Quantum-Safe Browsing Starts Now: Hybrid Post-Quantum Cryptography Across Every Leg of the Session

Adversaries don’t need a quantum computer today to put your data at risk. They only need to record your encrypted traffic and wait.

That tactic, known as harvest now, decrypt later, is why post-quantum cryptography (PQC) can’t wait for a confirmed “Q-Day.” Any data that must stay confidential for years, such as government records, patient information, financial data and trade secrets, is exposed the moment it is captured, not the moment it is decrypted.

Why the Quantum Timeline Matters Now

Quantum computers capable of breaking today’s public-key encryption don’t exist yet. But multiple independent estimates now place their arrival between 2030 and 2035, and that window has narrowed sharply in just the last few years. The NSA has publicly warned that adversaries may already be collecting encrypted data in anticipation.

Three facts make this urgent:

• Captured traffic is exposed permanently. Encryption that is broken later can’t be fixed retroactively.
• Migration takes years. Moving an organization’s security stack to quantum-resistant cryptography is a multi-year effort, because both ends of every connection have to be upgraded.
• The standards are ready. NIST finalized its first PQC standards, including ML-KEM (FIPS 203), in August 2024. There is no longer a reason to wait.

What Hybrid Post-Quantum Key Exchange Means

For most web traffic, the transition is happening through a hybrid approach. X25519MLKEM768, now the default in major browsers and widely supported by large web platforms, combines two methods in a single TLS 1.3 handshake:

• X25519, the proven elliptic-curve method that protects most of the web today
• ML-KEM, the NIST-standardized, quantum-resistant key encapsulation mechanism

A hybrid connection is protected by both methods at once. If either one is ever weakened, the other still holds. Some government guidance, such as the NSA’s CNSA 2.0, ultimately points toward ML-KEM on its own, but hybrid is how most of the web is making the move today, and it keeps connections compatible with every modern browser.

Hybrid only works when both sides of a connection support it. When a server hasn’t upgraded, the connection falls back to classical encryption, the same protection the web relies on today. That’s why adoption has to happen across every system traffic passes through, not just at the browser.

Every Leg of the Connection Counts

Most PQC conversations focus on a single hop. But enterprise web traffic rarely travels in one hop. It passes from the user’s browser to a security service, and from that service to the destination website. Each leg is a place where traffic can be harvested.

A PQC strategy that protects one leg and leaves another unaddressed still leaves data exposed. Security teams should also make sure quantum-resistant encryption doesn’t create a blind spot. Traffic that can’t be inspected for threats and data loss trades a future risk for a present one.

What to Look for in a PQC-Ready Security Platform

As vendors announce PQC support, the details matter. Ask:

1. Is it available now, or in beta or on a roadmap? Harvested traffic is exposed today.
2. Which legs are covered? User to the service, service to the website, and any isolation or proxy hop in between.
3. Is PQC traffic still inspected? Threat prevention and data protection should keep working.
4. Does it require new endpoint software? Agent rollouts slow migration by months.
5. Does it use FIPS-approved algorithms? Many regulated industries require them.
6. What visibility do you get? You should be able to see which connections use hybrid post-quantum key exchange and which still rely on classical cryptography alone.

One caution: post-quantum digital signatures are a separate technology that no public certificate authority or major browser uses yet. Key exchange is where harvest-now, decrypt-later risk lives today. Be wary of claims of end-to-end quantum safety.

How Menlo Security Helps

Menlo Security supports hybrid post-quantum key exchange (X25519MLKEM768) over TLS 1.3 today, built into the same platform that already secures browsing, application access and enterprise data.

• Every leg, available now. In Menlo Cloud deployments, PQC protects the connection from the user to Menlo and from Menlo to the destination website, including traffic rendered in the Menlo Secure Cloud Browser.
• No blind spots. Menlo terminates and re-establishes each TLS connection, so PQC-encrypted traffic stays fully inspected.
• Nothing to install. PQC lives in Menlo’s cloud. Modern browsers already support hybrid key exchange, so users get quantum-resistant protection with no agent or client to deploy.
• FIPS-approved algorithms, with no additional licensing.
• Visibility into what’s negotiated, including which connections are classical and which are hybrid PQC, plus help assessing which browsers are too old to support it.

In Private Cloud and on-premises deployments, the isolated-browser-to-destination leg supports PQC today, and the client-to-proxy leg is on the roadmap.

Start Your Quantum Migration Now

No one can say exactly when a cryptographically relevant quantum computer will arrive. But traffic captured today can be decrypted later, which makes waiting for certainty the riskiest option.

Learn more: Read the Menlo PQC solution brief · Talk to a Menlo expert