Who's actually shipping PQC?
A filterable, sortable matrix of CDN, cloud, SASE, identity, and messaging vendors. Data-first: every row is sourced and carries a "last verified" date. Corrections welcome via GitHub.
15 of 15 vendors
| Vendor | Category | Product | PQ Key Exchange | PQ Signatures | CISA | Verified |
|---|---|---|---|---|---|---|
| Akamai Opt-in hybrid on enterprise edge. | CDN/Edge | Connected Cloud, Secure Edge | Hybrid PQ TLS on select endpoints | Roadmap 2026–2027 | Transitioning | 2026-02-12 |
| Apple iMessage Level 3 post-quantum security. | Messaging | iMessage PQ3 | PQ3 (ML-KEM based) | Classical (signed by Apple identity) | Widely Available | 2026-02-14 |
| AWS AWS-LC now ships ML-KEM + ML-DSA. | Cloud | KMS, S3, CloudFront, ACM | X25519MLKEM768 (KMS, ALB, CloudFront) | ML-DSA in preview (AWS-LC) | Widely Available | 2026-03-20 |
| Cisco PQ VPN trials underway. | SASE/Firewall | Secure Firewall, Secure Access | Hybrid ML-KEM (select platforms) | Roadmap | Transitioning | 2026-02-05 |
| Cloudflare Free PQ for every site. Dogfooded by this site. | CDN/Edge | CDN, Workers, Zero Trust | X25519MLKEM768 (default) | In progress — targeting 2029 | Widely Available | 2026-04-14 |
| DigiCert Issues test PQ certs in PQC Labs sandbox. | Identity/CA | Trust Lifecycle Manager, PQC Labs | N/A (CA) | ML-DSA and SLH-DSA hybrid certs | Widely Available | 2026-03-01 |
| Entrust Composite certs in production previews. | Identity/CA | PKIaaS, nShield HSM | N/A | Hybrid ML-DSA issuance | Transitioning | 2026-01-28 |
| Fastly Following Chrome/BoringSSL defaults. | CDN/Edge | Compute@Edge, TLS | Hybrid PQ TLS beta | Evaluation | Transitioning | 2026-02-20 |
| Google Cloud PQC enabled by default on Chrome + GCP LB. | Cloud | BoringSSL, Cloud Load Balancing, Android 17 | X25519MLKEM768 | Planning | Widely Available | 2026-02-14 |
| Let's Encrypt PQC roadmap coordinated with CA/B Forum. | Identity/CA | Public CA | N/A | Planning | Transitioning | 2026-01-10 |
| Microsoft Azure SymCrypt PQC ships cross-product in 2026. | Cloud | SymCrypt, Azure Front Door | Hybrid ML-KEM in SymCrypt | ML-DSA in preview | Transitioning | 2026-03-01 |
| Open Quantum Safe Powers this site's deep scanner. | Open Source | liboqs, oqs-provider, OQS-OpenSSL | All NIST PQC KEMs | All NIST PQC signatures | Reference | 2026-04-14 |
| Palo Alto Networks Active Drift Detection for regression monitoring. | SASE/Firewall | NGFW, Prisma Access | Cipher Translation Proxy (hybrid in, classical out) | Roadmap | Widely Available | 2026-03-10 |
| Signal PQXDH for initial key agreement; Level 2. | Messaging | PQXDH | X25519 + CRYSTALS-Kyber (PQXDH) | Classical EdDSA (for now) | Transitioning | 2026-01-18 |
| Zscaler PPK deployment guidance live. | SASE/Firewall | ZIA, ZPA, IPsec | PQC IPsec PPK + inline PQ inspection | Roadmap | Widely Available | 2026-02-28 |
CISA "Widely Available" vs. "Transitioning" buckets follow the Jan 2026 procurement advisory. Status rows are updated from public release notes and vendor documentation — if a vendor has shipped PQC but isn't listed, open a PR.