Cloudflare expanded post-quantum encryption across its secure access service edge (SASE) platform, a move the company says makes it the first provider to support modern post-quantum standards across all major network configurations.

The San Francisco-based cloud services company said the update extends post-quantum coverage to Cloudflare IPsec, its wide-area networking service, and the Cloudflare One Appliance, its physical and virtual branch connector hardware. Combined with support already available in its Zero Trust and Secure Web Gateway products, Cloudflare said the Cloudflare One platform now supports post-quantum encryption across its core SASE components.

Sharon Goldberg, senior director of product management at Cloudflare, said the latest update completes the SASE stack by adding post-quantum protection to the WAN-as-a-service layer. 

“Previously, we upgraded the SWG (secure web gateway) and ZTNA (zero-trust network access) portions of Cloudflare One. This update upgrades the WAN-as-a-service piece,” Goldberg said.

The update centers on hybrid module lattice-based key-encapsulation mechanism (ML-KEM), a key encapsulation mechanism standardized by the U.S. National Institute of Standards and Technology (NIST). Cloudflare said more than 60% of human-generated transport-layer security (TLS) traffic on its network already uses the hybrid approach. 

The push reflects growing industry concern over so-called “harvest now, decrypt later” attacks, in which encrypted data is collected today in anticipation of future quantum computers capable of breaking existing cryptography. NIST has set a 2030 target year for organizations to move away from current public-key cryptography standards. 

Goldberg said enterprises are moving early because cryptographic upgrades can take years to complete. “If regulators say the deadline is 2030, that’s not actually so far away,” she said.

However, data with long retention periods could already be at risk. Goldberg said that organizations handling long-lived data, such as government records, health care information, or financial assets, face particular pressure because adversaries could store encrypted data today and decrypt it later.

The Cloudflare One Appliance upgrade is generally available in version 2026.2.0 and is pushed automatically, requiring no customer action. The Cloudflare IPsec upgrade remains in closed beta, with broader availability dependent on third-party branch connector vendors adopting the same emerging standard.

Cloudflare has worked on post-quantum cryptography since 2017, and introduced a cloud-native post-quantum Secure Web Gateway in 2025. The company said the latest update does not require additional hardware or major configuration changes for most customers.