Post-Quantum Cryptography Migration for Enterprise APIs: A Simulated Hybrid TLS Performance and Risk Evaluation

This empirical-style article presents a clearly labeled simulated study in Computer Science and Engineering. A simulated enterprise API gateway benchmark compared classical TLS, hybrid classical-plus-ML-KEM key establishment, and post-quantum-heavy configurations under small, medium, and large request profiles. Handshake time, transmitted bytes, CPU utilization, session reuse, memory use, and failure under constrained clients were modeled. The study emphasizes migration engineering and does not claim access to production enterprise systems. Hybrid classical plus ML-KEM increased simulated full-handshake latency by 18% relative to classical TLS but reduced the migration risk associated with an abrupt cryptographic cutover. Session reuse limited the application- level overhead to under 5% for sustained API traffic. Constrained clients experienced the largest memory and payload penalty. The numerical observations, assignments, and measured outcomes are synthetic and intended for methodological illustration only. No real industrial facility, enterprise network, laboratory, construction project, or manufactured component was used. The study demonstrates a realistic research framework aligned with current 2026 research directions while clearly separating simulated evidence from verified literature.