Communications Minister Fahmi Fadzil says Malaysia is considering speeding up its move to quantum-safe encryption. On one slice of the consumer web, connections to Cloudflare's network, more than half of requests already use it.
Quick facts
Contents
- Fahmi has asked MCMC to talk to the National Security Council (MKN), the National Cyber Security Agency (NACSA) and telcos about an R&D space for "faster and more secure quantum migration", Bernama reported on 9 November.
- From 12 October to 8 November, 59.6% of web requests from Malaysia reaching Cloudflare, bots included, used post-quantum key agreement (the step that protects a connection's encryption keys), according to Cloudflare Radar data we queried through its API on 9 November. Counting only traffic Cloudflare classes as likely human, the figure is 67.3%.
- That puts Malaysia 9th of the 11 ASEAN members, ahead of only Timor-Leste (53.9%) and Myanmar (49.6%). The Philippines is highest at 70.2%; the worldwide figure is 59.9%.
- Over the same four weeks in 2024, Malaysia's figure was 13.7%.
What Fahmi said
Fahmi spoke in Doha after visiting exhibition booths at MWC Doha 2026 on 8 November. "Malaysia is considering accelerating its quantum migration process. I have asked the MCMC to engage with the NSC and NACSA and discuss with telecommunications companies on how we can work together to establish an R&D space for faster and more secure quantum migration," he said, according to Bernama.
He named quantum-safe communication as one of the innovations that caught his attention, and said quantum computers are expected to challenge the encryption used to keep data secure today. Bernama's report gives no timeline, budget or target date. Fahmi is in Doha for the ITU Plenipotentiary Conference 2026, where Malaysia is seeking to keep its seat on the ITU Council for 2027 to 2030.
Where Malaysian connections to Cloudflare stand
Cloudflare Radar reports the share of web requests reaching Cloudflare that use post-quantum key agreement, by the country they come from. Our figures count all requests, human and automated, the same way for every country and year. We pulled all 11 ASEAN members, including Timor-Leste, for the same 12 October to 8 November window. Malaysia's 59.6% sits just under Singapore (60.7%), Indonesia (61.2%) and Vietnam (62.1%), and below Cambodia (62.9%), Brunei (64.4%), Laos (64.7%), Thailand (68.4%) and the Philippines (70.2%). The United States was at 57.2%.
It is worth being clear about what this number measures. It covers connections to Cloudflare only, not all Malaysian web traffic, and whether a request qualifies depends on the software making it supporting post-quantum key agreement. Cloudflare says recent versions of all major browsers, plus OpenSSL, Go and recent Apple operating systems, enable post-quantum key agreement by default. The figure says nothing about the government and telco systems that Fahmi's talks are aimed at.
Two years of change
Comparing the same 12 October to 8 November window each year, Malaysia's share went from 13.7% in 2024 to 42.4% in 2025 and 59.6% now. The worldwide figure moved from 12.7% to 40.0% to 59.9%, so Malaysia was 1.0 and 2.4 points ahead of the world figure in 2024 and 2025, and 0.3 points behind it now.
One risk driving the work is what security people call "harvest now, decrypt later": some traffic recorded today could be decrypted later, if it relied on vulnerable cryptography and a quantum computer able to break today's encryption is built. The US standards body NIST finalised its first three post-quantum cryptography standards, FIPS 203, 204 and 205, on 13 August 2024. For background on quantum hardware, see our report on AMD, IBM and Oak Ridge's error-correction platform.
What it means for you
For most readers, post-quantum key agreement on these connections comes with browser and operating system support rather than a setting you switch on. Cloudflare's documentation links a browser check that shows whether your current connection uses it. Post-quantum signatures, which protect authentication, are a separate step that Cloudflare says it is beginning to deploy.
When MCMC's talks with MKN and NACSA produce a plan, we will query the same Cloudflare window again and set the two side by side, as we did when we put Malaysia's under-16 social media rule next to California's.
How we measured: Cloudflare Radar API, endpoint http/summary/post_quantum, filtered by country (location=MY and each ASEAN member), dateStart 12 October 00:00 UTC to dateEnd 9 November 00:00 UTC of 2024, 2025 and 2026, all traffic (no botClass filter; the likely-human figure uses botClass=LIKELY_HUMAN), queried on 9 November 2026; the range covers 12 October to 8 November.
