Sector analysis
Industry: the vault may be good. The problem is when it has to talk.
The vault protects the stored secret; once it moves, cryptography does. A cut of the 14,958 industrial organizations in the IEQ base shows the sector's public cryptographic posture, and why, in the model, industrial data stays valuable for longer.
An industrial secret can be kept in an excellent vault. But a design that never leaves the vault never becomes a product. It goes to the supplier who makes the part, to the other plant, to the partner who certifies it. The vault protects the secret while it is stored. Once it moves, what protects it is cryptography, and traffic copied today can be read years from now.
In this cut, GWK examines the public cryptographic posture of the main domains of 14,958 industrial organizations. In 82%, the test did not negotiate a post-quantum hybrid key exchange, and the model assigns industrial data one of the longest value horizons in the base.
This analysis looks at the industrial cut of the IEQ base as a sector, not company by company. It uses only what the IEQ observes from outside and states, each time, what is a measurement and what is a model assumption. No organization is named.
Why look at industry
Industry is the largest sector in the base: 14,958 organizations, about 19% of the 80,182 in the current edition. Even so, the public conversation about the post-quantum transition tends to focus on banks and governments.
The previous analyses showed that the value of information over time changes how the same technical signals should be read. Industry is where that effect is most visible outside the sectors usually discussed: its technical surface looks like everyone else’s, while its data lives much longer than in retail or software.
Three conditions for the risk to exist
Harvest now, decrypt later only becomes a problem when three things hold at the same time. The IEQ observes the first, approximates the second and assumes the third.
- 01ObservedThe connection negotiates a key exchange that a sufficiently capable quantum computer could break. This is read directly from the public TLS handshake.
- 02ApproximatedAn adversary can reach and store that traffic. The IEQ does not observe capture. It measures the operational exposure of the public surface (dimension E) as an indication of how reachable it is.
- 03AssumedThe information is still valuable when decryption becomes possible. This is a documented sector parameter, not a measurement of each company's data.
Every reading in this analysis concerns the public surface of each organization's main domain. Internal networks, industrial control systems, VPNs and supplier links are outside the measurement.
The data clock
The IEQ assigns each sector a time horizon, TD: for how many years the representative information of that sector remains valuable to an adversary. For industry the parameter is 15 years, within a documented range of 10 to 20. The model uses the 20-year term of patent protection as the reference for the ceiling.
Retail works with 5 years, finance with 10, healthcare and government with 20. Combined with the model’s capability scenario, the industrial horizon translates into H = 0.88, against 0.21 in retail.
How long the data is worth something, by sector.
TD in years. The same value applies to every organization in the sector.
Source: IEQ V2 sector assumptions (median of the representative asset). These are documented assumptions, not measurements of how long each company's data stays confidential.
Industry in the base
On the technical side, industry looks like the base as a whole. The median of cryptographic vulnerability, V, is 0.9971 against 0.9985 for the base; the median of operational exposure, E, is 0.5286 against 0.5270.
The index tells a different story. The median IEQ of industry is 87.5, with half of the sector between 83.1 and 89.9. The base median is 59.5. Industry sits just below the sectors with a 20-year horizon and well above finance.
Similar surface, higher index.
Median IEQ by sector, 0 to 100.
View values and cohort sizes
| Sector | Organizations | V | E | TD | H | IEQ |
|---|---|---|---|---|---|---|
| Government | 7,203 | 0.9985 | 0.5190 | 20 | 0.9559 | 98.1 |
| Healthcare | 10,495 | 0.9971 | 0.5254 | 20 | 0.9559 | 94.8 |
| Defense | 1,252 | 0.9971 | 0.5344 | 20 | 0.9559 | 94.6 |
| Real estate | 2,395 | 0.9971 | 0.5384 | 20 | 0.9181 | 92.7 |
| Industry | 14,958 | 0.9971 | 0.5286 | 15 | 0.8784 | 87.5 |
| Energy | 3,421 | 0.9985 | 0.5246 | 10 | 0.7066 | 70.3 |
| Finance | 7,574 | 0.9985 | 0.5098 | 10 | 0.6591 | 66.3 |
| Telecom | 2,417 | 1.0000 | 0.5324 | 6 | 0.4453 | 45.1 |
| SaaS | 8,236 | 0.9985 | 0.5224 | 6 | 0.3409 | 34.7 |
| Retail | 14,107 | 0.9971 | 0.5376 | 5 | 0.2111 | 21.8 |
Source: IEQ V2 base, October 7, 2026 edition. Ten selected sectors, all above the anonymity floor (K = 30).
Industry combines technical medians close to those of the base with a median IEQ of 87.5. In the model, priority also depends on how long information stays valuable, set at 15 years for the sector.
What we see from outside, and what lies below
Among the 13,657 industrial organizations where the collection obtained a reading, 11,165 (81.8%) did not negotiate a post-quantum hybrid key exchange in the test. The share in the base is 80.7%. In other words, nearly one in five negotiated this kind of exchange in the test.
Basic practices follow the base closely. The clearest gap is HSTS, absent in 57.8% of industry against 53.9% of the base. TLS 1.0 or 1.1 is still accepted by 13.9%; this reading has lower coverage, since older protocols are not always testable.
Industry follows the base, with small gaps.
Cryptography in use
% of organizations where the signal was observed
Basic practices
% of organizations where the signal was observed
View counts and coverage
| Signal | Observed | With the signal | Industry | Base |
|---|---|---|---|---|
| Did not negotiate post-quantum hybrid exchange in the test | 13,657 | 11,165 | 81.8% | 80.7% |
| Cipher suites with classical key exchange breakable by a quantum algorithm | 13,622 | 11,180 | 82.1% | 84.1% |
| Accepts TLS 1.0 or 1.1 | 10,442 | 1,455 | 13.9% | 13.1% |
| No HSTS | 13,403 | 7,746 | 57.8% | 53.9% |
| No DNSSEC | 14,804 | 14,036 | 94.8% | 93.7% |
| No CAA record | 14,887 | 12,654 | 85.0% | 81.8% |
| Self-signed certificate | 13,083 | 46 | 0.4% | 0.3% |
Source: IEQ V2 base, same edition. Each percentage counts only organizations where that signal was read; organizations without a reading are left out of both numerator and denominator.
The tip of the iceberg
The public edge is the part that can be observed from outside. It is the tip. Below it are the VPNs to suppliers, remote access for maintenance, links between plants, the file-transfer services and the factory networks. From outside, the IEQ does not see them, does not know which information actually travels through the observed surface, and does not know whether anyone has captured it. It also reads only the main domain, not every subsidiary or brand.
If the tip already shows this picture, the rest deserves a look. With the organization's authorization, the same measurement can run inside its environment, on the channels that actually carry designs and contracts, and read the parts of the iceberg that cannot be seen from outside.
For your next security meeting
Four questions every industrial manager should be able to answer
A long data clock does not call for a different technology. It calls for a different order of priorities. These questions organize it:
- Which designs, formulations, process data and contracts will still be sensitive in ten or fifteen years, and through which channels do they travel today?
- Do the edge providers in front of those channels (CDN, load balancer, VPN) already support a post-quantum hybrid key exchange, and is it enabled?
- Are the inexpensive basics in place: legacy TLS disabled, HSTS active, certificates issued under a declared policy?
- Does the migration plan rank systems by how long their data stays valuable, and not only by how critical the system is today?
No clear answer to one of them? That is where an authorized assessment starts.
Talk to GWKMethod and sources
One edition, one reference base.
The figures come from the October 7, 2026 edition of the IEQ V2 base, with 80,182 organizations. The unit is the organization, observed through its main domain. Cohorts below K = 30 are not published. This edition keeps the data used, regardless of later updates to the catalog.
Observed: the signals in Figure 03 and the dimensions V and E. Assumed: the sector horizon TD and the parameter H derived from it. When a signal has no reading for an organization, it does not count in the percentages above; in the index, it enters with a neutral value. The IEQ is an exposure index: its values are not attack probabilities. The model is not calibrated against confirmed HNDL exploitation.
Found something to correct? Write to [email protected]. Corrections are recorded in a new edition, with date.
Below the tip
Measure the channels your secrets travel through.
Talk to GWK about an authorized assessment inside your environment, or see how the IEQ reads industry.
Talk to GWK Industry sector page Explore the public catalog