The PQC Capability Development Report was developed with MITRE’s internal PQC research team to provide a snapshot of PQC solution development maturity across a selected set of critical enterprise technologies relying on cryptographic capabilities based on publicly available evidence. The aim is to provide situational awareness of technological maturity to inform migration planning, technology refresh cycles, and long-term investment decisions by identifying the PQC development status of capabilities.

PQC Capability Development Overview

Each capability is evaluated across at least one of two independent security guarantee types: confidentiality development and authentication development. Confidentiality and authentication are evaluated independently because (1) not all capabilities rely on both types of security guarantees, and (2) capabilities may show more progress toward one type of security than the other.

Confidentiality development measures how far a capability has progressed in adopting PQC mechanisms that protect the confidentiality of data, such as quantum-resistant key establishment for encrypted communications.

Authentication development measures progress in adopting PQC mechanisms that allow a party to verify the identity of an entity or the origin and integrity of information through quantum-resistant digital signatures.

This assessment considers only positive progress toward incorporating PQC and therefore excludes technologies that do not rely on asymmetric cryptography at all, as they are not expected to require PQC-related changes. The resulting capability status provides a practical view of where PQC integration is occurring today and where future developments are likely to influence organizational migration planning.