[{"data":1,"prerenderedAt":133},["ShallowReactive",2],{"news-\u002Fnews\u002Finformation-technology-cloud-hybrid-post-quantum":3},{"id":4,"title":5,"author":6,"authorTitle":7,"authorUrl":8,"body":9,"canonical":8,"category":85,"date":86,"description":87,"draft":88,"extension":89,"faqs":8,"findingsSource":8,"geo":90,"image":8,"industries":94,"keyFindings":8,"meta":97,"modified":98,"navigation":99,"path":100,"pullquote":8,"recommendations":8,"references":101,"related":114,"seo":121,"seoTitle":122,"signposts":8,"slug":123,"stats":8,"stem":124,"tags":125,"tldr":131,"__hash__":132},"news\u002Fnews\u002Finformation-technology-cloud-hybrid-post-quantum.md","Cloud Providers Ship Hybrid Post-Quantum Encryption as Regulators Set 2030 and 2035 Milestones","ArcQubit Team","",null,{"type":10,"value":11,"toc":76},"minimark",[12,17,26,30,40,44,55,59,62,66,69,73],[13,14,16],"h2",{"id":15},"the-answer-up-front","The answer, up front",[18,19,20,21,25],"p",{},"The information-technology sector owns the cryptography the rest of the economy runs on, and it is already shipping post-quantum protection at scale. Cloudflare reported in February 2026 that more than 60 percent of human-generated TLS traffic to its network already uses hybrid ML-KEM protection ",[22,23,24],"span",{},"1",". At the same time, UK and EU timelines put the weight of the migration on software, cloud and managed-service providers, because smaller organizations will largely migrate through the products they buy. Cloudflare is a vendor reporting its own deployment data, so read its figures as self-reported.",[13,27,29],{"id":28},"cloud-providers-are-deploying","Cloud providers are deploying",[18,31,32,33,35,36,39],{},"Cloudflare announced in February 2026 that it extended hybrid ML-KEM post-quantum key exchange to its IPsec service and the Cloudflare One Appliance, covering its full SASE platform, following the IETF-standardized hybrid model that runs post-quantum key exchange alongside classical Diffie-Hellman ",[22,34,24],{},". A July 2025 TechTarget survey describes a phased approach at AWS, investment in key-management and HSM services at Google, and post-quantum TLS tunnels at Cloudflare, and it names four obstacles: legacy hardcoded cryptography, missing cryptographic inventories, third-party library and HSM dependencies, and integration complexity ",[22,37,38],{},"2",".",[13,41,43],{"id":42},"regulators-set-the-pace","Regulators set the pace",[18,45,46,47,50,51,54],{},"The UK's NCSC sets discovery by 2028, high-priority migration by 2031, and full migration by 2035, and it notes that small and medium enterprises typically migrate through vendor and service upgrades, which puts weight on software vendors and cloud and managed-service providers ",[22,48,49],{},"3",". The EU applies similar pressure: Member States should start national strategies by the end of 2026, move high-risk use cases by the end of 2030, and finish by 2035 where feasible, with first steps including cryptographic asset management and supply-chain coordination and next steps tied to the Cyber Resilience Act and NIS2 ",[22,52,53],{},"4",". The EU detail comes from trade coverage rather than the primary text.",[13,56,58],{"id":57},"why-it-carries-the-load","Why IT carries the load",[18,60,61],{},"Because so many organizations will migrate through their vendors, the IT sector effectively carries the migration for everyone downstream. That is why the four obstacles the TechTarget survey names, especially missing cryptographic inventories and hardcoded cryptography, matter beyond IT: an unresolved dependency in a widely used product propagates to every customer.",[13,63,65],{"id":64},"what-this-means-for-it-providers","What this means for IT providers",[18,67,68],{},"Software, cloud and managed-service providers should expect customers to ask what post-quantum support their products carry and when. The practical steps are to inventory cryptography across the product estate, remove hardcoded algorithms in favor of agile interfaces, and publish a clear post-quantum roadmap customers can plan against.",[13,70,72],{"id":71},"how-arcqubit-approaches-it","How ArcQubit approaches it",[18,74,75],{},"ArcQubit treats discovery and crypto agility as the core problem for IT providers. QuCode builds the cryptographic inventory across the product and infrastructure estate, and QuTrust holds the migration plan so a provider can show customers a current, defensible roadmap rather than a one-off attestation.",{"title":7,"searchDepth":77,"depth":77,"links":78},2,[79,80,81,82,83,84],{"id":15,"depth":77,"text":16},{"id":28,"depth":77,"text":29},{"id":42,"depth":77,"text":43},{"id":57,"depth":77,"text":58},{"id":64,"depth":77,"text":65},{"id":71,"depth":77,"text":72},"Analysis","2026-02-23","Cloudflare reports 60%+ of human TLS traffic already uses hybrid post-quantum protection. UK and EU timelines put the migration weight on software and cloud vendors.",false,"md",[91,92,93],"uk","eu","global",[95,96],"Cross-Sector","Information Technology",{},"2026-09-13",true,"\u002Fnews\u002Finformation-technology-cloud-hybrid-post-quantum",[102,105,108,111],{"label":103,"url":104},"S. Goldberg, A. Paul, and D. Gauch, \"Cloudflare One is the first SASE offering modern post-quantum encryption across the full platform,\" Cloudflare Blog, Feb. 23, 2026.","https:\u002F\u002Fblog.cloudflare.com\u002Fpost-quantum-sase\u002F",{"label":106,"url":107},"G. Lawton, \"The cloud's role in PQC migration,\" TechTarget, Jul. 7, 2025.","https:\u002F\u002Fwww.techtarget.com\u002Fsearchcloudcomputing\u002Ftip\u002FThe-clouds-role-in-PQC-migration",{"label":109,"url":110},"UK National Cyber Security Centre, \"Setting direction for the UK's migration to post-quantum cryptography,\" NCSC blog, Mar. 20, 2025.","https:\u002F\u002Fwww.ncsc.gov.uk\u002Fsites\u002Fdefault\u002Ffiles\u002Fpdfs\u002Fblog\u002Fsetting-direction-uk-migration-to-pqc.pdf",{"label":112,"url":113},"A. Ribeiro, \"EU begins coordinated effort for Member States to switch critical infrastructure to quantum-resistant encryption by 2030,\" Industrial Cyber, Jun. 24, 2025.","https:\u002F\u002Findustrialcyber.co\u002Fregulation-standards-and-compliance\u002Feu-begins-coordinated-effort-for-member-states-to-switch-critical-infrastructure-to-quantum-resistant-encryption-by-2030\u002F",[115,118],{"label":116,"url":117},"Does Chrome Support Post-Quantum Cryptography?","\u002Fblog\u002Fdoes-chrome-support-post-quantum-cryptography",{"label":119,"url":120},"Hybrid vs Pure Post-Quantum","\u002Fblog\u002Fhybrid-vs-pure-post-quantum",{"title":5,"description":87},"Cloud Ships Hybrid Post-Quantum TLS","information-technology-cloud-hybrid-post-quantum","news\u002Finformation-technology-cloud-hybrid-post-quantum",[126,127,128,129,130],"operational technology","PQC migration","NCSC PQC timelines","EU PQC roadmap","for enterprises","Cloudflare reports that more than 60 percent of human-generated TLS traffic to its network already uses hybrid post-quantum protection, while UK and EU timelines put weight on software and cloud vendors to carry smaller customers through the migration.","-J7WIAqIxNisOMvpZDCN1iUyPGlW1uWOWfXQ9wLYiNI",1792182885866]