Sectigo’s Crypto Agility Report 2026: Read the Questionnaire Before the Conclusions
We read Sectigo’s State of Crypto Agility 2026 report. The operational problems deserve attention. The conclusions need more scrutiny.
The report combines post-quantum migration, shorter certificate lifespans and AI-agent identities into an argument for modernising digital trust infrastructure. Its commercial direction is clear: Sectigo sells certificate lifecycle management, and the report’s recommendations align with that business. That does not make the findings false. It does mean readers should distinguish what the survey establishes from what the vendor wants them to conclude.
A survey of seniority is not an assessment of capability
Censuswide collected responses from 500 senior decision-makers in July 2026. The report includes the questionnaire, which is where the limitations become visible.
Take the finding that 38% have fully assessed systems vulnerable to quantum attacks. Respondents selected “Yes, fully”. The published research does not establish what counted as complete, whether supplier-controlled dependencies were included, or whether anyone checked the assessment.
The distinction matters. Two organisations can select the same answer while having done substantially different work. The percentage records their responses, not a common standard of readiness.
The unanswered questions are more useful than the headlines
The report says 62% have a complete, up-to-date inventory of public TLS certificates. It also says 61% experienced a certificate-related outage or incident during the preceding year.
Those findings invite investigation. They do not, by themselves, explain the relationship between visibility and operational failure.
Did organisations with complete inventories have fewer incidents? Were their inventories completed before or after an outage? Which failures involved discovery, validation, deployment, ownership or recovery?
The published results do not provide those cross-tabulations, incident severities or root causes. Consequently, the reader cannot establish which reported practices were associated with better outcomes.
That would be considerably more useful to an investment decision than another percentage showing concern.
An architectural argument needs technical evidence
One chapter declares that “PQC readiness will require a new PKI architecture”. The report then discusses Merkle Tree Certificates and respondents’ expectations of structural change.
There is a legitimate technical discussion to have about certificate size, interoperability and infrastructure adaptation. But a survey of expectations cannot settle it.
The missing distinction is between changes required to support particular algorithms and protocols, and evidence that an organisation needs a fundamentally different certificate architecture. Those are not interchangeable conclusions.
Readers should ask which constraints apply to their environment, which options have been tested and what dependencies each option introduces. A market survey cannot answer those questions for them.
Where the report earns its place
The report is stronger when discussing operations than when drawing broad conclusions from sentiment.
It recognises that certificate renewal can succeed while deployment fails. It calls for vendor commitments, rollback arrangements and measurable performance. It also acknowledges that its expanded geographic sample limits comparisons with the previous year. Those qualifications deserve to remain attached to the headline findings.
But recommendations are not measured results. The questionnaire does not establish how many organisations have successfully replaced a critical cryptographic dependency, recovered from a failed migration or verified that a supplier’s promised capability works in their environment.
Our assessment
Read this as commercially framed market research, not independent assurance of enterprise crypto agility.
Its value lies in identifying reported concerns and operational pressures. Its weakness is the distance between those responses and conclusions about readiness, resilience and architectural direction.
For boards, the next request should be evidence from their own organisation: what can change, who can authorise it, which dependencies constrain it, and what testing demonstrates that the change can be completed safely.
That is the focus of SITG-Consulting’s independent PQC advisory and assurance work: examining exposure, dependencies and the evidence supporting a defensible transition.
The report is worth reading. It is not a readiness certificate.
Comments