Fintech Regulatory Brief
Cloudflare Just Proved “PQC Capable” and “PQC Protected” Are Different Things
September 10, 2026 · PQCClear · 5 minute read
A few days ago, we wrote about why a system being capable of post-quantum encryption isn’t the same as that encryption actually protecting a given connection. Cloudflare has now published proof of exactly that gap, at a scale few companies could ever generate.
Cloudflare announced Automatic Key Exchange, a system that actively scans the origin servers behind its network to learn which encryption methods each one really supports, instead of guessing. Previously, Cloudflare’s default guess for every origin was the same classical algorithm, correct most of the time, but wrong often enough that it cost an extra round trip on a large share of connections. Now Cloudflare measures each origin directly and leads with the strongest method it actually supports, preferring the post-quantum option wherever it is available.
The Numbers Are the Interesting Part
12.8%
Origins supporting post-quantum key exchange, up from 0.5% in 2023
3.7%
Share of connections needing a costly retry, down from 52%
99.2%
Post-quantum handshakes completing on the first try
The performance win is real, over 150 milliseconds shaved off connection setup across the 45 billion post-quantum-protected connections Cloudflare now handles daily. But one detail buried in the announcement matters more than the speed improvement.
The Finding That Matters
Cloudflare found that simply watching normal traffic couldn’t tell them everything a server actually supported. Some origins would quietly accept an older, classical connection without ever objecting or asking for something stronger, so their real post-quantum capability never showed up in ordinary traffic at all. Only by actively testing each server directly did Cloudflare discover thousands of origins that were fully capable of post-quantum encryption but had never actually used it, simply because nothing had ever asked.
A server can be fully capable of post-quantum encryption and never once have used it, because nobody actually asked.
That is the gap the industry doesn’t talk about enough. A vendor’s software stack supporting a standard is one fact. That standard actually getting used, on real connections, in production, is a separate fact, and the first one tells you almost nothing about the second unless someone goes and checks directly.
Why This Is Exactly What Our Own Methodology Is Built to Catch
This is precisely the distinction PQCClear’s assessment methodology is designed around, and it is not a new addition in reaction to this news. One of our questionnaire’s core questions, internally we refer to it as Q13, exists specifically to separate “does this system support strong encryption” from “can a weaker connection still slip through in practice.” A vendor whose weak protocol is present in code but genuinely unreachable is scored differently than one where it is present and exploitable, and a vendor who cannot answer the question at all is scored as though the weak path is live, not given the benefit of the doubt.
Cloudflare just demonstrated why that distinction earns its place in an assessment methodology instead of being a nice-to-have detail. At 45 billion connections a day, “capable” and “actually protected” were different facts for thousands of servers, and the only way to find out which was true was to check directly rather than assume.
Assess what’s actually happening, not just what’s possible
PQCClear helps banks, credit unions, and payment processors see past a vendor’s stated capabilities to what is actually configured and negotiated in practice, producing a Quantum Readiness Score, a full CBOM, and an examination-ready report for each vendor in the portfolio.
Request accessThis post represents the editorial analysis of PQCClear as of September 10, 2026. It should not be construed as technical or legal advice.
Key source: Suleman Ahmad, Yawar Jamal, and Alex Krivit, “Automatic Key Exchange: faster, post-quantum secure origin handshakes for 45 billion daily connections (and counting),” Cloudflare Blog (September 8, 2026).