PQC Surface Index
Post-quantum HTTPS, measured hostname by hostname. Qtonic Quantum Corp ranks first of 51 in the 6 October 2026 snapshot.† In that snapshot, 8 of its 8 measured HTTPS hostnames met the published four-handshake harvest-proof rule: they accepted the tested post-quantum exchange and refused the tested classical exchanges (what changed since). Of 2,868 measured hostnames at the 50 selected comparison companies, none met that rule. qryptonic.com and qryptonic.org stay outside this score because they still accept classical handshakes. So do the publishing hosts, as measured on 7 October 2026 and again on 27 October 2026: pqc-surface.org is served by Cloudflare Pages over hybrid TLS that accepts classical handshakes, and pqc-index.org, which offered no post-quantum key exchange on 7 October 2026, offered the hybrid post-quantum exchange on 27 October 2026 and still accepts classical handshakes; neither meets this rule and neither is in the scored cohort (four-handshake transcripts: 7 October 2026, 27 October 2026). This is a dated HTTPS measurement, not a ranking of product code or engineering quality.
Reproduce the result: inspect company totals, every measured hostname and UTC observation, the raw handshake run and the 26 September 2026 hashes, the 6 October 2026 hashes and the second 6 October raw run. Counted by IP address instead, Qtonic Quantum Corp was 1 of 1 on 6 October 2026. A corrected handshake, cohort or ranking rule could change this dated order; submit counterevidence.
- Post-quantum exchange accepted
- TLS 1.3 X25519 refused
- TLS 1.3 P-256 refused
- TLS 1.2 refused
Against the biggest
Qtonic Quantum Corp against the ten largest IT-security companies by market value.
Against the best
Qtonic Quantum Corp against the five companies with the highest post-quantum coverage on the common industry measure. Four offer the hybrid group on all of their measured HTTPS hostnames and Cloudflare on 99.2%; every one of those measured HTTPS hostnames still accepts a classical session.
All 51 companies †
Qtonic Quantum Corp 8 of 8. Selected peers 0 of 2,868.
The published order ranks clean measured HTTPS hostname share, then hybrid-offer share, then name. Change the lens, not the edition: the hybrid and resolved-IP views use the same dated records with different units. The published rank number remains its original position when you sort. Select any company to inspect its measured hostname records. Open one company in the hostname explorer.
Three lenses, one frozen snapshot. Published rule = clean/measured HTTPS hostnames; common hybrid = hostnames offering X25519MLKEM768/measured HTTPS hostnames; by resolved IP = addresses where every measured name on that address is clean/all measured addresses within that company. An address shared across companies is not pooled globally. On this 6 October 2026 snapshot, Qtonic Quantum Corp is 1 of 1 by the resolved-IP rule and the other 50 companies are 0. qryptonic.com and qryptonic.org use that same address and stay outside this own-domain score. Company counts · Hostname and IP records · Proof hashes. This snapshot says nothing about sold products or customer systems.
Publisher disclosure. Qtonic Quantum Corp publishes this page, designed the harvest-proof measure and ranks first on it. The hybrid column uses the common industry measure, where several companies tie Qtonic Quantum Corp at 100%. Read comparison limits.
Interactive filters and Inspect are unavailable until this page is ready. All 51 ranking rows and the published raw data links remain readable.
Published 6 October 2026 order: clean measured HTTPS hostname share, then common hybrid share, then name. Alternative columns are visible without scripts; the rank numbers always denote this published order.
HTTPS hostname explorer
Each row shows the hostname, resolved address, observation time and four recorded handshake outcomes. Match the hostname and UTC time in the published 6 October 2026 raw run; the snapshot was measured from an AWS us-west-2 worker.
| HTTPS hostname | Kind | Address | Observed (UTC) | Hybrid only | X25519 only | P-256 only | TLS 1.2 | Result |
|---|---|---|---|---|---|---|---|---|
| Loading HTTPS hostname records… | ||||||||
Two ways to read the table
Hybrid column: can a modern client get post-quantum protection?
This is the common industry measure. Cloudflare, Akamai and Fastly, and companies whose HTTPS hostnames use those networks, score high on this column. Several of the largest companies offer the hybrid group on a minority of their measured HTTPS hostnames: F5 18.4%, Fortinet 25.0%, Palo Alto Networks 30.3%.
Harvest-proof column: can anyone still get a classical session?
A recorded classical handshake can be decrypted once a large quantum computer exists. In this index, a server closes that path only if it refuses all three classical handshakes tested: TLS 1.3 with X25519, TLS 1.3 with P-256, and TLS 1.2. On 6 October 2026, none of the 2,868 measured HTTPS hostnames at the 50 companies did, and Qtonic Quantum Corp refused all three on 8 of its 8 measured HTTPS hostnames (what changed since).
What changed since 26 September 2026. At 23:36 UTC that day, Qtonic Quantum Corp opened qtonicquantum.com and www.qtonicquantum.com to classical clients (deploy transcript). The ranking on this page does not use that measurement. On 6 October 2026, from 01:25–01:32 UTC, the same published probe measured 8 of 8 own-domain HTTPS hostnames as harvest-proof, including qtonicquantum.com, www, lab.qtonicquantum.com and demo.qtonicquantum.com. qryptonic.com and qryptonic.org still accept classical handshakes. They are separate registered domains, they are outside this own-domain score, and on 6 October 2026 they used the same address as the eight scored names.
What changed since 6 October 2026. The daily measurement cycle runs the same published probe from one vantage and does not change the ranking. It found 3 Qtonic Quantum Corp HTTPS hostnames completing classical handshakes: demo.qtonicquantum.com from the 10 October 2026 cycle and qtonicquantum.com and www.qtonicquantum.com from the 24 October 2026 cycle. In the 25 October 2026 cycle, 5 of 8 own-domain HTTPS hostnames were harvest-proof and the selected peers stayed at 0 harvest-proof hostnames. The ranking above is the 6 October 2026 snapshot and is not re-ranked by this note (cycle record). The change to demo.qtonicquantum.com from the 10 October 2026 cycle was first disclosed here on 25 October 2026, 10 business days later; the regression check that enforces the alert service level allows one, so that disclosure was late.
Peer hostnames the cycle could no longer measure. In the 31 October 2026 cycle the probe could not measure 31 peer HTTPS hostnames that the 6 October 2026 run measured: 9 had no DNS answer, 2 refused the connection, 12 timed out and 8 failed every handshake. 20 more could not be measured in at least one cycle and were measured again later. Of the hostnames the 30 October 2026 record listed as not measured, api.zscaler.com, esxi.zscaler.com, facsso1-test.fortinet.com, helpdesk.zscaler.com, hrms.zscaler.com, jenkins-prod.zscaler.com, mail3.zscaler.com, owa.zscaler.com, sapdb.zscaler.com and vpn2.zscaler.com were measured again in the 31 October 2026 cycle. None of them was harvest-proof on 6 October 2026, so no harvest-proof count in that edition includes them, and this note does not re-rank. The cycle runs from one vantage, so the cause may be our vantage rather than the hostname (record, with every cycle run it was computed from; the 30 October 2026, 29 October 2026, 28 October 2026, 27 October 2026 and 26 October 2026 records stay on file). 29 of these 51 hostnames were first disclosed here on 26 October 2026; for 24 of them that was more than one business day after the cycle that first found them (the earliest in the 9 October 2026 cycle, 11 business days), and the regression check that enforces the alert service level allows one, so those disclosures were late. 3 more, first found unmeasured in the 27 October 2026 cycle, were first disclosed here on 28 October 2026, inside the one business day the regression check that enforces the service level allows. 1 more, first found unmeasured in the 28 October 2026 cycle, was first disclosed here on 28 October 2026, inside the one business day the regression check that enforces the service level allows. 1 more, first found unmeasured in the 29 October 2026 cycle, was first disclosed here on 29 October 2026, inside the one business day the regression check that enforces the service level allows. 12 more, first found unmeasured in the 30 October 2026 cycle, were first disclosed here on 30 October 2026, inside the one business day the regression check that enforces the service level allows. The other 5 hostnames, aspsprod.leidos.com, bbb-conf-ext.secunet.com, fmlo365.fortinet.com, k3ls.secunet.com and task-stage.secunet.com, first found unmeasured in the 31 October 2026 cycle, are first disclosed by this edition, inside the one business day the regression check that enforces the service level allows. The hostnames shop.secunet.com and task.secunet.com, which the 30 October 2026 record listed as measured again, could not be measured in the 31 October 2026 cycle and are disclosed again by this edition, inside the one business day the regression check that enforces the service level allows.
Refusing classical has a cost: clients without the hybrid group cannot connect. curl built on OpenSSL 3.0.13 (the Ubuntu 24.04 default) fails against api.qtonicquantum.com (transcript). Qtonic Quantum Corp's harvest-proof HTTPS hostnames accept only X25519MLKEM768, so a client that offers only another post-quantum group, such as pure ML-KEM-1024, cannot connect either. Companies that serve the general public accept classical sessions so older clients keep working. On 6 October 2026 the eight measured Qtonic Quantum Corp HTTPS hostnames refused those classical sessions. A 0% harvest-proof score can reflect a choice to keep classical clients working; this index measures handshakes, not the reasons behind them.
How each HTTPS hostname was tested
Four handshakes per HTTPS hostname
TLS 1.3 · X25519MLKEM768 only
TLS 1.3 · X25519 only
TLS 1.3 · P-256 only
TLS 1.2 · default suites
Every measured hostname is tested on HTTPS (port 443). A handshake counts as completed even if the certificate name does not match.
Which HTTPS hostnames
Each company's apex and www, the names from the first 2,400 labels of the SecLists subdomains-top1million-5000 list that resolve, and names from certificate-transparency logs, all on the company's own registered domain. The same method applies to every company, including Qtonic Quantum Corp.
An HTTPS hostname that completes none of the four handshakes is left out of every percentage and shown as unmeasured in the explorer. Mail servers are not included: the measurement host cannot reach port 25, so this edition covers HTTPS only. A name such as mx.qtonicquantum.com is counted for its HTTPS service on port 443.
The four handshakes are a practical test, not every classical option. Two WISeKey VPN HTTPS hostnames refuse X25519 and P-256 but accept P-384 and X448; they count as not harvest-proof because they also accept TLS 1.2. The 26 September 2026 edition also tested that day's harvest-proof names against 19 more classical variants and 5 other post-quantum groups. This page's rank uses the four published handshakes only.
This measurement, and the 26 September edition
The ranking table on this page is one full run on 6 October 2026, 01:25–01:32 UTC (checksum, FreeTSA), from an AWS us-west-2 worker, using the published Go probe. The same binary was run again from 54.148.31.245 at 15:33–15:41 UTC. Qtonic Quantum Corp stayed first: 8 of 8 hostnames and 1 of 1 addresses. Selected peers were 0 of 2,872 in that window and 0 of 2,868 in the first. 20 companies changed rank. The ranking table remains the first window. The six rows beneath it are the 26 September 2026 edition: an original measurement and re-tests at 15:52–15:59 UTC, 17:28–17:35 UTC and, after that day's policy change, 23:44–23:52 UTC. Those runs were made from AWS us-west-2. HTTPS hostnames served by content networks may answer differently in other regions.
What matched
2,858 of 2,883 HTTPS hostnames measured in both the original and the published 26 September 2026 measurement (23:44–23:52 UTC) got the same result (99.1%). Both headline results held: no measured HTTPS hostname meeting the rule among the 50 companies, and Qtonic Quantum Corp as the only one of the 51 companies with measured hostnames meeting the rule.
What differed, and why
20 of the 25 differences sit on one content-network address range (150.171.110.x); 3 are Qtonic Quantum Corp's own measured HTTPS hostnames: qtonicquantum.com and www.qtonicquantum.com, which reflect its policy change on 26 September 2026, 23:36 UTC (above), and demo.qtonicquantum.com, which is served from a content network and accepted classical sessions in every re-measurement. Re-tested three times, some of those HTTPS hostnames switched between hybrid and classical between attempts. The replication also added qstrike.qtonicquantum.com, a name in Qtonic Quantum Corp's certificate logs that the first run missed. It was harvest-proof in that run. It also removed qryptonic.org, a separate Qtonic Quantum Corp domain that the first run had counted under qtonicquantum.com. No other company had a second domain counted, so it was taken out.
A second full re-measurement at 17:28–17:35 UTC confirmed the result: 99.1% of measured HTTPS hostnames gave the same answer, Qtonic Quantum Corp was again 7 of 8 (measured before the policy change of 23:36 UTC), and no measured HTTPS hostname at any of the 50 companies was harvest-proof. Post-quantum shares held within 2 points for every company except Commvault, NCC Group and Varonis Systems, whose measured HTTPS hostnames use a content network that switches between classical and hybrid (up to 15.2 points).
| Measurement | TLS implementation | Vantage point | When | Qtonic Quantum Corp harvest-proof | Harvest-proof HTTPS hostnames at the 50 companies |
|---|---|---|---|---|---|
| Original measurement (as published) | Go crypto/tls (publisher probe) | AWS us-west-2 (publisher host) | 26 Sep 2026, as published | 7 of 8 (before the policy change) | 0 of 1,612 |
| Replication 1 | Go crypto/tls (independent code) | AWS us-west-2 (worker host) | 15:52–15:59 UTC | 7 of 8 (before the policy change) | 0 of 2,878 |
| Replication 2 | Go crypto/tls (independent code) | AWS us-west-2 | 17:28–17:35 UTC | 7 of 8 (before the policy change) | 0 of 2,879 |
| OpenSSL cross-check | OpenSSL 3.5.7 s_client | AWS us-west-2 | 26 Sep 2026, 18:17–18:29 UTC | 7 of 8 (before the policy change) | 0 of 2,875 |
| Adversarial review | Go crypto/tls (reviewer's own code) | AWS us-west-2 | 18:54–18:59 UTC | 7 of 8 (before the policy change) | 0 of 2,880 |
| 26 September 2026 measurement after the policy change | Go crypto/tls (independent code) | AWS us-west-2 (worker host) | 23:44–23:52 UTC | 5 of 8 | 0 of 2,877 |
| 6 October 2026 measurement (this page's ranking) | Go crypto/tls (published probe) | AWS us-west-2 (worker host) | 01:25–01:32 UTC | 8 of 8 | 0 of 2,868 |
In the table, the first five rows are the 26 September 2026 edition before the 23:36 UTC policy change. The next row is the 26 September measurement after that change. The last row is the 6 October 2026 measurement, which is the ranking on this page. The first row is the publisher's own published summary: its raw files are published under proof/original/, but the exact HTTPS hostname subset behind that summary cannot be identified from them, so it is shown as published rather than recomputed.
Try to disprove it
- Own domain only.
- Unmeasured hostnames do not count.
- Sort by clean rate, then hybrid rate, then name.
- The ranking table is the first window.
The headline is falsifiable. To disprove it, find one measured HTTPS hostname on the published list, at any of the 50 companies, that completes a hybrid-only handshake and refuses all three classical ones. Or show that one of the Qtonic Quantum Corp HTTPS hostnames marked harvest-proof (api, demo, lab, mx, qstrike, qtonicquantum.com, stream, www) accepts a classical session. In the 25 October 2026 cycle, three of them did; see what changed since 6 October 2026. Any listed HTTPS hostname can be checked with OpenSSL 3.5 or later:
HOST=api.qtonicquantum.com
# 1. Post-quantum hybrid only — a harvest-proof server completes this
openssl s_client -connect $HOST:443 -servername $HOST -brief -tls1_3 -groups X25519MLKEM768 </dev/null
# 2-4. Classical only — a harvest-proof server refuses all three
openssl s_client -connect $HOST:443 -servername $HOST -brief -tls1_3 -groups X25519 </dev/null
openssl s_client -connect $HOST:443 -servername $HOST -brief -tls1_3 -groups P-256 </dev/null
openssl s_client -connect $HOST:443 -servername $HOST -brief -tls1_2 </dev/nullThe 26 September 2026 proof files listed in SHA256SUMS have not changed since they were timestamped on Sep 27 00:20:08 2026 GMT. The 6 October 2026 company totals, hostname records and raw run are this page's ranking and are not inside that September timestamp. Those October files are listed in SHA256SUMS-20261006, which has its own FreeTSA timestamp. The September timestamp does not cover them. To verify, download SHA256SUMS, the files it lists and a timestamp token, then run:
sha256sum -c SHA256SUMS
openssl ts -verify -data SHA256SUMS -in SHA256SUMS.freetsa.tsr -CAfile freetsa-cacert.pem -untrusted freetsa-tsa.crt
openssl ts -reply -in SHA256SUMS.freetsa.tsr -text | grep "Time stamp"From the same proof/ directory, the October ranking files verify with their own checksum. ../companies.json and ../doors.json are the company totals and hostname records this page serves:
sha256sum -c SHA256SUMS-20261006
openssl ts -verify -data SHA256SUMS-20261006 -in SHA256SUMS-20261006.freetsa.tsr -CAfile freetsa-cacert.pem -untrusted freetsa-tsa.crt
openssl ts -reply -in SHA256SUMS-20261006.freetsa.tsr -text | grep "Time stamp"The second window is not inside that October ranking checksum. From the same proof/ directory:
sha256sum -c SHA256SUMS-20261006-path2
openssl ts -verify -data SHA256SUMS-20261006-path2 -in SHA256SUMS-20261006-path2.freetsa.tsr -CAfile freetsa-cacert.pem -untrusted freetsa-tsa.crt
openssl ts -reply -in SHA256SUMS-20261006-path2.freetsa.tsr -text | grep "Time stamp"The self-hosting four-handshake transcript is timestamped separately (7 October 2026). From the same proof/ directory:
sha256sum -c SHA256SUMS-20261007
openssl ts -verify -data SHA256SUMS-20261007 -in SHA256SUMS-20261007.freetsa.tsr -CAfile freetsa-cacert.pem -untrusted freetsa-tsa.crt
openssl ts -reply -in SHA256SUMS-20261007.freetsa.tsr -text | grep "Time stamp"The publishing-hosts four-handshake transcript of 27 October 2026 is timestamped separately. From the same proof/ directory:
sha256sum -c SHA256SUMS-20261027
openssl ts -verify -data SHA256SUMS-20261027 -in SHA256SUMS-20261027.freetsa.tsr -CAfile freetsa-cacert.pem -untrusted freetsa-tsa.crt
openssl ts -reply -in SHA256SUMS-20261027.freetsa.tsr -text | grep "Time stamp"The own-domain cycle record since 6 October 2026 is timestamped separately (25 October 2026). From the same proof/ directory:
sha256sum -c SHA256SUMS-20261025
openssl ts -verify -data SHA256SUMS-20261025 -in SHA256SUMS-20261025.freetsa.tsr -CAfile freetsa-cacert.pem -untrusted freetsa-tsa.crt
openssl ts -reply -in SHA256SUMS-20261025.freetsa.tsr -text | grep "Time stamp"A hostile reader could look for a showcase server we missed. We searched public certificate logs for post-quantum-named hosts (pq, pqc, quantum, kyber, mlkem and similar) at 48 of the 50 companies, after checking that the same search finds pq.cloudflareresearch.com. It found 11. None is harvest-proof: 9 do not resolve, 1 did not answer, and 1 accepts classical sessions. The public log database timed out for SailPoint and Zscaler, so those two were not searched this way. The result is in hunt-report.json.
Submit a reproducible challenge and read the public log with the hostname, resolved address, UTC time, vantage and four handshake outcomes. Qtonic Quantum Corp is the publisher and a measured company; accepted corrections will be recorded in a new dated snapshot while this proof remains available.
Questions and answers
Why did Qtonic Quantum Corp's score change on 6 October?
On 6 October 2026 the same published probe was run again. qtonicquantum.com, www.qtonicquantum.com, lab.qtonicquantum.com and demo.qtonicquantum.com accepted X25519MLKEM768 and refused the three tested classical handshakes. With api, mx, qstrike and stream, the count was 8 of 8 measured HTTPS hostnames, on one address. On 26 September 2026 at 23:36 UTC the company had opened qtonicquantum.com and www to classical clients, and that day's published count was 5 of 8. The 26 September files remain on this page. Changes found by later daily cycles are listed under "What changed since 6 October 2026" on the homepage. This measurement does not rank products or engineering quality.
Which company ranks first under the dated four-handshake rule?
In the 6 October 2026 snapshot, Qtonic Quantum Corp ranks first of 51 under the published four-handshake rule. 100.0% of its measured HTTPS hostnames (8 of 8) accepted X25519MLKEM768 and refused all three tested classical handshakes. None of the 2,868 measured HTTPS hostnames in the 50 selected comparison companies did both. Counted by address, it was 1 of 1. This does not rank products or engineering quality.
How do the largest IT-security companies compare?
Each of the ten largest IT-security companies by market value has 0% harvest-proof measured HTTPS hostnames. Their share of measured HTTPS hostnames offering post-quantum key exchange ranges from 18.4% (F5) to 99.2% (Cloudflare). On 6 October 2026, Qtonic Quantum Corp offered it on all 8 of its measured HTTPS hostnames (100%).
What does harvest-proof mean?
A harvest-proof HTTPS endpoint accepts the post-quantum hybrid group X25519MLKEM768 and refuses the three classical handshakes tested: TLS 1.3 with X25519, TLS 1.3 with P-256, and TLS 1.2. In these tests, the only handshake it completed was the post-quantum one. That removes the classical-only sessions that harvest-now, decrypt-later attacks record today to decrypt later.
How was this measured and checked?
On 6 October 2026, 3,642 public HTTPS hostnames found on each company's own domain (51 companies) were tested with four TLS handshakes; the 2,876 that completed at least one are counted in the ranking table. The probe is the published Go program. The ranking table is the first run, 01:25–01:32 UTC. The same binary was run again from 54.148.31.245 at 15:33–15:41 UTC. Qtonic Quantum Corp stayed first, at 8 of 8 hostnames and 1 of 1 addresses. Selected peers were 0 of 2,872 in that window and 0 of 2,868 in the first. 20 companies changed rank. The ranking table remains the first window. The 26 September 2026 edition, kept below, agreed with its original run on 99.1% of the hostnames both of those runs measured, and in that edition none of the 50 comparison companies had a harvest-proof measured HTTPS hostname.
Read this before citing the ranking
Different estate sizes. Qtonic Quantum Corp has 8 measured HTTPS hostnames. The 50 companies have between 5 and 163 measured HTTPS hostnames. Counted by IP address instead of by measured HTTPS hostname, Qtonic Quantum Corp was 1 of 1 on 6 October 2026. On 6 October 2026, all 8 measured names resolved to one address and every one of them was harvest-proof. qryptonic.com and qryptonic.org resolve to that same address and still accept classical handshakes; they are not in this own-domain score. Each of the 50 companies is 0 by address. A small estate is easier to keep uniform, so the percentages compare rates, not effort.
One day, public HTTPS hostnames only. This is a snapshot of internet-facing TLS on 6 October 2026. It says nothing about internal systems, the products these companies sell, or their customers' deployments. Companies are the top 50 of the companiesmarketcap.com IT-security list as read on 26 September 2026, plus Qtonic Quantum Corp.
A separate question: product capability
This site measures a dated set of public HTTPS handshakes. It does not audit the discovery, code quality or crypto agility of the products these companies sell. The separate PQC Discovery Index evidence explorer compares documented product capabilities under its disclosed 2026.7 rubric. Its QScout product-proof record states which vendor artifacts have been tested and which product outcomes remain unverified. Neither publication transfers this hostname result into a product score.