The threat here is called harvest now, decrypt later. An adversary records encrypted traffic today and keeps it until a quantum computer can break the key exchange that protected it. Nothing about that requires the machine to exist yet, which is why traffic with a long confidentiality lifetime is exposed right now.
Hybrid key exchange fixes it today: combine a conventional key agreement with a post-quantum one, so the session is safe unless both fall.
SSLBoard reports whether your tested endpoints negotiate a recognized post-quantum key exchange, and shows the observed group where it can.
Reading readiness
A ready result means the capability was observed. A not-ready result identifies an endpoint that explicitly rejected the offered PQC groups. A timed-out or failed probe establishes neither, so SSLBoard reports it as unknown and excludes it from the readiness percentage. Read the known- and unknown-endpoint counts together.
The summary bands:
| Band | Share of known endpoints ready |
|---|---|
| High | 75% and above |
| Medium | 40% up to 75% |
| Low | Below 40% |
With no known endpoints the model falls back to Medium and shows no percentage. That is an absence of evidence, not a measured middle level of protection. Do not read it as half-safe.
The groups you may see
Hybrid: X25519+MLKEM768, P-256+MLKEM768, P-384+MLKEM1024, and the older X25519+Kyber768-draft00 name. Pure: MLKEM512, MLKEM768, MLKEM1024.
Keep the actual group name when you discuss deployment, because the differences matter for client compatibility. NIST defines ML-KEM in FIPS 203.
What a ready result does not cover
Support on your public TLS endpoint means the endpoint can negotiate it. Whether a given client does is up to that client.
It also says nothing about:
- The connection from your CDN to your origin.
- Internal service-to-service traffic.
- Backups and data at rest.
- Protocols other than the one measured.
- Your certificate’s signature algorithm. Certificate authentication and session key establishment are distinct, which is why an RSA or elliptic-curve certificate sits happily alongside a hybrid key exchange. See key analysis.
And a scoring note worth keeping in proportion: this is one component of Future Readiness, weighted at 5% of the total. A Low band is not a reason to postpone an expired certificate.
Plan and verify
Identify the TLS terminator and find out which hybrid groups its current software or managed provider supports. Most modern servers and major CDNs now do. Test compatibility in your own deployment before enabling it broadly, since larger handshakes occasionally upset old middleboxes.
After rollout, retest every affected endpoint and check both the readiness result and the reported group. If the origin leg is also in scope for your migration, assess that path separately.