A sufficiently powerful quantum computer does not exist yet, but the encrypted traffic it could one day unlock is already flowing across the internet. Cloudflare and AWS, two of the infrastructure providers that sit beneath an enormous share of web and cloud activity, have spent the past two years building defenses against that future machine. They have arrived at strikingly different strategies, and the gap between those strategies tells engineers planning 2026 and 2027 roadmaps a great deal about what quantum-safe protection actually costs and who ends up paying for it.
The Threat That Justifies Acting Early
The concern driving all of this is "harvest now, decrypt later." An adversary intercepts encrypted traffic today, stores it, and waits for a quantum computer capable of breaking the classical key-exchange math underneath RSA and elliptic-curve Diffie-Hellman. Data that must stay confidential for years, such as medical records or government communications, is exposed to that future risk even though no such computer exists today. In August 2024, the National Institute of Standards and Technology finalized three standards built to close that gap: ML-KEM (FIPS 203) for key exchange, ML-DSA (FIPS 204) for signatures, and SLH-DSA (FIPS 205) as a structurally different backup signature scheme. Key exchange and signatures are migrating on separate timelines. ML-KEM defends the session key as a connection is established, which is why both Cloudflare and AWS prioritized it first. Signature migration is moving more slowly because certificate authorities, browsers, and hardware all need to agree on new formats before broad trust can follow.
Cloudflare Made It the Default
Cloudflare has published on post-quantum cryptography since 2017 and treated the transition as infrastructure, not an optional feature. Its core mechanism pairs the classical X25519 exchange with ML-KEM-768 into a hybrid group called X25519MLKEM768, rolled out as the default for TLS 1.3 connections across its network. Because Cloudflare terminates TLS for a vast share of the public web, that default-on decision meant adoption climbed without any customer needing to flip a switch. The company has reported adoption rising from roughly a third of human-generated HTTPS traffic in March 2025 to about 43% by September 2025, with Cloudflare's own dashboard later showing figures approaching 70% of browser traffic by late September 2026. A separate feature introduced in November 2025, Automatic Key Exchange, detects when an origin server supports the hybrid negotiation and prioritizes it, which reportedly cut costly handshake retries and improved latency for connections at scale. The tradeoff is architectural: TLS 1.2 traffic remains outside this coverage entirely, and the approach only works because Cloudflare controls the termination point on behalf of its customers.
AWS Leaves the Switch With the Customer
AWS took the opposite path, rolling out hybrid ML-KEM support service by service rather than network-wide. Starting in April 2025, AWS enabled hybrid post-quantum key agreement on Key Management Service, Certificate Manager, and Secrets Manager endpoints, later extending similar support to AWS Transfer Family in September 2025. AWS kept the pre-standard CRYSTALS-Kyber algorithm running alongside the finalized ML-KEM through 2025 before retiring it, giving customers a transition window rather than a hard cutover. The catch is that protection only activates once a customer upgrades their own SDK, credential provider, or client library. AWS controls the server side of each handshake, not the client side, so there is no single adoption percentage the company can publish the way Cloudflare does. AWS has tied the effort publicly to external deadlines, including the NSA's Commercial National Security Algorithm Suite 2.0, which sets migration dates for national security systems and is pushing similar urgency through regulated industries elsewhere.
What the Divergence Means for 2026 Planning
Neither company charges extra for the hybrid key exchange itself, so cost differences show up in engineering time rather than invoices. Cloudflare's centralized model delivered protection to its entire customer base the moment it shipped, with no application code to touch. AWS's model preserves customer control over exactly when and how the migration happens, but it means coverage will stay uneven until individual teams update their SDKs. For organizations that want the broadest possible protection with minimal internal work, Cloudflare's rollout already covers most of what it can reach. For teams deeply embedded in AWS services with disciplined SDK management, the same underlying algorithm is available, just gated behind a deliberate upgrade step. The cryptography is identical. What differs is who carries the operational burden of turning it on.