Is ING quantum-safe?
Partly. 32 of 77 public servers under ing.com use post-quantum key exchange, the protection against traffic recorded today being decrypted once a large quantum computer exists. Grade C. Scanned October 18, 2026.
Fix first
Production login, API, VPN, payment and developer servers that still rely on key exchange scheduled for retirement.
- api.commercial.ing.com
- api.developer.ing.com
- api.feedback.ing.com
- api.ing.com
- api.mobile.ing.com
- api.myaccount.ing.com
- api.nrc.esaeat.ing.com
- api.onesearch.ing.com
- api.smartcollect.ing.com
- api.tax.esaeat.ing.com
- api.transactional.ing.com
- developer.ing.com
- portal.smartcollect.ing.com
32 other servers without post-quantum key exchange
- 3ds-acc.ing.com
- 3ds.pl.ing.com
- api.myaccount.sandbox.ing.com
- api.sandbox.ing.com
- commercial.ing.com
- creditview.ing.com
- ct.pbresearch.ing.com
- extnotify.ing.com
- feedback.ing.com
- gdn.ing.com
- ingcommercialcard.ing.com
- isabel.services.be.ing.com
- myaccount.ing.com
- myaccount.sandbox.ing.com
- onesearch.ing.com
- os.cdn.ing.com
- passwordreset.smartcollect.ing.com
- pki.ing.com
- psrv-ws.ing.com
- research.ing.com
- sds2.ing.com
- think.ing.com
- tpcra.ing.com
- transactional.ing.com
- tst.api.smartcollect.ing.com
- tst.portal.smartcollect.ing.com
- uat.ingcommercialcard.ing.com
- up.transactional.ing.com
- webinars.think.ing.com
- www.creditview.ing.com
- www.pki.ing.com
- www.research.ing.com
32 servers already protected
- acc.ing.com
- acc1.supplyfy.ing.com
- accept-art.ing.com
- accept-online.ing.com
- accp.feedback.au.ing.com
- api.accp.feedback.au.ing.com
- api.feedback.au.ing.com
- api.myleo.ing.com
- api.test.feedback.au.ing.com
- art.ing.com
- assets.ing.com
- b2b.itsme.ing.com
- brand.ing.com
- careers.ing.com
- cdn.ing.com
- click.ing.com
- cms-acc.ing.com
- cms-tmp.ing.com
- cms-tst.ing.com
- cms.ing.com
- developer.smartcollect.ing.com
- feedback.au.ing.com
- ing.com
- internal.careers.ing.com
- mailing.ing.com
- myleo.ing.com
- online.ing.com
- supplyfy.ing.com
- survey.ing.com
- tmp.ing.com
- tst.ing.com
- www.ing.com
What this means
NIST has scheduled the key exchange most servers still use for retirement: deprecated after 2030, disallowed after 2035 (NIST IR 8547). Traffic recorded today can be decrypted once a large quantum computer exists. A server that offers hybrid ML-KEM key exchange closes that today; a server that does not is still open to harvest now, decrypt later.
Hostnames come from public certificate logs plus common service names, kept where the name resolves to a public address, and each is tested from the outside with post-quantum-only TLS 1.3 handshakes. A hostname shows what a server is called, not what traffic it carries; internal systems are out of scope. Method.
Work at ING?
Fleet Watch gives you this scan privately every week, with your suppliers and a report your auditor can verify. The first scan is free.
Scan your own domainBadge
Shows the current grade and updates itself. Anyone may embed it.
<a href="https://latticescan.com/readiness/ing.com"><img src="https://latticescan.com/badge/readiness/ing.com" alt="quantum readiness"></a>