Only 34.5% of oil and gas websites support post-quantum cryptography (PQC). The figure comes from F5 Labs’ 2026 State of PQC on the Web report, which scanned the world’s top one million websites. The global average is 54%.
The sectors running critical infrastructure trail everyone else. Telecoms sits at 35.2%, government at 35.4%, and utilities at 39.4%. Those sites hold some of the most sensitive data, yet they’re least ready for attackers who harvest encrypted traffic now to decrypt later.
The dangerous paradox of quantum security is that the industries managing essential infrastructure are in the bottom quartile of readiness.
David Warburton, Director of F5 Labs and report author
| Sector | Websites with PQC |
|---|---|
| Consumer services | 58.8% |
| Technology | 56.1% |
| Consumer goods | 49.8% |
| Utilities | 39.4% |
| Government | 35.4% |
| Telecommunications | 35.2% |
| Oil and gas | 34.5% |
F5 Labs puts the gap down to data sovereignty rules, SCADA (supervisory control and data acquisition) systems, and long procurement cycles. The better-scoring industries mostly route traffic through edge platforms such as Fastly, AWS CloudFront, and Cloudflare, which switched on hybrid PQC key exchanges by default. Cloudflare carries much of the load: remove the domains it hosts and global adoption drops to 22%.
F5 says adoption has effectively doubled since 2025 on a like-for-like basis, but the release doesn’t give the earlier figure. Another 10.51% of sites that answered the scan don’t support TLS 1.3 at all, which rules out post-quantum connections entirely. Adoption also peaks in the middle of the list, at 80% for sites ranked 80,000 to 220,000.
In the Gulf, 56.7% of UAE websites and 53.66% of Saudi websites support PQC, both close to the global average. Ukraine leads at 65.12%, ahead of Australia (63.11%), the US (62.05%), and the UK (60.95%). Much of Europe lags, with Germany at 35.78%, while Japan (29.69%), South Korea (29.08%), Russia (16.09%), and China (13.03%) sit further back. The UAE is also working beyond the web: du and QuantumGate are bringing post-quantum security to the National Hypercloud used by government and critical entities.
The scan checked only each website’s public front end, but Warburton has acknowledged that internal connections behind content delivery networks (CDNs) could be an even bigger target. F5 Labs warns that internal application tiers, private APIs, and corporate databases often still run on legacy cryptography. Its advice is to map every place cryptography is used, pay down technical debt, and press suppliers for crypto-agility.
F5’s own blog suggests Q-Day, when quantum computers can break today’s encryption, may still be two years or more away. Warburton’s point is that waiting is already too late, because adversaries are gathering encrypted data now.
