Post-quantum TLS in Europe, October 2026: who already accepts hybrid ML-KEM?

Published 13 October 2026 · Measured 13 October 2026 · 380 websites · Version française

Hybrid ML-KEM key exchange (X25519MLKEM768) protects today’s TLS traffic against “harvest now, decrypt later”. We checked whether the main public websites of 380 of Europe’s largest companies, banks, insurers, grid operators and public bodies accept it. The answer is mostly yes, and mostly not by their own doing.

Key findings

• 64%of 379 reachable websites accept hybrid ML-KEM
• 98% vs 19%behind a major CDN vs other or self-hosted infrastructure
• 48%of national government portals: the lowest segment
• 0post-quantum certificates; 77% still use RSA

Results by segment

Share of reachable websites in each segment that accept hybrid ML-KEM. The stock-index companies lead; governments trail.

The CDN effect

Adoption follows hosting, not sector. Websites served by Cloudflare, Fastly and Imperva accepted hybrid ML-KEM in every case we saw, and Akamai in almost every case: these providers enabled it by default at their edge. Websites on other or self-hosted infrastructure accepted it only 19% of the time.

That is good news for the visitor’s connection, but it is not a migration. Hybrid key exchange at a CDN protects the leg between the visitor’s browser and the CDN. The leg from the CDN to the organisation’s own servers is invisible from outside and may still be classical, and none of this reaches the systems where long-lived data actually lives.

By country

Headquarters country of each organisation (EU bodies grouped as “EU”). Countries with fewer than 5 websites are grouped as “Other countries”. Differences mostly reflect hosting choices of the organisations in each sample, not national policy.

Certificates and legacy protocols

Every certificate we saw is classical: 293 RSA and 86 ECDSA. That is expected: publicly trusted post-quantum certificates (ML-DSA) are not available yet, which is why authentication is the second, later half of the migration. 92% of websites negotiated TLS 1.3 by default, and 11 (3%) still accepted TLS 1.0 or 1.1, protocols deprecated since 2021 (RFC 8996).

What this means for a security team

• Your website is the easy part. If it sits behind a major CDN, it probably already offers hybrid ML-KEM. That says little about online banking back ends, APIs, partner links, internal TLS, VPNs or the code that encrypts stored data.
• Start from an inventory. The EU roadmap asks for first steps by the end of 2026. Knowing where classical key exchange still protects long-lived data is the prerequisite, and it cannot be measured from the outside.
• Check the origin leg. If your CDN terminates TLS with hybrid ML-KEM, ask how it connects to your servers, and whether those servers can do the same.
• Plan authentication separately. Certificates will move to ML-DSA later; crypto-agility in PKI and code is what makes that second step cheap.

What we measured

The sample. 401 entries from public lists, 380 distinct websites (a company in two indices is counted once overall): CAC 40 (40), DAX 40 (40), IBEX 35 (35), AEX (30), Banks (ECB-supervised) (107), Insurers (EIOPA stress test) (40), Grid operators (ENTSO-E) (40), National governments (27), EU institutions & agencies (42). Each organisation’s domain was taken from an independent source (Wikidata, the index provider, the regulator’s register, the EU’s own pages), not guessed. The full list with both sources per row is published below.

The check. On 13 October 2026, each website received the same check as our free TLS quantum checker: up to three TLS handshakes to port 443 (a normal modern offer, a hybrid-only offer, and a TLS 1.0/1.1-only offer). No web page was requested. A website “accepts hybrid ML-KEM” when the server completed a TLS 1.3 handshake using X25519MLKEM768 or SecP256r1MLKEM768. The client ran Node.js 26.7.0 with OpenSSL 3.5.7.

The hosting network. The IPv4 address the website resolved to was mapped to its network (ASN) with Team Cymru’s public IP-to-ASN service, then grouped by provider.

Aggregates only. We publish no result for any named organisation: these are prospective customers, and the point is the pattern, not a ranking. Any breakdown group with fewer than 5 websites is merged into “other”.

Limits

• One snapshot, one date, from one network location (France). CDN configurations change often.
• Main public website only, one hostname per organisation. Other services of the same organisation may differ.
• A handshake shows what the server accepts, not what every browser negotiates, and nothing about the connection behind the server.
• Domains come from public sources; where a group has several sites, we used the one the source designates (choices are visible in the published list).
• The provider grouping relies on the network that announces the IP address; a website can use a CDN that is not visible this way.

Reproduce it

Everything needed to repeat the study is public: the sample with sources (CSV), the published aggregates (JSON), and the scripts in our repository (tools/measure_ml_kem.js, tools/aggregate_ml_kem.py). Run them with Node.js 24 or later:

node tools/measure_ml_kem.js research/eu-ml-kem-2026/domains.csv results.json
python3 tools/aggregate_ml_kem.py results.json aggregates.json

Reference lists: CAC 40 live.euronext.com · DAX 40 en.wikipedia.org · IBEX 35 www.bolsasymercados.es · AEX live.euronext.com · Banks (ECB-supervised) www.bankingsupervision.europa.eu · Insurers (EIOPA stress test) www.eiopa.europa.eu · Grid operators (ENTSO-E) www.entsoe.eu · National governments european-union.europa.eu · EU institutions & agencies european-union.europa.eu.