India quantum-readiness snapshot

We asked which public sites already negotiate hybrid post-quantum key exchange (X25519MLKEM768). We probed 132 Indian public sites across NCIIPC's seven critical sectors, plus 25 global reference sites as a control, on 2026-09-18 08:05 UTC using our own protocol scanner.

■ Indian sector   ■ global reference

0%25%50%75%100%Global reference: 56.0% of 25 reachable sites negotiate hybrid post-quantum key exchangeGlobal reference56.0%n=25Banking, financial services & insurance: 34.4% of 32 reachable sites negotiate hybrid post-quantum key exchangeBanking, financial services & insurance34.4%n=32Power & energy: 18.8% of 16 reachable sites negotiate hybrid post-quantum key exchangePower & energy18.8%n=16Government (central): 17.8% of 45 reachable sites negotiate hybrid post-quantum key exchangeGovernment (central)17.8%n=45Transport: 16.7% of 12 reachable sites negotiate hybrid post-quantum key exchangeTransport16.7%n=12Health: 11.1% of 9 reachable sites negotiate hybrid post-quantum key exchangeHealth11.1%n=9Telecom: 0.0% of 8 reachable sites negotiate hybrid post-quantum key exchangeTelecom0.0%n=8Strategic & public enterprises: 0.0% of 10 reachable sites negotiate hybrid post-quantum key exchangeStrategic & public enterprises0.0%n=10India, all 7 sectors: 18.9% of 132 reachable sites negotiate hybrid post-quantum key exchangeIndia, all 7 sectors18.9%n=132
18.9%
of the Indian sites we probed use post-quantum key exchange (our global reference: 56.0%)
86%
of the Indian sites we probed present an RSA certificate
0%
post-quantum certificates in anything we probed: no public CA issues them yet
22 / 25
Indian sites that pass sit behind a CDN that enabled it for them
Table view
sectorreachable / probedhybrid PQ key exchange TLS 1.3RSA leaf certECDSA leaf cert
Government (central)45/4817.8%80.0%88.9%11.1%
Banking, financial services & insurance32/3434.4%93.8%84.4%15.6%
Telecom8/90.0%87.5%100.0%0.0%
Power & energy16/1618.8%75.0%87.5%12.5%
Transport12/1216.7%66.7%58.3%41.7%
Health9/1111.1%66.7%88.9%11.1%
Strategic & public enterprises10/120.0%80.0%100.0%0.0%
Global reference25/2556.0%100.0%64.0%36.0%

Method

We make two connections per site, exactly what a browser does on a visit: one TLS 1.3 ClientHello offering X25519MLKEM768 first (which key-exchange group does the server pick?) and one normal handshake (version, cipher suite, leaf certificate). We do not crawl, probe for vulnerabilities or authenticate. We publish sector totals only and keep the list of sites to ourselves. A result reflects a site's public edge (often a CDN), not necessarily its internal systems. This is our snapshot, not a ranking.