How Many Servers Offer Post-Quantum Key Exchange? Two arXiv Scans of 6 November 2026 Count 45.2% of SSH Hosts and 9.1% of Scanned HTTPS Servers, Where F5 Labs Counts 54% of Websites

What two arXiv papers of 6 November 2026 found on SSH and TLS servers

Md Ariful Haque, Sander Vinberg, Ben Edwards and João Cruz posted two measurement studies to arXiv on 6 November 2026, both built on Bitsight's GROMA internet scanning platform. The SSH paper counts 688,814 of 1,523,998 hosts on port 22, or 45.2%, offering a post-quantum key exchange in a scan of 16 February 2026. The TLS paper finds the hybrid X25519MLKEM768 group selected in its own test connections by 9.11% of the HTTPS server addresses it reached and 7.39% of LDAPS servers, and by fewer than 1% of servers for SMTPS, IMAP, POP3, TELNETS and RDP.

Why the percentages disagree with F5 Labs and Forescout

F5 Labs' 2026 report of 22 September counts 54% of the top million websites supporting post-quantum key exchange, and 22% once Cloudflare-hosted domains are removed. Forescout counted 11.8% of about 160 million SSH servers in June. Each figure uses a different population and a different test: an offered algorithm or a negotiated one, a content-delivery edge or an individual server address. Most of the SSH result also rests on sntrup761, a hybrid NIST did not standardize; a hybrid incorporating ML-KEM appears on 5.79% of hosts. The studies are not directly comparable, and definitions explain only part of the spread, which is why a shared definition of PQC adoption matters for supervisors, auditors and buyers.