PQC Endpoint Risk

Why endpoints are missing from most PQC programmes

Post-quantum programmes scope servers, data centres, cloud workloads and network infrastructure, and stop there. Endpoints are where cryptography is actually used: keys are generated and stored, sessions originate, credentials are cached and trust decisions are made. Excluding them leaves the largest population of cryptographic assets in the estate unmeasured.

Why endpoints are missing from post-quantum cyber security programmes

The omission is practical rather than deliberate, and three reasons account for most of it.

Scale creates hesitation. An organisation with forty thousand laptops faces a discovery exercise across forty thousand cryptographic environments, and security teams reasonably worry about performance impact, user disruption and the volume of findings that visibility will produce.

Ownership is split. Servers and certificate authorities sit with security architecture and infrastructure teams. Endpoints sit with IT operations and end-user computing, who are rarely in the room when a post-quantum programme is scoped and who are not measured on cryptographic posture.

There is also an assumption that endpoints are handled elsewhere, on the basis that operating system and browser vendors will deliver post-quantum support through normal patching. That is partly true and materially incomplete, as set out below.

The result is that programmes produce a cryptographic inventory covering the systems that are easiest to enumerate rather than the systems where most cryptographic assets actually reside.

What cryptography actually lives on an endpoint

A managed laptop typically holds more distinct cryptographic assets than the servers it connects to.

The last two rows account for a disproportionate share of the difficulty. Application-embedded certificate stores are invisible to central certificate management, and smartcard capacity may prevent a post-quantum credential fitting at all, which turns a software migration into a token replacement programme.

What post-quantum cyber security already looks like on an endpoint

Endpoints are further ahead than most organisations realise, and unevenly so, which is its own problem.

Hybrid post-quantum key exchange is now enabled by default in mainstream browsers, so a substantial proportion of user web traffic already uses ML-KEM alongside a classical algorithm. Cloudflare reported in 2026 that over 65 per cent of human traffic reaching its network was post-quantum encrypted, which is largely a consequence of browser defaults rather than deliberate enterprise action.

That protection is narrow. It covers browser-originated TLS key exchange and nothing else. Authentication remains classical, because certificates are still signed with RSA and ECDSA. VPN clients, email signing, 802.1X, line-of-business applications and locally stored keys are unaffected. An organisation can therefore be substantially protected against harvest now, decrypt later on web browsing while entirely unprotected on the interfaces that carry its most sensitive traffic.

Hardware is beginning to move. Intel has stated it is the first silicon vendor to deliver CNSA 2.0 post-quantum capability as hardware-rooted cryptography for client PCs, which matters because current TPM implementations do not support post-quantum algorithms. Until that capability is widespread, hardware-backed key protection on endpoints remains classical regardless of what the operating system supports.

Why endpoints matter for harvest now, decrypt later

Sessions originate at the endpoint. When a clinician opens a patient record, a caseworker retrieves benefit data or an engineer accesses design material, the session key that protects that traffic is negotiated on the device.

If that negotiation is classical, the traffic is exposed to collection regardless of how well the server side has been migrated. The exposure follows the weakest end of the connection, and for most sensitive access that end is a laptop rather than a data centre.

This inverts a common assumption. Server-side migration is highly visible and is usually where programmes start, but it does not by itself close the confidentiality exposure for user access. Both ends have to move.

The immediate security benefit of endpoint discovery

Endpoint cryptographic discovery is unusual among post-quantum activities in that it reduces current risk as well as future risk.

Industry analysis mapping cryptographic weakness to the MITRE ATT&CK framework shows that poor endpoint cryptographic practice enables or amplifies credential dumping, private key theft, interception of weak TLS sessions, abuse of code signing, persistence through tampered boot components and lateral movement through compromised authentication. Endpoints sit at the intersection of most of these techniques.

In practice, an endpoint discovery exercise typically surfaces expired certificates still trusted, self-signed certificates installed for expedience and never removed, legacy TLS versions and cipher suites still enabled, unmanaged SSH keys on developer machines, and private keys stored in file systems rather than hardware. None of that is a quantum problem. All of it is exploitable today.

This is the strongest argument for including endpoints in scope. The work produces a return before any post-quantum decision is made, which changes the funding conversation.

Building endpoint discovery into post-quantum cyber security work

Scale is manageable if discovery uses tooling that is already deployed rather than introducing new agents.

Most organisations already run endpoint detection and response, unified endpoint management and asset management platforms across the fleet, and those platforms can enumerate certificates, trust stores, keys and enabled protocol versions. Integrating cryptographic discovery with existing endpoint tooling avoids a new deployment programme, avoids user disruption and produces results in weeks rather than quarters.

Sequencing that works in practice runs as follows. Start with a representative sample rather than the whole fleet, sufficient to characterise the build. Analyse for cryptographic hygiene findings first, since those are actionable immediately and demonstrate value. Extend to full fleet enumeration once the finding categories are understood and the remediation path for each is agreed. Feed the results into the same cryptographic bill of materials used for the rest of the estate, rather than maintaining a separate endpoint record.

Procurement is the second lever, and it is more effective on endpoints than anywhere else. Client hardware refreshes on a three to five year cycle, which means specifications set now reach the whole fleet before 2035. Post-quantum capable platform roots of trust, TPM support for approved algorithms, and credential storage sized for post-quantum certificates are all reasonable requirements to place in the next refresh specification, and they cost nothing if specified early.

Common mistakes

The first is assuming vendor patching covers it. Operating system and browser updates address the components those vendors control. They do not reissue your internal certificates, resize your smartcards or remove the self-signed certificate an engineer installed in 2019.

The second is scanning without a remediation route. Endpoint discovery produces a large volume of findings, and a programme that surfaces them without an agreed disposition for each category loses credibility quickly.

The third is treating browser post-quantum defaults as endpoint readiness. Browser key exchange is one interface among many, and it does not address authentication at all.

The fourth is excluding unmanaged and developer endpoints. Those hold the SSH keys and cloud credentials with the widest access and the least oversight, which makes them the highest-value targets on the fleet.

How Unsung helps

Unsung is a UK-based, vendor-neutral consultancy specialising exclusively in public key infrastructure and cryptographic systems, working across central government, defence, healthcare, financial services, nuclear and transport.

We extend cryptographic discovery to endpoints as part of our PKI health check and cryptographic bill of materials services, using tooling already deployed in the estate where possible. We then address the issuance side, designing the certificate lifecycle management capability needed to reissue device, user and email certificates at fleet scale, which is the point at which endpoint migration becomes a routine operation rather than a project.

For the organisational factors behind exposure, see the seven drivers of post-quantum risk exposure.