edges and OpenSSH defaults have moved, while the scanned mail, directory and remote-desktop servers and other back-office protocols show little movement. A plan template or vendor questionnaire that asks whether a service is "PQC-enabled" without defining the term lets each respondent report the figure that applies to its own setup, which for a site behind a content-delivery network may be the edge. A definition that names the server measured, negotiated key exchange in place of an offered list, and the algorithm counted would make the answers comparable.
Quentir's Signature Brief 2026.4, Crypto-Agility as a Verifiable Duty, covers the side this post leaves out: maturity models with published evaluations, quantified agility metrics and the covenant gap in existing contracts. The next test comes when a supervisory plan template first defines what counts as migrated; on the SSH sample alone, the choice of definition moves the answer between 45.2% and about 6%.
Sources: Md Ariful Haque, Sander Vinberg, Ben Edwards and João Cruz, "Empirical Study of Post-Quantum Cryptography Adoption Status in SSH Infrastructure", arXiv 2611.09703, 6 November 2026; the same authors, "Empirical Assessment of Post-Quantum Cryptography Adoption Status in TLS", arXiv 2611.09707, 6 November 2026; F5 Labs, David Warburton with Kevin Stewart and Chase Abbott, "2026 State of PQC on the Web", 22 September 2026; OpenSSH, OpenSSH 9.0 release notes, 2022, and OpenSSH 10.0 release notes, 9 April 2025; NIST, FIPS 203, Module-Lattice-Based Key-Encapsulation Mechanism Standard, August 2024; NIST, IR 8547, Transition to Post-Quantum Cryptography Standards, final, October 2026; NASA Mars Climate Orbiter Mishap Investigation Board, Phase I Report, 10 November 1999. Links checked 9 November 2026.
Published intelligence, built to inform your own decisions. Published: November 9, 2026.