Quantum computers remain experimental, yet they will threaten today’s encryption once they scale. The modern internet relies on RSA and elliptic-curve cryptography—defenses a sufficiently powerful quantum computer could break in days rather than centuries. It sounds speculative, yet the shift has already begun: browsers and major content delivery networks (CDNs) have started protecting your connections with new post-quantum cryptography (PQC).
In 2024, the U.S. National Institute of Standards and Technology finalized the first PQC standards—ML-KEM, ML-DSA, and SLH-DSA—designed to withstand quantum attacks. Google Chrome shifted to the standardized ML-KEM naming, and Cloudflare reports that by March 2025, well over a third of human HTTPS traffic on its network already used hybrid post-quantum handshakes.
Organizations are preparing their own migrations in parallel. The National Cybersecurity Center of Excellence at NIST outlines a first step that sounds almost mundane: deploy a discovery agent on endpoints to find where vulnerable cryptography lives. These scans feed into a Cryptography Bill of Materials (CBOM), a map of algorithms, keys, and certificates that must be updated.
Taken together—the web quietly securing the edge, and businesses inventorying crypto inside—these shifts tell a larger story. Post-quantum protections are moving from lab theory to production across everyday internet infrastructure.
Post-Quantum Rollout in Brief
- Standards finalized: NIST published FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA) in August 2024.
- Chrome adopted the ML-KEM name to align with the new NIST standards across documentation and enterprise guidance.
- Cloudflare measured roughly 38% of HTTPS traffic on its network using hybrid PQC by March 2025.
- NIST SP 1800-38B recommends installing and configuring a discovery agent.
- CBOMs describe what cryptography you use, where it resides, and how it connects across your systems.
What Your Browser Does to Enable Post-Quantum TLS
Hybrid Key Exchange in Plain Terms
On each HTTPS connection, the browser and server negotiate session protection. Traditionally that meant elliptic-curve cryptography such as X25519. The new approach adds a second lock—ML-KEM alongside X25519—forming a hybrid key exchange. Think of a digital deadbolt paired with a smart lock—if one fails, the other holds.
The Internet Engineering Task Force (IETF) has drafted named groups like X25519MLKEM768, which browsers and servers negotiate during the TLS handshake. That’s how hybrid protection works today—no user settings required.
Why Chrome Adopted the ML-KEM Name
When NIST finalized PQC standards, it assigned official FIPS labels to the selected algorithms. What was “Kyber” became ML-KEM under FIPS 203. Chrome followed suit and updated policies and enterprise guidance so administrators could align with the standardized names. The shift reduces cross-vendor confusion, aligns implementations, and accelerates interoperability.
Adoption Numbers so Far
According to Cloudflare’s 2025 adoption report, approximately 38% of human HTTPS traffic on its network now runs over hybrid PQC. That’s a sharp jump from pilot phases a year earlier. Adoption remains uneven; some regions and networks lag. Even so, the data shows large-scale deployment is possible without disrupting the user experience, and for most users it operates silently in the background.
What this Shift Means for Everyday Privacy
For everyday readers, the key takeaway is straightforward: if you’re running an up-to-date browser and connecting to a major CDN, chances are many of your web sessions are already quantum-resistant. You don’t need to change advanced settings or install plugins.
Not every website, CDN, or service provider has enabled hybrid PQC yet. Keep your browser updated and favor platforms that disclose their quantum-safe status.
On the organizational side, discovery agents and CBOMs will help companies plan internal upgrades so that future connections—emails, VPNs, software updates—can stand up to quantum attacks as well. Together, quiet changes at the edge and deliberate audits inside organizations mark the first real chapter of the post-quantum era.
Mapping Crypto Dependencies with Discovery Agents and CBOMs
How to Deploy Endpoint Discovery Agents
Replacing vulnerable cryptography starts with locating it—which is why organizations deploy discovery agents. The National Cybersecurity Center of Excellence at NIST specifies in its migration guide that the first operational step is to install and configure an endpoint discovery agent. These lightweight tools scan software, network traffic, and system libraries to locate algorithms such as RSA and ECC that quantum computers could eventually break.
These agents enumerate algorithms, certificates, and protocols in use. Discovery agents analyze code and data flows, record findings, and create a digital paper trail. The work extends beyond spotting old algorithms; it also uncovers hidden dependencies—such as embedded certificates, outdated protocols, or overlooked applications—that might otherwise escape audits.
From Scan to Cryptography Bill of Materials (CBOM)
Teams compile scan results into a Cryptography Bill of Materials (CBOM). According to the CycloneDX specification, a CBOM lists cryptographic elements in use—algorithms, key sizes, certificate chains, libraries, and ownership details. It provides a structured inventory of cryptographic components across the environment.
Producing a CBOM creates a living map of an organization’s cryptographic assets. The inventory highlights which systems must be migrated first, which can transition later, and where to deploy hybrid TLS 1.3 with ML-KEM safely.
Turn Findings into a Safe Migration Plan
Once a CBOM is in place, teams can prioritize remediation based on risk. High-risk items—such as public-facing sites still using RSA—move to the top of the list. Lower-priority exposures—such as internal test systems—can be scheduled later. Most teams use a staged rollout: first enable hybrid key exchange at the edge, then update application stacks and firmware-signing processes.
A step-by-step approach reduces downtime risk and helps teams identify compatibility issues early. It also helps leadership track progress against regulatory milestones, such as the U.S. federal government’s National Security Memorandum 10 and the Commercial National Security Algorithm Suite 2.0, both of which set deadlines for adopting post-quantum standards across federal systems.
Under the Hood: How Hybrid TLS Works
IETF Drafts that Enable Hybrid TLS
The Internet Engineering Task Force is drafting the building blocks for hybrid connections. A hybrid TLS handshake combines a classical algorithm like X25519 with a post-quantum algorithm such as ML-KEM. IETF drafts such as TLS Hybrid Key Exchange Design and named groups like X25519MLKEM768 specify how browsers and servers negotiate these combinations.
Why Draft Status Matters Now
Because these are still Internet-Drafts, vendors retain flexibility in implementation. The draft status explains why adoption rates differ across providers and regions. Even so, rapid adoption by Google Chrome and Cloudflare indicates the plumbing is robust enough for wide-scale deployment. IETF drafts frequently progress into standards, so early alignment prevents last-minute migrations.
How Edge and Agents are Making Browsing Quantum-Safe
Post-quantum cryptography is no longer theoretical—it is unfolding across today’s devices and services. Browsers and CDNs have led the way, quietly adding hybrid protection to billions of web sessions without requiring end users to do a thing. At the same time, organizations are beginning the meticulous work of discovery, deploying agents that map cryptographic assets and building CBOMs to guide migrations with clarity and precision.
The moment balances invisibility with inevitability. The shift is invisible because, for most people, it just works—your browser automatically negotiates quantum-resistant connections in the background. Yet it is inevitable because the deadlines are set, the standards are finalized, and the stakes for digital trust have never been higher.
Keep your technology up to date. For organizations: the task is complex but urgent—start inventorying cryptography today. Together, these small individual and large institutional steps ensure the digital world remains secure as quantum computers move from research labs toward practical reality.
What You can do Next
For Everyday Readers
- Keep your browser updated: Chrome, Firefox, and other major browsers are adding hybrid PQC support, and updates ensure you benefit from these silent security upgrades.
- Prefer providers that disclose post-quantum readiness: When services advertise that they support PQC or hybrid TLS, it means they are ahead of the curve.
For Organizations
- Launch a discovery project: Install a pilot discovery agent on a representative set of systems. Within 30–60 days, expect a CBOM that highlights crypto dependencies.
- Plan phased upgrades: Start with your most exposed services—like websites, VPNs, and APIs—before moving to less visible systems.
- Track regulatory timelines: Align your roadmap with milestones in CNSA 2.0 and other government guidance so you are not caught unprepared.
FAQs on Post-Quantum Browsing and Migration
Is my Browser Already Using Post-Quantum Security?
In many cases, yes—depending on browser, website, and network path. Cloudflare reports that by March 2025, approximately 38% of human HTTPS traffic on its network used hybrid post-quantum handshakes. Whether your connection uses it depends on your browser, the website, and the network path.
Why Use Hybrid Instead of Full Post-Quantum?
Hybrid key exchange pairs classical and post-quantum algorithms. Hybrid TLS preserves security even if the new algorithm has an undiscovered flaw, serving as a safety net during the transition.
How ML-KEM Differs from Kyber
ML-KEM is the official NIST name for the algorithm formerly known as Kyber. Standardization under FIPS 203 helps ensure consistent implementation across browsers, CDNs, and enterprise software.
What is a CBOM and Why it Matters
A Cryptography Bill of Materials is an inventory that details every cryptographic element inside your systems. It guides safe migration planning by showing where old algorithms remain and what must be updated first.
What Should Organizations do First?
The consensus from NIST and industry leaders is clear: deploy a discovery agent to create a CBOM. That single step gives teams clear visibility into their cryptographic environment, allowing for a smooth transition to post-quantum standards.
