Every month we measure how many Swiss organisations already negotiate a post-quantum key exchange (ML-KEM) on their public website. This is not a survey: it is a TLS handshake, observed from the outside.
- 39.5% of the 276 Swiss organisations we measure negotiate ML-KEM on their public site. Across the whole index (6,503 organisations in 50 countries) the figure is 38.4%.
- 11th of 32 countries with at least 40 organisations measured.
- 46% of the 80 Swiss banks we measure negotiate ML-KEM, the highest of the six banking centres with at least 20 banks in the index.
- 63/100 is the average Quantum Risk Score of the Swiss panel, in the "vulnerable" tier (50 to 69). The index average is 59.
Banks carry the country
Banking (80 organisations) and manufacturing (54) are the two Swiss sectors large enough to compare, and both sit above the index average. The other fourteen sectors count ten to twelve organisations each in our Swiss panel. Read them as indicative: with ten sites, one site changes the figure by ten points.
On banking, Switzerland is ahead
Across all 807 banks in the index, 29% negotiate ML-KEM. Swiss banks reach 46%, ahead of the Netherlands (43%), the United Kingdom (39%), the United States (29%), Japan (23%) and Germany (19%).
Inside Switzerland the split is narrow: 10 of 24 cantonal banks (42%) and 27 of 56 other banks (48%: private, regional, retail and online banks). We do not publish any single bank's result, only groups of at least 20 organisations.
Often, the CDN decides
Of the 109 Swiss organisations that negotiate ML-KEM, 46 do so because the service that terminates their TLS turns it on by default: Cloudflare, Amazon CloudFront, Imperva or Azure Front Door. None of them ran a post-quantum project for it. When the organisation runs its own front end, the share drops to 32%. Behind other CDNs and hosting platforms it is 0 of 36: the setting sometimes exists, but it is not on by default.
Three questions for your next board meeting
- Who terminates our TLS? If it is a CDN, post-quantum on the public site may already be there, or one setting away. If it is our own appliance, it is a project.
- The front door is not the core. ML-KEM on the public website says nothing about internal APIs, VPNs, certificates or application keys. That is where most of the migration work sits.
- Do we have an inventory? Without a list of the algorithms and certificates in use (a CBOM), there is no migration plan and no answer for the regulator.
The barometer only sees the public website. To measure the rest of your estate (certificates, keys and algorithms in use) and get a migration plan, see the Quantum Risk Score.
How we measure
- Measurement. A live TLS and DNS handshake against each organisation's public website, with no self-assessment and no privileged access. "Negotiates ML-KEM" means the server accepts an X25519MLKEM768 key exchange.
- Score. The Quantum Risk Score (0 to 100) combines four signals: algorithm resilience, cryptographic agility, exposure to passive collection and migration posture. Tiers: 70 and above, hybrid migration; 50 to 69, vulnerable; below 50, critical.
- Not measured. Internal systems, supplier portals and remote access. The score is not a security audit, a penetration test or a regulatory attestation.
- Panel. 276 Swiss organisations across the 16 NIS2 sectors, within an index of 6,503 organisations in 50 countries. The panel has grown since September, so we do not report month-on-month changes until it is stable.
- Privacy. No organisation is named and no single score is published. Comparisons use groups of at least 20 organisations; smaller sectors are marked indicative. Front-end providers are labels derived from DNS and response headers, not a measurement.
- Data. DuoKey index, measurements from 3 September to 4 November 2026 (median age 23 days).
