An enterprise technology can support post-quantum confidentiality while its authentication remains classically vulnerable. The Post-Quantum Cryptography Coalition recently released MITRE’s PQC Capability Development Report, dated September 2026 and based on evidence collected in July. The report assesses eight technology categories on separate confidentiality and authentication tracks.
That separation is the report’s most useful operational lesson. MITRE found general-release post-quantum confidentiality integration in browsers, web servers, VPN and network encryption, PKI/CA management, and cloud connectivity. Authentication maturity was generally lower. The report also states important limits: it relies on public vendor and technology claims, records the highest maturity observed in each category, and is not an independent product-security evaluation.
Category maturity is not estate readiness
A category rated “Integration” means MITRE found at least one publicly available general release meeting its definition. It does not mean every product in that category is ready, every installed version enables the feature, or every connection negotiates it.
Organizations need to translate the market snapshot into their own population. A useful record connects:
- the product, edition, version, deployment, and accountable owner;
- the cryptographic role—key establishment, signature, certificate, boot, attestation, or key wrapping;
- supplier-documented capability and the date of that evidence;
- enabled configuration and approved parameter set;
- observed production behavior and covered population;
- validation status and the exact module or boundary it covers;
- interoperability, upgrade, and relying-party dependencies; and
- unknowns, exceptions, target state, and remediation owner.
This prevents a market-level rating from becoming an unsupported asset-level conclusion.
Confidentiality and authentication need separate scorecards
MITRE evaluates confidentiality through mechanisms such as post-quantum key establishment and authentication through quantum-resistant signatures. Several categories show the same pattern: hybrid key establishment is available while post-quantum signatures, certificates, secure boot, or endpoint authentication remain experimental or component-level.
That is not necessarily failure. Harvest-now-decrypt-later risk makes confidentiality an urgent early target. But a migration dashboard should show the intermediate state accurately. A VPN can protect session-key establishment with PQC while relying on traditional endpoint authentication. A browser can negotiate hybrid TLS while validating a traditional certificate chain.
Reporting one combined readiness percentage would hide these differences and could close authentication work prematurely.
Validation must be attached to the deployment boundary
MITRE’s highest maturity level requires a general release backed by a FIPS 140-3 validated module certified for the relevant PQC function. The report found no category at that level, even though validated cryptographic modules with ML-KEM existed by its evidence cutoff.
The distinction matters. A validation certificate for a module does not prove that a particular product release invokes that module for the configured operation, inside the approved boundary, in the deployed environment. Teams should retain the certificate identifier, module version, security policy, covered algorithms, operational environment, product integration evidence, and any applicable constraints.
“Uses validated cryptography” should be a traceable relationship, not a copied supplier phrase.
Public evidence has an expiration date
The report deliberately presents a snapshot. Its evidence was gathered in July, reviewed in August and September, and published afterward. Products, standards, validations, and defaults can change between collection and an enterprise decision.
Vendor evidence should therefore carry an observed date, source, confidence, and refresh trigger. Roadmap statements must remain distinct from released capability. Documentation of support must remain distinct from enabled configuration, and enabled configuration from observed use.
What organizations should do next
First, split PQC reporting into confidentiality and authentication, then break each into the actual cryptographic roles used by the estate.
Second, use MITRE’s categories as a vendor-review starting point, not as proof about installed products. Request version-specific documentation and committed timelines.
Third, map validation claims to exact modules, products, configurations, and environments. Preserve gaps where the integration relationship is not proven.
Fourth, prioritize authentication dependencies that lag confidentiality: certificates, signatures, secure boot, attestation, endpoint identity, and code signing.
Finally, repeat evidence collection. A maturity snapshot becomes stale unless it feeds a living inventory and scheduled reassessment.
How Vista Platform helps
Vista Platform is a self-hosted cryptographic system of record. Its operating loop—discovery, canonical inventory, evaluation, action, and proof—helps organizations connect product claims, deployed configurations, observed cryptography, validation evidence, owners, and remediation.
Vista Platform Core is free of charge and includes discovery, inventory, compliance and PQC assessment, and CBOM generation without asset, sensor, seat, or time caps. Vista tracks and governs post-quantum migration; it does not generate PQC keys or perform every migration. Selected-asset Active Scan is targeted rather than indiscriminate network scanning. Vista is not a vulnerability scanner, and discovery gaps are not proof of absence.
Explore Vista’s post-quantum migration and cryptographic inventory resources.
Where uncertainty remains
MITRE’s report records the highest public maturity it found rather than a statistically representative market sample. It does not independently test product security, distinguish every hybrid and pure configuration, or prove deployment. Its value is directional: it shows uneven capability development and offers a vocabulary that organizations can apply more precisely to their own evidence.
Source
- Post-Quantum Cryptography (PQC) Capability Development Report, MITRE / Post-Quantum Cryptography Coalition, September 2026; released October 15, 2026.