IonQ Is Buying Elisity for Access to CISOs. Most of the Post-Quantum Capabilities Those CISOs Need First Are Still Missing.

October 12, 2026 – IonQ announced a definitive agreement to acquire Elisity, a San Jose company that sells identity-based network microsegmentation, in an all-stock transaction valued at up to $1.3 billion. Up to $150 million of that is an earnout tied to how Elisity performs after the deal. IonQ will set the number of shares at closing from its average share price over 20 trading days, within a range of $33.07 to $49.61, so the value Elisity’s owners receive is fixed unless IonQ’s stock moves outside that range. IonQ expects to close in the fourth quarter of 2026, subject to regulatory approval, and Elisity’s CEO, James Winebrenner, will keep running the company.

IonQ presented the deal as a combination of its own post-quantum cryptography (PQC) and quantum key distribution (QKD) products with Elisity’s Zero Trust platform. It said Elisity’s more than 100 customer deployments and its relationships with CISOs would give IonQ new channels for selling PQC, QKD and quantum computing to enterprises and governments.

IonQ is paying up to $1.3 billion for a channel into more than 100 customer deployments, and the deal makes it a bigger security company without filling most of the gaps in its post-quantum offering. The post-quantum work those customers face starts with an inventory of their cryptography and then moves key establishment and digital signatures to NIST’s PQC standards, and federal agencies need that cryptography to run in FIPS-validated modules.

IonQ’s own Investor Day recap says the company delivers “complete, end-to-end quantum security solutions.” Through ID Quantique, IonQ sells PQC key establishment for network links today, and I found no FIPS 140-3 validation for it. IonQ also describes a posture-management offering for finding vulnerable cryptography, but I found no product documentation for it, and the inventory feature announced for Elisity is a roadmap item. I found no IonQ product for issuing post-quantum certificates or signing code.

Elisity’s published customers are mostly health systems, drug makers and manufacturers. Segmentation is likely to be one of their main compensating controls for medical and industrial devices that cannot run PQC, which helps Elisity sell its existing product, but I expect few of them to buy IonQ’s QKD or key-distribution products. In the programs I see, financial institutions spend most on PQC migration, and Elisity’s published customers include no bank.

The firewall, endpoint and cloud security vendors that Elisity’s customers already pay are building cryptographic inventory into their own products. The migration itself is a multi-year program, and I found no security services organization at either company built to run one.

IonQ’s own September paper on breaking elliptic-curve signatures points to the gap in certificates and code signing. On September 8, the day of its Investor Day, IonQ released a resource estimate for running Shor’s algorithm against secp256k1, the elliptic curve behind Bitcoin and Ethereum transaction signatures. Its researchers estimate that a trapped-ion machine with 19,397 physical ions, organized into 1,457 logical qubits, would need about 25.7 days per attempt. Nobody has built that machine.

The estimate covers one curve and gives no figures for the RSA and NIST-curve keys behind most enterprise certificates, but IonQ presented it as a blueprint for breaking signatures, and forgery is also the quantum threat to the certificates and signing keys that tell enterprise systems which servers, software and devices to trust. IonQ’s shipping security products distribute and manage keys for data in transit, or supply the randomness behind them, and Elisity adds network access control. Neither covers certificates or code signing. IonQ’s chairman and CEO, Niccolo de Masi, told investors that day that certificates and device identities with long lifetimes can take years to replace. He is right, and IonQ does not yet sell products for that work.

How IonQ Assembled Its Quantum Hardware Business

IonQ has completed or agreed to at least eleven acquisitions since the start of 2025, Elisity included. The others include Qubitekk (completed in January 2025), ID Quantique (about 86% of the shares on April 30, 2025, according to IonQ’s SEC filings; IonQ announced the completion on May 6), Lightsynq, Capella Space, Oxford Ionics (about $1.08 billion, completed in September 2025), Vector Atomic, Skyloom, Seed Innovations, Nexus Photonics and SkyWater Technology, the US semiconductor foundry it bought for about $1.8 billion and took over on July 31, 2026.

Tomislav Marinovic, an engineer who writes about IonQ as a long-term investor, published a useful map of these purchases on X on October 11, under the title IonQ: The Pieces of the Quantum Puzzle Are Coming Together. He compares IonQ to Rocket Lab and calls the acquisitions “pieces of a much bigger engineering puzzle,” each removing a different bottleneck in the same machine. Oxford Ionics brings electronic qubit control, which reduces the number of lasers a trapped-ion system needs. Nexus Photonics shrinks the remaining optics onto chips. Lightsynq works on quantum memory and photonic links between processors. SkyWater manufactures and packages the result.

At its Investor Day, IonQ said working directly with SkyWater cut its chip design cycle from nine months to two, that it completed six tapeouts in the first half of 2026, and that it ran 12 times more wafer lots in six months than at its previous foundry. Those are company figures, and I found no independent verification of them.

I find the argument persuasive for the hardware. IonQ uses each of those capabilities to build its own machines, so owning them shortens its own development loop. The security business has a different customer.

What IonQ Sells in Quantum Security Today

IonQ’s security business is built on ID Quantique (IDQ), the Geneva company founded in 2001 as a spin-off of the University of Geneva. On IonQ’s own product page, the quantum security entry describes QKD and links to IDQ. It names no PQC product. IDQ’s portfolio has three main lines:

• Clavis XG quantum key distribution systems, plus Clavis XG Multiplex, launched on June 17, 2026, which lets quantum and classical traffic share the same metro fiber.
• The Solteris Network Appliance, which IDQ describes as an enterprise PQC “crypto plane.” It distributes keys out of band over ordinary IP networks and combines PQC with QKD keys where both are available. It also extends QKD networks to sites that QKD fiber cannot reach. It runs IDQ’s Clarion KX key-management software.
• Quantis quantum random number generators, used as entropy sources.

IonQ’s release lists Switzerland, Poland, Romania and Slovakia among the countries where it has deployed quantum-safe national networks. In December 2025, IDQ and Cisco made the link between two Swiss data centers quantum-resistant in a project with the Canton of Geneva, with Solteris supplying keys to Cisco Nexus switches running MACsec encryption. IDQ called it a first step toward a national post-quantum infrastructure.

Slovakia’s national quantum communication network, announced the same month, uses a hybrid of QKD and PQC for its cross-country link. In February 2026, IonQ announced that IDQ had supplied every QKD system in Romania’s national quantum communication network, 36 quantum-secured links covering more than 1,500 kilometers. At its Investor Day, IonQ also announced an $8.18 million agreement with Congruity360, a data-management company, for Clavis QKD pairs and Solteris appliances.

IDQ’s QKD line does hold a government security approval. In January 2025, before IonQ took control, IDQ announced that Clavis XG, with its embedded Clarion KX key management, had become the first QKD product to receive a national security approval from South Korea’s National Intelligence Service. Testing involved the National Security Research Institute, the Korea Research Institute of Standards and Science, the Telecommunications Technology Association (TTA) and the IT Security Certification Center.

TTA issued the approval as a security function confirmation, Korea’s check that IT products bought by the public sector meet its national security standards. Korea runs that scheme separately from Common Criteria certification, and the approval does not extend to Solteris.

The public record says less about how the PQC is built. IDQ’s Solteris page names no algorithm and lists no FIPS 140-3 or Common Criteria certification for the appliance. It cites a NIST-approved IDQ random number generator as its entropy source. NIST has validated an IDQ Quantis generator under its separate program for entropy sources.

IDQ’s Clavis XG portfolio brochure lists “hybrid key agreement leveraging QKD, ECC and/or PQC (ML-KEM)” among Clarion KX’s features, and in a September blog post, Simon Patkovic, IonQ’s field quantum security officer, tied the Clarion KX architecture to ML-KEM, NIST’s standard for key establishment (FIPS 203). IonQ and IDQ have not publicly said which ML-KEM parameter sets they use, how ML-KEM, classical and QKD keys are combined, or whose code implements them.

In earlier deployments the PQC came from partners: SK Telecom put its own PQC software into IDQ’s Solteris key manager for a stand-alone PQC product, and CryptoNext’s library protected the relays in Orange’s Paris network. IDQ has advertised for a principal engineer to work on PQC hardware-acceleration products for use in hardware security modules (HSMs) and network appliances, so a broader product line is in development.

IonQ’s October 12 release also lists “quantum-safe posture management” among its offerings. At the Investor Day, Jordan Shapiro, IonQ’s president and general manager of its quantum platform business, described it as Quantum Security Posture Management (QSPM), an offering that gives customers “visibility into their full infrastructure to determine where they are vulnerable to potential quantum attacks.” The recap’s summary says QSPM “provides complete network visibility.”

I found no product page, datasheet or named customer for QSPM, and IonQ has not said whether it is software, a service or both, what it scans, or what it exports. IonQ did not give a revenue target for its security business at its Investor Day.

In IonQ’s October 12 release, posture management comes first among its security offerings, ahead of QKD and PQC, and the Elisity roadmap would feed cryptographic inventory into IdentityGraph. That ordering and that roadmap look like the start of a platform with posture management at its hub, and I think that is the right design for IonQ. A hub needs a discovery engine underneath it. Keyfactor bought its engine with InfoSec Global and CipherInsights, and SandboxAQ with Cryptosense.

What Elisity Adds to IonQ

Elisity was founded in 2018 by a team from Cisco, Qualys and Viptela, according to its 2020 launch release (its current materials say 2019). It closed a $7.5 million seed round led by Atlantic Bridge that year and came out of stealth in August 2020. After a $26 million Series A in 2021, a $37 million Series B led by Insight Partners in April 2024 brought its total funding to more than $72 million, according to the company, and in January 2025 it announced further investments from TCV and Chevron Technology Ventures without disclosing the amounts.

Its product is microsegmentation: dividing a network into small, identity-defined zones so that a compromised laptop or medical device can reach only what policy allows, which limits how far ransomware and intruders can move. Elisity’s IdentityGraph classifies users, devices, workloads and, more recently, AI agents. Its Virtual Edge software pushes the resulting policy to the Cisco, Juniper, Arista, HPE Aruba and Hirschmann switches a customer already owns.

Elisity has a good record in a category known for failed projects. Gartner listed it as a representative vendor in its 2025 market guide for network security microsegmentation, Forrester rated it a Strong Performer in its Q3 2024 Wave, and Deloitte ranked it 13th on its 2025 Technology Fast 500 list of fast-growing North American companies. Customers include GSK, Main Line Health, MultiCare, Bupa and Shaw Industries.

IonQ says Elisity doubles its revenue and its customer base every year and has lost no deployed customer, and it cites 40% year-over-year growth in its own multiproduct revenue in the second quarter of 2026 as evidence that its customers buy more than one product, without saying what that revenue is. Elisity’s revenue is not public, so I cannot check the growth claims or calculate the multiple of revenue IonQ is paying. Whether Elisity is worth the price as a segmentation business is a question its undisclosed revenue leaves open. IonQ’s quantum security case for the deal can be tested against the public record.

IonQ put the microsegmentation opportunity at more than $10 billion without saying how it defines the market. Exactitude Consultancy estimated the market at $2.6 billion in 2023, rising to $12.5 billion by 2030, according to Elisity’s Series B announcement, and Mordor Intelligence puts it at $26.7 billion in 2026.

IonQ gets two things it did not have: a sales channel to CISOs in healthcare, life sciences and manufacturing, and a point in the customer’s network where it can enforce policy. For medical and industrial devices that cannot run PQC and will not be replaced for years, segmentation is a reasonable compensating control, and the Cybersecurity and Infrastructure Security Agency (CISA) named strong network segmentation as a mitigation in its 2024 guidance on PQC for operational technology.

Segmentation limits what a vulnerable device can reach. It does not protect traffic an adversary has already recorded, and it cannot stop a forged signature.

The most plausible near-term product is an add-on for Elisity’s existing customers: show which devices and flows still use quantum-vulnerable key exchange, then use Elisity to restrict what those devices can reach. IonQ and Elisity said their shared roadmap will add cryptographic inventory and risk information to IdentityGraph. They present it as a roadmap item, and I found no shipping version.

How Many Elisity Customers Enforce Policy Across Their Networks

Elisity describes the problem with its own category. In its winning entry for the 2026 Cybersecurity Stars Awards, Elisity cites Gartner as reporting that 60% of legacy microsegmentation projects stall. Elisity also commissioned Omdia to survey 352 US security decision makers in healthcare and manufacturing, all at organizations with at least 1,000 employees. In the 2025 survey, 99% said their organizations were implementing or planning microsegmentation, but only 9% reported that more than 80% of their critical systems were protected.

Elisity argues that its approach, which needs no new hardware or agents and lets teams simulate a policy before enforcing it, avoids that pattern. CISA called microsegmentation a critical component of zero trust in guidance for federal agencies in July 2025.

Elisity has published one measure for its own customers. In January 2025, it said that over 83% of the Fortune 500 companies it had recently added as customers implemented critical security policies across their infrastructure within 90 days, and that customers averaged 14 days from deployment to their first enforced policy. Those are company figures for one group of new customers, and they do not say how much of each network the policies cover.

IonQ said Elisity has more than 100 customer deployments but did not say how many of them enforce policy across most of the network. The merger agreement, which may show how IonQ measures Elisity’s performance for the earnout, had not been filed with the SEC when I wrote this.

What Elisity Can See of a Customer’s Cryptography

Elisity’s documentation for Cisco switches lists what it collects: flow telemetry (NetFlow or the vendor’s equivalent), syslog, endpoint tracking data, neighbor tables, and identity mappings exchanged over SXP. A standard flow record contains the addresses, ports and byte counts of a connection, not the handshake parameters and certificates a cryptographic inventory needs.

Cisco’s Encrypted Traffic Analytics, an extension to NetFlow on some Cisco routers and switches, reports the TLS version, cipher suites and key lengths, but Elisity’s documentation does not say it collects that data. To build the promised inventory, Elisity will have to add a sensor that reads handshakes, use those extensions where the switches support them, or take data from partners.

A handshake sensor has a limit of its own. In TLS 1.3, all handshake messages after the ServerHello are encrypted, so a passive sensor can see which key exchange the two sides negotiate but not the server’s certificate.

Even with handshake data, a network sensor cannot see whole categories an inventory has to cover: stored data, keys embedded in firmware and application code, the signing chains for code and firmware, HSM and PKI configuration, the cryptographic libraries inside applications, and traffic that never crosses a switch Elisity manages, such as workloads in public clouds. In its June memo, the White House Office of Management and Budget (OMB) named network scanning for protocols and cipher suites as one of three discovery methods, alongside software composition analysis of a product’s software bill of materials (SBOM) and static and dynamic testing of code. A network sensor covers the first of those and does not replace the other two.

Where Elisity’s Customers Stand on PQC

Elisity’s named customers, such as GSK, MultiCare and Shaw Industries, the case studies on its website and the survey it commissioned from Omdia all come from healthcare, life sciences and manufacturing. The devices on those networks are a long way from post-quantum cryptography.

Forescout’s Vedere Labs tracks post-quantum support across the devices it sees on enterprise networks. In June, it reported that 50% of IT devices ran OpenSSH versions that support post-quantum key exchange, against 16% of operational technology (OT) devices and 6% of connected medical devices. For TLS, where Forescout looked at the key exchange negotiated in connections it observed, the figures were 8% for IT devices, 5.6% for IoT and medical devices and 0.8% for OT.

In October, Forescout followed with a report on healthcare. Medical devices made up 5% of the more than 2.5 million devices it counted across more than 50 healthcare delivery organizations, and Forescout put IoT and OT devices at another 18%. Forescout also found more than 5,500 instances of 50 medical information systems exposed to the internet. On average across those systems, 31% ran TLS 1.3, the only TLS version that supports post-quantum key exchange. Forescout concluded that the specialized devices “are unlikely to be fully migrated this decade if we keep going at the current pace.”

Medical technology companies, the makers of those devices, rated themselves the best-prepared sector in DigiCert’s 2026 survey. That survey asked respondents how prepared they felt; Forescout measured the devices already installed in hospitals.

For regulated medical devices and legacy proprietary systems, Forescout notes, cryptographic changes depend on vendor release cycles, recertification or even hardware replacement. CISA’s 2024 guidance on PQC for operational technology warns that OT systems may be some of the last platforms to reach post-quantum standards, for similar reasons.

I expect hospitals and plants to rely on segmentation to protect those devices for years. Forescout recommends segmenting and isolating legacy systems that cannot be updated. That is Elisity’s product, which it can now sell as a compensating control for devices that cannot run PQC. Segmentation does nothing about the other quantum risk to those devices, a forged signature on a firmware update, which only the device maker’s signing chain can address.

It gives Elisity’s customers far fewer reasons to buy IonQ’s PQC and QKD products. Their medical and industrial devices will get PQC, when they get it, from the device makers. IonQ’s shipping products secure links between sites, such as data center interconnects and national backbones, or supply entropy, and they do not change the cryptography inside an infusion pump, an imaging system or a programmable logic controller on a factory floor.

Hospitals also run ordinary IT, 66% of the devices in Forescout’s sample, with links to data centers, clouds and partners that need post-quantum key exchange. Most hospitals will get it from their firewall, VPN and cloud vendors as those products update. I expect few of Elisity’s customers to buy QKD or a Solteris appliance, and the exceptions will be the ones with data center interconnects or research links that justify a separate key plane.

IonQ’s $8.18 million agreement with Congruity360 shows another route into these sectors: a data-management provider buying Clavis QKD pairs and Solteris appliances to protect the data it holds for clients in healthcare, manufacturing, finance and other regulated sectors. That is a service provider buying for its own infrastructure, a different sale from a hospital buying an appliance.

I expect hospitals and manufacturers to spend on the quantum threat in three places: visibility of what cannot be upgraded, containment for it and pressure on their vendors. Forescout advises building PQC requirements, or clear vendor roadmaps, into procurement decisions and contract renewals.

Forescout sells device visibility, network access control and segmentation products, and Elisity markets itself as an alternative to Forescout’s segmentation product. Microsoft lists Forescout among its partners with cryptographic posture management products available today, and describes Forescout’s Cyber Assurance service as showing whether an asset’s communications use post-quantum or classical cryptography, across IT, IoT and OT. A company Elisity competes with already sells the cryptographic risk view that IonQ and Elisity have put on their roadmap.

Who Pays for PQC Migration

The organizations I see spending most on PQC migration are financial institutions. Capgemini’s 2025 survey of 1,000 organizations with revenue of at least $1 billion found 90% of defense organizations and 86% of banks working on or planning quantum-safe solutions within five years, the two highest shares of the 13 sectors surveyed, against 48% in consumer products and 49% in retail. In January, the G7 Cyber Expert Group, which advises G7 finance ministers and central bank governors, published a non-binding roadmap for the financial sector that gives 2030–2032 as an example window for migrating the most critical systems.

Individual supervisors have gone further. In July, the Hong Kong Monetary Authority scored the banks that answered its survey at 2.3 out of 10 on a new quantum preparedness index and set a target of 10 by 2030. The same month, the Monetary Authority of Singapore said it wants financial institutions to be quantum resilient before the end of the decade.

Elisity markets to financial institutions too. Its page for them quotes an unnamed US financial services CISO, but its named customers and case studies include no bank. IDQ’s brochure for banks claims “production deployments with tier-1 financials” without naming them. Whatever position IonQ has with banks comes from IDQ, and Elisity’s public record adds no bank to it.

The banks spending on PQC need signature, PKI and validated-module work that IonQ does not yet sell. The channel IonQ is paying for leads mainly to hospitals, drug makers and manufacturers, whose devices are among the least able to use its PQC products.

The people who buy PQC also differ from the people who buy segmentation. Segmentation belongs to the network security team. When the Entrust and Ponemon survey published in January asked who is most responsible for an organization’s cryptographic security strategy, 24% of respondents named the CIO and 22% the CISO. In the same survey, 37% cited unclear ownership as a main challenge in deploying and managing PKI. PKI teams and application owners do much of the migration work, along with procurement, which manages the vendors whose products have to change.

Elisity’s relationships are with CISOs and network teams, which can open doors to the PKI and application teams but do not replace them. IDQ’s relationships are mostly with governments, telecom operators and research networks. I found nothing in either company’s public record aimed at the enterprise PKI team or at vendor remediation.

What Executive Order 14412 and OMB’s Memo Require of Federal Agencies

IonQ tied the deal to the White House executive order of June 22, 2026. That order, EO 14412, “Securing the Nation Against Advanced Cryptographic Attacks”, directs OMB to require federal agencies to move their high value assets and high-impact systems to PQC by December 31, 2030, for key establishment and by December 31, 2031, for digital signatures. It makes each agency’s PQC migration lead responsible for cryptographic inventory management.

The order directs the Federal Acquisition Regulatory (FAR) Council to propose, within 180 days (around December 19, 2026), a rule requiring covered contractors to comply with NIST’s FIPS standards, including PQC, by December 31, 2030. That rule is directed rulemaking and has not been proposed yet. The order also directs CISA and NIST to publish minimum elements for a cryptographic bill of materials (CBOM), a machine-readable inventory of an organization’s cryptography, within 270 days, around March 19, 2027.

The order binds federal agencies, and the FAR rule, once written, would bind covered contractors. It does not reach a private hospital or manufacturer, unless the rule later covers contracts it holds, but Elisity’s customers face the same first step anyway.

In August 2023, CISA, the National Security Agency (NSA) and NIST urged organizations, especially those that support critical infrastructure, to begin preparing by creating quantum-readiness roadmaps and conducting inventories. Several of the regulators I talk to are now preparing to test the quality of inventories and CBOMs as well as whether they exist, and some insurers are building quantum-readiness assessments into their pricing.

OMB followed on June 24 with memorandum M-26-15, which I covered here. It gives agencies until October 22, 2026, ten days after IonQ’s announcement, to send OMB and the Office of the National Cyber Director (ONCD) a PQC Migration Plan that describes how they will inventory their cryptography and with which tools. It sets five phases:

1. Strategy, planning and discovery, 2026–2027
2. Pilots and early migration, 2027–2028
3. Prioritized migration of key establishment, plus crypto-agility for all systems, 2028–2030
4. Migration of digital signatures for the same priority systems, 2031
5. Full migration, 2035

OMB tells agencies to prioritize legacy systems that cannot support PQC for replacement or decommissioning. The memo does not discuss compensating controls such as segmentation. OMB also treats zero trust as dependent on PQC: its requirements include PQC key exchange at TLS and IPsec terminators, PQC-signed tokens, PQC-agile libraries and re-encryption of sensitive data that has to stay confidential for years. Neither the order nor the memo mentions QKD, network segmentation or microsegmentation.

Inventory is where agencies are stuck. In an audit that ran from February 2024 to September 2025 and was made public on October 6, 2026, the US Government Accountability Office (GAO) found that only one of 24 agencies had fully carried out the activities for developing a prioritized inventory of systems with vulnerable cryptography. OMB had asked agencies for their first inventories by May 2023.

Agencies will fund what these dates require: an inventory of the whole cryptographic estate, FIPS-validated PQC, and a plan for signatures. Predictions of Q-Day will not move those dates.

Where National Security Agencies Stand on QKD

US and allied governments are more skeptical of QKD than of PQC. NSA rewrote its QKD statement on October 1, 2026 and kept its verdict: it does not recommend QKD for protecting national security systems. NSA’s CNSA 2.0 FAQ tells owners of national security systems not to use or research QKD without consulting NSA.

The UK’s National Cyber Security Centre (NCSC) said in an August 2025 paper that it “will not support the use of QKD for government or military applications.” Security agencies in France, Germany, the Netherlands and Sweden concluded in a joint paper in January 2024 that QKD suits niche use cases and that migration to PQC should come first.

European policy is split. The European Commission is building EuroQCI, a quantum communication infrastructure that all 27 member states have joined, with QKD as its first service, and IonQ presented its Slovak network as Slovakia’s contribution to it. I would not trust critical systems to QKD today, but I think the investment in it is justified, partly as a hedge for key distribution in case PQC algorithms fail. For IonQ, that means QKD will sell where governments fund it, in EuroQCI national networks, Korea and Switzerland, and a QKD-first pitch will cost it credibility with US federal buyers.

The Security Pieces IonQ Still Needs

Once the deal closes, IonQ will own an established product for one piece of a PQC migration, containment for systems that cannot migrate, and a product for another, PQC key establishment, for which I found no FIPS 140-3 certificate. The other pieces are missing, incomplete or undocumented:

Containment is useful, and it satisfies none of the inventory, signature or validated-module requirements in OMB’s memo.

Inventory Beyond the Network

The vendors IonQ will meet in inventory deals already cover more vantage points. Keyfactor, which sells certificate lifecycle management, bought InfoSec Global and Quantum Xchange’s CipherInsights product in May 2025. InfoSec Global’s AgileSec Analytics discovers cryptography in devices, source code, binaries, file systems, applications and cloud workloads. CipherInsights is a passive network sensor. Keyfactor connects both to its certificate platform. In December 2025, SandboxAQ signed a five-year agreement with the Department of War CIO to provide automated cryptographic discovery and inventory with its AQtive Guard platform.

IBM sells Quantum Safe Explorer, which scans code for cryptography, alongside its posture-management product and its consulting arm. The market for cryptographic inventory tools was crowded before IonQ arrived. IonQ describes QSPM as giving customers visibility into their full infrastructure, and has not published what it scans or how.

Cryptographic Inventory in Firewalls, Endpoint Agents and Scanners

A buyer may not need a new product for the network slice of an inventory, or for much of the endpoint, code and cloud slices. The security platforms many enterprises already run now include cryptographic discovery:

• Palo Alto Networks’ Quantum-Safe Security app builds what the company calls “a real-time inventory of your applications, user devices, infrastructure, and IoT devices” from the decryption, traffic and tunnel logs of its firewalls and Prisma Access, and flags assets that use classical algorithms as harvest-now, decrypt-later risks. The app needs its own license.
• Zscaler made a PQC Visibility Report generally available in September 2025, showing which traffic uses post-quantum key exchange, and says customers can stream the underlying logs into a cryptographic bill of materials.
• Microsoft lists a certificate inventory with key algorithms in Defender Vulnerability Management, drawn from devices running the Defender for Endpoint agent, along with detection of vulnerable cryptographic libraries and of TLS and SSH sessions. It also lists detection of cryptography in source code through GitHub Advanced Security.
• Wiz added certificates, SSH keys, cryptographic libraries in third-party software and containers, and cloud key-management services to its agentless cloud scanning in May.
• Tenable added post-quantum inventory checks for TLS and SSH services to its vulnerability scanners in December 2025.
• Keyfactor’s AgileSec discovery sensor deploys across a customer’s CrowdStrike Falcon endpoints.

These are signals, and a buyer still has to combine them into one inventory; Microsoft’s guidance is written as a strategy for the customer to assemble it from Microsoft’s tools and its partners’ products. A firewall that decrypts traffic sees handshakes and certificates, and Elisity’s switches, as documented, see flows. Palo Alto can also act on what it finds. From PAN-OS 12.1, its firewalls can decrypt traffic from a legacy device that supports only classical TLS and re-encrypt the outbound leg with post-quantum key exchange.

In my PQC Migration Framework, I argue for starting with what the framework calls a Minimum Viable CBOM, an inventory of the systems that matter most that grows over time, instead of spending years on a complete inventory that is out of date when it is finished. A network-derived inventory is a reasonable first slice, and many buyers can already get one from the firewalls and security gateways they own, with an added license in Palo Alto’s case.

Elisity’s remaining distinction is where it acts: at the access switch, on traffic between devices in the same network, including medical and industrial devices that cannot run an endpoint agent and whose traffic may never pass a firewall. IonQ’s inventory roadmap should start from that gap. The network slice is the part many customers already have tools for.

Signatures, Certificates and Code Signing

IonQ’s September paper models an attack on signatures, and OMB set 2031 as the federal deadline for migrating them on priority systems. A forged signature lets an attacker impersonate a server, a software publisher or a firmware vendor, the risk I call Trust Now, Forge Later. Migrating signatures requires:

• certificate authorities and PKI that issue ML-DSA or SLH-DSA certificates
• certificate lifecycle management to replace certificates across the estate
• code-signing pipelines and firmware verification that accept the new signatures
• HSMs that support the new signature algorithms

I found no IonQ product for any of these. The vendors that sell them include Keyfactor, DigiCert, Entrust, Thales and Utimaco, and their PQC support and its validation status vary by product and version. CyberArk bought the certificate management vendor Venafi in 2024, and Palo Alto Networks completed its acquisition of CyberArk on February 11, 2026, so one of the best-known certificate management products is now part of Palo Alto Networks.

A FIPS 140-3 Certificate for IonQ’s PQC

FIPS 140-3 is the US government standard for cryptographic modules. NIST’s Cryptographic Module Validation Program (CMVP) validates modules against it. NIST states that only validated modules meet federal requirements for protecting sensitive information, and that a validated module can be a component embedded in a larger product. Covered contractors would need the same under the FAR rule the executive order directs.

IDQ’s June 2026 brochure for Clarion KX lists a “FIPS 140-3 ready” crypto module, and IonQ’s Investor Day recap describes its PQC as “NIST/CNSA 2.0-compliant.” Neither names a certificate or says which ML-KEM parameter set the products use; CNSA 2.0 requires ML-KEM-1024.

When I searched NIST’s lists of validated modules on October 12 and 13, I found no certificate, active or historical, with ID Quantique or IonQ as the vendor, and no entry for either on NIST’s list of modules in process. IDQ appears only as a distributor on a retired FIPS 140-2 certificate for a Senetas encryptor that used classical algorithms.

The lists cannot rule out a submission. NIST says listing in its queue is voluntary, a joint decision by the vendor and its testing lab, and 12 of the 204 modules in process on October 12 were not displayed. IDQ may also be relying on a third-party module that is itself waiting at NIST, as PQShield’s and SafeLogic’s modules with PQC algorithms are. CMVP reported in January that its last 30 validations had averaged 348 days.

A module in IDQ’s own name would normally leave one public trace before NIST’s review: algorithm certificates. NIST’s algorithm database has none for an IDQ or IonQ implementation, and ID Quantique appears there only as a distributor of Senetas encryptors validated in 2016 and 2017.

A federal buyer will ask which certificate covers the PQC in Solteris and Clarion KX, whether IDQ’s own or one embedded from another vendor. In federal procurement, “ready” has no standing; the buyer needs a certificate number, or at least a modules-in-process entry. IDQ has taken its QKD system through a national government evaluation in Korea; its PQC has yet to go through NIST’s. The executive order tells NIST to speed up CMVP validations, so IonQ has a reason to name the module now and to submit whatever no certificate covers.

Delivery Capacity for Multi-Year Migrations

Most of a PQC migration is program work: discovery, prioritization, remediation by vendors, testing, and engineering for crypto-agility so the next algorithm change costs less. The scale is easy to underestimate. One of the programs my PQC Migration Framework came out of ran to more than 120,000 tasks on its own.

In a July 2024 report to Congress, OMB cited an estimate by ONCD of about $7.1 billion, in 2024 dollars, to move prioritized federal systems to PQC between 2025 and 2035. It is the only official public estimate of the federal cost, and I think it is far too low.

ONCD built it from the funding assessments agencies submitted in 2024, and the GAO audit later examined how those were prepared. Only one agency’s assessment was based on a complete inventory of its priority systems. All 21 agencies that produced one acknowledged that their data were not fully accurate, and eleven said it was difficult to assess funding when no vendor yet sold the PQC products they needed.

ONCD told GAO that agencies had been instructed to look at historical program baseline costs and project them forward as best they could. The figure is closer to a projection of existing budgets than to a costing of the systems that have to change.

The figure also covers less than the migration OMB now requires. It covers prioritized systems only and excludes national security systems, and OMB said replacing systems that cannot accommodate new cryptography is “a significant portion” of it. OMB’s June memo extends the work to crypto-agility for all systems by 2030 and migration of the remaining systems by 2035, based on risk and on what vendors offer, and it requires each agency’s PQC Migration Plan to include resource and funding estimates. Those estimates are due with the plans on October 22.

OMB and ONCD acknowledged the weaknesses but told GAO the assessments were reliable for a rough order of magnitude. GAO warned that agencies risk unexpected migration costs. Because most agencies worked from incomplete inventories, ONCD’s estimate could be too high or too low for the systems it covers. Migrating the systems it excludes, national security systems among them, can only add cost. I expect the full federal migration to cost a multiple of $7.1 billion.

OMB required agencies’ first inventories by May 2023. More than two years later, when GAO finished its audit, all but one of the 24 agencies had incomplete inventories of their priority systems or none at all. None had tested PQC in its own environment. ONCD told GAO that testing was voluntary, and GAO disputed that reading of OMB’s guidance.

GAO also found that 18 of the 24 agencies reported a lack of expertise in cryptography and in building inventories, 19 used no automated discovery tools, and 23 had no documented process for maintaining their inventories. These are agencies with a mandate, a deadline and a reporting line to OMB.

Private organizations report a shortage of people. In the Entrust and Ponemon survey, which I analyzed in January, the share of respondents naming a lack of in-house expertise among their greatest concerns about the quantum threat and PQC migration rose from 28% to 38% in a year, and fewer than half (47%) said their organizations have PKI specialists on staff.

A PQC migration crosses network, application, PKI and procurement teams, and it moves at the pace of the vendors whose products have to be upgraded. Carmen Chu, who heads banking supervision at the Hong Kong Monetary Authority, said in July that the banks that already have transition plans expect implementation to take 5.6 years on average.

Large buyers fill that gap with IBM Consulting, Accenture, the Big Four and specialist firms, often with tools bundled in. Zscaler now offers service-led crypto-discovery engagements in partnership with HCLTech, aimed at building the cryptographic bill of materials a migration roadmap starts from.

Elisity’s team deploys its own product, which is a different job from running a migration across an estate for years. IonQ has an applications team for quantum computing, but I could not find a security services business at IonQ of the size a federal or Fortune 500 migration needs. It will have to build one or work through systems integrators. Without that capacity, the Elisity channel will generate demand that other firms turn into programs. (Disclosure: Applied Quantum, the firm I founded, runs PQC migration programs, so I have a commercial interest in this part of the market.)

Why Vertical Integration Is Harder in Cybersecurity

On the hardware side, IonQ buys capabilities it uses itself. A faster foundry loop or a smaller laser system makes IonQ’s next processor better, whether or not a customer ever hears about it. In security, the customer is a CISO with a deadline and thousands of systems, and that CISO gains nothing from IonQ owning the photonics inside a QKD link. The CISO will judge IonQ on coverage of the estate, validated modules and integration with the tools already in place.

The vendors assembling post-quantum suites started from certificates, identity and discovery: Keyfactor with its two acquisitions, Palo Alto Networks with CyberArk, SandboxAQ with its Department of War agreement, and IBM. IonQ’s shipping products start from network key distribution, and Elisity adds network enforcement. Both work at the network layer, and the hard parts of the migration (signatures, applications, embedded devices, stored data) are outside the network layer.

Network key establishment is also becoming a feature of products customers already pay for. Palo Alto’s firewalls have supported post-quantum hybrid IPsec VPNs since PAN-OS 11.2. Zscaler says it began inspecting hybrid ML-KEM traffic inline in February 2026. Chrome, Edge and Firefox negotiate post-quantum key exchange by default, and by October 2025 more than half of the human web traffic through Cloudflare was protected with post-quantum encryption.

Solteris competes with upgrades many customers receive under support contracts they already have. IDQ’s case for it is a separate key plane that can mix PQC and QKD keys and feed encryptors that do not negotiate their own, which a few links need and most do not.

IonQ publishes estimates of how to break elliptic-curve cryptography and sells PQC and QKD products, and de Masi defends the combination with an analogy: “You want a safecracker to be the one who builds your safe.”

The analogy works when IonQ’s marketing is as careful as its research. IonQ’s researchers were careful in the September paper. They call the 25.7 days a conservative upper bound on runtime. The estimate assumes two-qubit error rates IonQ has measured on two ions, applied to a machine of nearly 20,000. IonQ also stated that ML-DSA and SLH-DSA are unaffected.

IonQ’s press releases were less careful. In the September 8 release for the paper, de Masi said he had flagged in 2025 that the Q-Day horizon was shifting “from the 2030s to the 2020s.” In the October 12 release announcing the Elisity deal, he said, “As I said first, Q-Day is coming much faster than predicted.”

CISOs will discount lines like these from a vendor with a product to sell. The deadlines they already face give IonQ all the urgency it needs, and IonQ can cite them without predicting when a cryptographically relevant quantum computer will exist.

What IonQ Should Do Next

1. Publish the implementation details and get them validated. IonQ has tied Clarion KX to ML-KEM in a brochure and a blog post. Its product pages should say which ML-KEM parameter sets Solteris and Clarion KX use, how ML-KEM, classical and QKD keys are combined, how the channel is authenticated, and whose code implements them. IonQ should then name the validated modules that cover that code and submit to CMVP any code they do not cover, while NIST is under orders to speed validations up.
2. Make QSPM the hub of a platform, and buy what goes under it. Publish what QSPM scans and how. Export a CBOM in CycloneDX format and map it to the CISA and NIST minimum elements when they appear around March 2027. Take findings from the inventories customers already run in their firewalls, endpoint agents and cloud scanners, and add a handshake sensor at Elisity’s Virtual Edge for the traffic those tools miss. Discovery across code, hosts and cloud is the first layer to buy or partner for, as Keyfactor and SandboxAQ did, and the PKI and services layers follow in recommendations 3 and 4. The step that would set IonQ apart is the one after the inventory: a finding about a device that cannot run an agent becomes a containment policy at the access switch. Publish, too, the migration plan for Elisity’s own control channels, from its cloud console to the Virtual Edge software and the switches, because that cryptography has to move as well.
3. Close the signature gap. Partner with a PKI and certificate lifecycle vendor first, and consider buying one later, along with PQC intellectual property for the HSM-acceleration products IDQ is already hiring for.
4. Build or partner for delivery capacity. A large buyer of PQC is buying a multi-year program: inventory, prioritization, vendor remediation, testing, rollout and evidence for auditors. IonQ needs program managers, PKI engineers and cryptographers who can run that, in a services arm of its own or through integrator alliances with shared delivery playbooks. It needs them before the Elisity channel starts producing demand.
5. Sell Elisity customers a simple first product. A quantum-readiness report built from an existing Elisity deployment, structured to feed a migration plan of the kind M-26-15 requires. For hospitals and plants, the most useful version lists the medical and industrial devices that cannot run PQC and contains them. Solteris belongs in the report only for the few site-to-site links that justify an appliance. The measures of success are how much of each customer’s network the report covers and how many quantum-vulnerable flows it helps remove, as well as how many customers buy it.
6. Build a route to the banks. Financial institutions are spending on PQC now, under pressure from their supervisors. Elisity’s public customer record does not show it reaching them. Their migrations run through PKI, HSM and payments teams, so IonQ needs partners that already sell to those teams, or an acquisition that does, alongside the bank relationships IDQ says it has for QKD.
7. Lead with PQC in US federal sales. Sell QKD where governments fund it, as an added layer for EuroQCI national networks, Korea and Switzerland, and keep it out of the federal compliance story, since neither the executive order nor OMB’s memo mentions it.

Dates and Disclosures to Watch

• The merger agreement. When IonQ files it, the earnout metrics will show how IonQ measures Elisity’s performance, whether by revenue, bookings or something else.
• October 22, 2026. Agency PQC Migration Plans are due at OMB, and I expect federal procurements for inventory tools to follow.
• IonQ’s third-quarter results. Watch for any separate disclosure of security revenue and for the integration plan for Elisity.
• Around December 19, 2026. The FAR Council’s proposed rule on contractor FIPS and PQC compliance, if it arrives on the order’s schedule.
• Around March 19, 2027. CISA and NIST’s minimum elements for a CBOM, the standard any QSPM or IdentityGraph inventory output will be measured against.
• A QSPM datasheet. One that names its data sources, its CBOM output and its integrations would turn the offering from a description into a product.
• A joint customer. The first IonQ and Elisity deployment in which a cryptographic finding drives a segmentation policy would show the combined product working.
• A FIPS 140-3 submission for Solteris or Clarion KX, or a partnership in PKI, certificate management, cryptographic discovery or migration services. Any of these would show IonQ building toward what the deadlines require.

Marinovic’s map shows a company that knows which pieces its quantum computers need and has bought most of them. Its security customers need a different set: inventories that cover the whole estate, a way to migrate signatures, cryptographic modules with certificates, and people who can run a multi-year program.

The Elisity deal gives IonQ a channel to sell that set, mainly to hospitals, drug makers and manufacturers, which will spend on segmentation long before they buy PQC products. IonQ still has to build or buy most of the set, and find its way to the banks that are paying for PQC now.

From the author