NIST finalized FIPS 203, 204, and 205 to protect data from quantum attacks. FIPS 203 covers ML-KEM for general encryption, while FIPS 204 and 205 provide digital signature standards via ML-DSA and SLH-DSA. Cloudflare implements post-quantum authentication using ML-DSA for Cloudflare-to-origin connections in mid-2026. This deployment targets the authentication layer to prevent attackers from forging identities and certificates. While Cloudflare has already protected more than 65% of human-generated traffic through post-quantum encryption, the next stage involves deploying ML-DSA for authentication to prevent attackers from forging credentials once quantum computers become capable of bypassing classical systems. Craig Gidney showed in 2025 that breaking RSA-2048 requires fewer than one million superconducting qubits. This research suggests the deadline to migrate is sooner than previous estimates. Cloudflare plans to deploy these capabilities by default to ensure customers benefit without manual configuration. The company aims for full quantum-resistant protection across its network by 2029. In mid-2027, the company plans to deploy post-quantum authentication for visitor-to-Cloudflare connections using Merkle Tree Certificates, which facilitates identity verification through updated certificate formats. Cloudflare completes the integration into the Cloudflare One SASE suite in early 2028.
Enterprise shifts and provider differences
Enterprises move away from Akamai to Cloudflare to replace complex, managed services with programmable, API-first automation. Akamai sells services through negotiated, committed contracts and requires dedicated platform teams to manage rule trees and change windows. Akamai maintains an advantage in managed media delivery and deep ISP peering with its 365,000 servers. Cloudflare publishes self-serve plans at $25 and $250 per month, while Enterprise plans start near $5,000 per month. I find the Cloudflare model better for teams managing infrastructure as code across multi-cloud estates. Akamai users often deal with the complexity of contract-driven provisioning and manual tuning. Cloudflare’s network spans more than 335 cities and has 534 Tbps of capacity. Cloudflare uses every PoP as a scrubbing center for DDoS defense, whereas Akamai reroutes malicious traffic to specific scrubbing centers.
| Specification | Cloudflare | Akamai |
|---|---|---|
| Enterprise Starting Price | ~$5,000/month | Negotiated contracts |
| Self-Serve Pricing | $25 – $250/month | Not available |
| DDoS Defense | Every PoP scrubs traffic | Dedicated scrubbing centers |
| Primary Use Case | Automation and API | Managed media and delivery |
The reality of the quantum threat
The harvest-now, decrypt-later threat drives the need for immediate post-quantum key exchange. Adversaries capture encrypted data today to decrypt it later using quantum computers. Cloudflare protects over 65% of human-generated traffic with post-quantum encryption. A mid-September 2025 iOS update moved the global share of post-quantum requests from 29% to 52% in one week. Cloudflare enabled quantum-resistant encryption for all websites and APIs on its platform in 2022. Microsoft also shipped ML-KEM and ML-DSA APIs for Windows Server 2025 and Windows 11 in November 2025 via the Cryptography API: Next Generation. However, Active Directory Certificate Services support for these algorithms does not arrive until early 2026. You should check your origin server because Cloudflare’s platform-level security does not cover the connection between Cloudflare and your origin. Cloudflare’s Zero Trust platform enables organizations to route communications between users and applications through quantum-safe connections. This includes Cloudflare Access and the WARP device client. By mid-2025, the WARP client will support all IP protocols via post-quantum encryption. ML-DSA-44 adds approximately 15 KB of extra data to each TLS handshake, which complicates deployments on slow networks. ML-KEM-768 targets NIST security level 3. Does your origin infrastructure support ML-DSA?
