IonQ Completes the Quantum-Safe Stack: Why the Elisity Deal Makes IonQ the Security and Networking Leader Governments and Commerce Worldwide Need
We strongly favor this acquisition and believe it will significantly accelerate IonQ's growth and substantially increase shareholder value over a short period of time. Elisity gives IonQ the one security layer it lacked and puts a quantum-safe market worth about $36–65 billion by 2030 within its reach. More than two dozen countries and blocs have deadlines approaching: U.S. agencies must file migration plans by October 22, the EU and Saudi Arabia's banks start by the end of 2026, and Swiss banks are expected to have roadmaps by mid-2027. The collar caps dilution, and we believe it is outweighed by Elisity's own recurring revenue, which IonQ says is doubling every year, and by new revenue from selling IonQ's quantum-safe products to Elisity's customers. The details of the merit and potential shareholder value are found in the data presented in this report.
$36–65B Quantum-safe market IonQ with Elisity now reaches by 2030; $94– 161B by 2035 | 1% ≈ $180–440M A 1% share of the $18–44B core product market ≈ 40–97% of IonQ's 2026 revenue guidance | 12 / 12 Capability score across six layers; no rival reaches 7 on equal weights | $26–40M Illustrative Elisity revenue to break even on revenue per share, across the collar | 25+ Countries and blocs with post-quantum dates, 2026–2035, plus NATO's 2027 pilot |
IonQ's acquisition of Elisity is an outstanding deal, and in our view the most important security move any quantum company has made. With it, IonQ becomes the only company we have identified that owns every layer of quantum-era security: trusted U.S. silicon, quantum random number chips, quantum key distribution, post-quantum cryptography, national quantum networks, satellite links, and now the identity-based Zero Trust layer that decides who and what may reach what inside a network. That turns IonQ from a quantum supplier waiting for budgets into a security platform that sells into deadlines governments have already set. It arrives as more than twenty-five countries and blocs tell their banks, ministries and critical infrastructure to act.
Who is on the clock
★ The four countries this report examines in depth in Part One, where IonQ already has a footprint: IonQ Italia; ID Quantique's Swiss headquarters and national network; ID Quantique behind Singtel's quantum-safe network; and IonQ's Korean science-ministry agreement, KISTI partnership and ID Quantique chips in SK Telecom phones. Details and sources for every entry are in Part One and Part Two.
Country or bloc | 2026–2027: inventory, plans and first rules | 2028–2031: priority systems and key cutoffs | 2032–2035: full migration |
★ Italy | ACN guidelines require a cryptographic inventory, a migration roadmap and crypto-agility; EU start (end-2026) | high-risk systems migrated (end-2030, EU) | medium- and low-risk systems (2035, EU) |
★ Switzerland | FINMA asks banks for board-approved PQC roadmaps built on an inventory (mid-2027); national cyber center puts PQC first | no national cutoff yet; FINMA roadmaps drive bank migration | — |
★ Singapore | MAS supervisory expectations (July 2026); critical-infrastructure migration plans (March 31, 2027) | new systems quantum-safe or ready (Jan. 1, 2028); banks quantum-resilient "before the end of this decade"; critical infrastructure complete (end-2031) | — |
★ South Korea | quantum-security law takes effect six months after promulgation; ₩4.5B PQC pilots (2026); public-sector market opens (2H 2027) | private-sector market opens (from 2029, industry expectation) | national cryptographic systems moved to PQC (2035 master plan) |
United States | agency migration plans (Oct. 22, 2026); NSA CNSA 2.0 (2027) | high-value systems, key exchange (end-2030), signatures (end-2031) | full federal migration; NIST disallows RSA and ECC (2035) |
Canada | federal plans (April 2026) | high-priority systems (end-2031) | all systems (end-2035) |
European Union, all 27 member states | national plans and start (end-2026) | high-risk systems (end-2030) | medium- and low-risk (2035) |
Poland | PQC migration plan in its 2025–2029 cyber strategy | — | — |
Lithuania | national transition plan (Q3 2026) | — | — |
France | no certification without PQC (2027) | stop buying non-PQC products (2030) | — |
Australia | refined plans (end-2026) | cease traditional public-key crypto (2030) | — |
Japan | national roadmap (fiscal 2026) | — | government agencies (2035) |
Saudi Arabia | bank inventory (end-2026); risk assessment (March 2027) | — | — |
Israel | bank preparedness plans (January 2026) | — | — |
Hong Kong | bank readiness index launched (July 2026) | full bank readiness (2030) | — |
India | critical-infrastructure foundations (2027) | critical infrastructure complete (2029); enterprises' priority systems (2030) | enterprises complete (2033) |
Taiwan | bank inventory (2026–2027) | bank pilots (2027–2029) | high-risk bank systems (2035) |
Thailand | inventory and risk assessment (2026–2027) | hybrid trials (2027–2030) | critical systems (2030–2035) |
Brazil | national certificate system moving to PQC (2026) | — | — |
NATO | HQ–SHAPE quantum-resilient pilot (Q4 2027) | — | — |
United Kingdom | — | discovery and plans (2028); priority systems (2031) | complete (2035) |
Germany | — | sensitive data (2030); classical-only encryption ends (2031) | classical signatures (2035) |
Netherlands | — | high-risk (end-2030) | medium-risk (end-2035) |
Czech Republic | — | critical data (end-2030) | — |
Sweden | — | long-lived sensitive data (2030) | all (end-2035) |
Vietnam | — | PQC research program and proposed roadmap (2026–2030) | — |
Brunei | — | deprecate RSA and ECC (2030) | complete (2035) |
G7 financial sector | — | critical systems (2030–2032) | overall (2035) |
Programs without a set date yet: United Arab Emirates, Jordan, Bahrain, Qatar, Türkiye, Malaysia, Indonesia, New Zealand, Kazakhstan
Building their own standards: China, Russia
The 27 EU member states on the EU timetable: Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Poland, Portugal, Romania, Slovakia, Slovenia, Spain and Sweden. IonQ and ID Quantique already run national quantum networks in Romania, Slovakia and Poland and have IonQ Italia in Italy.
Contents
PART ONE · THE STRATEGIC CASE
How IonQ Will Put Elisity to Work
PART TWO · THE WORLD FACES THE SAME DEADLINES
Latin America and Central Asia are starting
China and Russia are writing their own standards
The countries and their deadlines
How large each region's market could be
What the global pattern means for IonQ
PART THREE · FROM ONE HOSPITAL NETWORK TO SIX MORE ECOSYSTEMS
Healthcare: the new revenue ecosystem
How healthcare correlates to six more ecosystems
PART FOUR · ANSWERING THE SKEPTICS: THE FINANCIAL CASE
What Governments Say the Migration Will Cost
2. Why IonQ Is Positioned to Win
Who Elisity Is: The Evidence Behind the Price
How Elisity Compares With Its Direct Rivals
Six More Ways the Deal Creates Value
Ten Moves That Would Prove the Thesis
"On a combined basis, we are unequivocally the leading security company in the Western world."
Niccolo de Masi, IonQ Chairman and CEO, Bloomberg Open Interest, October 12, 2026
Please take the time to read this in full, because most observers are going to miss the importance of what IonQ announced on October 12. IonQ's agreement to acquire Elisity is one of the most consequential moves in the company's history, and it is the move we had been hoping to see. With it, IonQ takes an unequivocal position of strength in a security market that is growing fast and becoming more alarming by the month, and no other quantum computing company can match it.
For months our research on China, Russia and the countries now racing to protect themselves kept reaching the same conclusion. IonQ had assembled the strongest quantum-safe portfolio in the industry: quantum computing, quantum networking, quantum key distribution through ID Quantique, quantum random number generation and post-quantum cryptography. One layer was still missing, and it was the layer adversaries exploit first: control over who and what is allowed to reach what inside a network. We wanted IonQ to own that layer, and now it will.
Elisity brings identity-based Zero Trust to every user, device, workload, AI agent and non-human identity. Its IdentityGraph enforces least-privilege policy through a software layer that does not depend on the network underneath. The deal is all-stock and worth up to $1.3 billion, including an earnout of up to $150 million, with closing expected in the fourth quarter. It gives IonQ the whole path: the key that encrypts the data, the link that carries it, and the identity that is allowed to use it. This is not a cybersecurity tuck-in. It is the step that completes IonQ's full stack, and it arrives exactly when governments and banks are being told to act.
The timing matters because of the threat. Over several months, our research on Moscow and Beijing has documented a quantum partnership between Russia and China that is deeper, better funded and more deliberate than most Western observers assume. Both states are pursuing quantum computing, quantum communication and the human networks that move expertise between them. Meanwhile their cyber services are already inside critical networks today. Salt Typhoon reached deep into American telecommunications carriers. UNC3886 attacked Singapore's critical infrastructure and then all four of its major telcos, which Singapore's Cyber Security Agency called "a deliberate, targeted, and well-planned campaign." Russian services have spent years probing European energy, government and diplomatic systems. Behind them come other dubious players: North Korea's industrial-scale theft and its fake IT workers, and the commercial brokers who sell access to whoever pays.
Artificial intelligence is now accelerating all of it. IonQ frames the challenge as two overlapping priorities: containing attacks that move at machine speed today, and protecting sensitive information against the quantum threat tomorrow. Elisity answers the first, and IonQ's quantum-safe portfolio answers the second.
All of this feeds harvest-now-decrypt-later, where adversaries copy encrypted traffic today and wait for a quantum computer to open it. As the U.S.-China Economic and Security Review Commission has reported, China is among the adversaries already doing exactly that. Our own conclusion is blunt: encrypted data stolen today is a quantum loss already in progress. IonQ's announcement quotes Niccolo de Masi: "Q-Day is coming much faster than predicted." On the day of the deal he went further, telling Bloomberg he expects it "by the end of this administration in the lab and a year after that at scale." That is his forecast, and it is a demanding one, but it explains the urgency: "We are urging our customers to listen to the White House executive order of June 22 and start working with us now. This is a real and present threat." The adversaries do not need to break today's encryption today. They only need to be inside the network and patient. Elisity is built to stop the first step, and IonQ's quantum-safe products are built to make the patience worthless.
Our China research shows how far ahead of the official picture Beijing already is. In "China's Quantum Push: What Beijing Is Assembling in Plain Sight," we documented from China's own procurement, standards and government records a state program that is further along than the assessments most U.S. and allied officials still cite. A China Telecom-controlled center in Beijing's E-Town district is building a full-stack quantum ecosystem that, in Beijing's own words, is benchmarked against IBM Qiskit and NVIDIA NVQLink. The research institute that leads Beijing's quantum-AI consortium belongs to CETC, the state defense-electronics group, and is on the U.S. Entity List alongside three other consortium members. China Telecom alone reports 7.2 million quantum-communication users, with metro quantum networks in 25 cities by late 2025 and 40+ planned. China's state carriers sit on the Pentagon's list of Chinese military companies, and China's mobilization law lets the state requisition their facilities. PLA universities co-draft China's national standards for quantum computing and quantum key distribution, and hardware for the next generation of quantum satellites is already in procurement.
7.2 million | CHINA'S STATE STACK China Telecom reports 7.2 million quantum-communication users, with metro networks in 25+ cities. The only rival full stack belongs to a state. |
When the Chinese Academy of Sciences released its 15th Five-Year Plan on September 28, we tested our findings against it. Of 49 findings, 39 were confirmed or partly confirmed and none was contradicted. China is not racing toward a single device. It is racing to own the whole stack, and Beijing has said so in writing.
The danger reaches beyond China's borders. Origin Quantum's Wukong cloud, run by a company on the U.S. Entity List, had logged more than 49 million remote visits from 192 countries and regions by June 2026. The United States, Russia and Japan were its top foreign users, and its operating system is now free to download. A state ordnance conglomerate led its latest funding round. China is writing its own standards for post-quantum encryption and quantum networks, and it aims to offer a global quantum communication service by 2027.
Russia is a willing partner in that push. The Chinese Academy of Sciences and Rosatom signed a quantum and photonics memorandum during President Putin's state visit in May, and Chinese and Russian researchers continue to co-author work on trapped-ion quantum computing. The strategic question for every allied government is now concrete: whose operators sit inside its keys, whose clouds hold its research, and whose code runs on its networks. Our answer is an in-alliance quantum-safe stack that allies operate themselves, and this acquisition takes IonQ a long step toward being the company that supplies it.
That is why we see this as a full-stack deal rather than a bolt-on. Our China research makes a point that the quantum industry rarely says aloud: key distribution does not protect compromised endpoints or insiders. Post-quantum cryptography and QKD protect data in transit, but they cannot stop a compromised device or a stolen identity from moving sideways once it is inside. Microsegmentation stops that lateral movement. Elisity's roadmap goes further and adds cryptographic inventory and quantum-risk data to IdentityGraph. A bank or ministry could then see which assets still run vulnerable cryptography, who can reach them, and how to fence them off while migration proceeds. Every regulator we have studied asks institutions to do exactly this, in roughly this order: inventory the cryptography, contain the risk, then migrate.
The U.S. government shows how wide the gap is. A Government Accountability Office audit covering Feb. 2024 to Sept. 2025, released this month, found that none of the 24 major federal agencies had fully put in place the post-quantum practices the White House requires. Twenty-three lacked documented processes to keep a cryptographic inventory, and 19 were not using automated tools to discover the cryptography running on their networks. The Office of Management and Budget puts the migration of priority federal systems at roughly $7.1 billion. That missing inventory, with an automated map of what is running and who can reach it, is exactly what Elisity's IdentityGraph roadmap is designed to supply.
0 of 24 | GAO AUDIT None of the 24 major federal agencies had fully put in place required post-quantum practices; 23 lacked a documented cryptographic inventory process. |
These dates sit on a federal framework built since 2022:
The deadlines are fixed:
Dec. 31, 2030 | HARD U.S. DEADLINE Executive Order 14412 requires high-value federal systems to use post-quantum key establishment by the end of 2030, and signatures by the end of 2031. |
With Elisity, IonQ can sell the whole sequence instead of only the last step.
Artificial intelligence makes this layer more valuable every month. Elisity was built to govern not only people and devices but workloads, AI agents and other non-human identities, and that is where the next wave of risk is gathering. Enterprises are deploying autonomous agents that log in, call applications and move data on their own. Each one is a new identity inside the network, and each one is a foothold an adversary can hijack or impersonate. Security teams cannot protect what they cannot see, and most have no reliable map of which agents exist or what those agents can reach. Our AI infrastructure report argued that IonQ belongs beneath the AI transition as part of the infrastructure it runs on. With Elisity, IonQ can also secure the AI estate itself. It can see every agent, limit what each one may touch, and protect its traffic with quantum-safe keys. As the AI and quantum eras arrive together, that combination is exactly what chief information security officers will be asked to deliver, and IonQ will be one of the few companies able to provide all of it.
40% | AI AGENTS Gartner predicts 40 percent of enterprise applications will feature task-specific AI agents by the end of 2026, up from under 5 percent in 2025. Each one is an identity Elisity can govern. |
The commercial case is just as strong. Elisity has more than 100 deployments worldwide and a growing roster of Fortune 500 customers. Its revenue and customer count are doubling year over year, and it reports zero churn. It works in a microsegmentation market IonQ sizes at more than $10 billion. The opportunity is enormous precisely because the world is so far behind: Juniper Research projects that only 27 percent of businesses worldwide will have deployed post-quantum cryptography by 2035.
27% | JUNIPER RESEARCH Only 27 percent of businesses worldwide are expected to have deployed post-quantum cryptography by 2035. The world is far behind, which is the opportunity. |
Elisity brings what quantum vendors have always struggled to build: a trusted seat with the chief information security officer, and enterprise and government sales channels that reach buyers long before they have a quantum budget. IonQ reported 40 percent year-over-year multiproduct revenue growth in the second quarter of 2026. Elisity gives that growth a far wider funnel. A customer who starts with Zero Trust today becomes the natural buyer of PQC, QRNG, QKD and eventually quantum computing tomorrow, all from a vendor already inside the security perimeter. Keeping James Winebrenner as CEO of the business protects the team and the customer relationships that make it valuable.
The deal also cements IonQ's leadership in networking. IonQ already points to national quantum networks in Switzerland, Poland, Romania and Slovakia, and ID Quantique supplies the quantum key distribution behind Singtel's national quantum-safe network. What those networks have lacked is a way to govern who uses them. Because Elisity's policy layer runs independently of the network underneath, a customer can deploy it across the switches, clouds and sites it already owns without tearing anything out. That means IonQ can secure the network a customer has today while building the quantum network it will need tomorrow, and manage identity policy and quantum keys as one system.
When governments speak of digital sovereignty, this is what they mean: a network they can see, control and protect end to end, supplied by a trusted partner rather than an adversary's carrier. Few companies in the world can offer that, and IonQ is now one of them.
Switzerland shows why this matters to sovereign buyers. It is home to ID Quantique, the Swiss secure-network infrastructure and the Geneva Quantum Network. It also faces Russian and Chinese intelligence activity on its soil, which Swiss authorities have publicly acknowledged, from Geneva's international organizations to its research and banking sectors. Switzerland's National Cyber Security Centre has taken a deliberately post-quantum-first position: in its December 2025 brief, QKD is "explicitly not considered" a stand-alone solution. The financial regulator has set a date. In its Guidance 05/2026 of July 9, FINMA recommends that institutions have a post-quantum roadmap by mid-2027, approved by their governing bodies and built on a cryptographic inventory. Its own survey of 60 institutions found that 72 percent had not yet planned or implemented any quantum-safe measures, and only 8 percent had a concrete roadmap.
72% | FINMA SURVEY Of 60 Swiss financial institutions, 72 percent had not yet planned or implemented any quantum-safe measures; only 8 percent had a concrete roadmap. |
Elisity speaks directly to that view. IonQ can now offer Swiss authorities and banks a layered answer: PQC everywhere, QKD where fixed high-value links justify it, and identity-based segmentation across the entire estate. That is a better fit for the Swiss doctrine of sovereignty by design than any single technology, and it lets IonQ meet the regulator where it already stands rather than argue with it.
Italy shows the same pattern in a European Union and NATO setting. Russia and China maintain sustained pressure on Italian defense, space, ports, telecommunications and the networks that carry Mediterranean traffic. Italy's response is gathering pace through its national quantum strategy, its post-quantum preparation and the financial sector's own work. The national cybersecurity agency, ACN, has updated its cryptography guidelines to include post-quantum solutions. They call for an inventory of cryptographic assets, a migration roadmap and crypto-agility, and they warn of "harvest now, decrypt later" risk to long-lived data. Italy also follows the EU timetable: transition under way by the end of 2026 and high-risk systems migrated by the end of 2030. The Bank of Italy's Milano Hub is a natural entry point. Italian banks, energy operators and public administrations need cryptographic inventory, containment and migration all at once, delivered by a vendor that can respect Italian and European sovereignty requirements. Elisity turns IonQ's Italian proposition from "quantum technology for the future" into "security your teams can deploy this quarter, on a path to quantum safety."
Singapore shows how a leading financial center turns the threat into a program, and how closely that program matches what IonQ now offers. The danger there is not hypothetical: UNC3886 reached Singapore's critical infrastructure and then all four of its major telcos. The Monetary Authority of Singapore (MAS) has worked on both layers of quantum-safe security for two years. In November 2024 it ran a post-quantum experiment with the Banque de France, exchanging signed and encrypted email across continents using the new algorithms, and the two central banks planned a next phase for cross-border payments. In September 2025 MAS published the results of a QKD sandbox with DBS, HSBC, OCBC and UOB. The sandbox found that QKD can secure links such as those between a bank's data centers. It also found that wide adoption needs interoperability between providers and standards for tamper-resistant, auditable trusted nodes. On July 16, 2026, the Cyber Security Agency of Singapore published its Quantum-Safe Migration Handbook. The handbook puts post-quantum cryptography first and treats QKD as a complementary control for high-security point-to-point links. Its milestones for critical-infrastructure owners:
On July 28, MAS announced formal supervisory expectations for this year, built on a cryptographic inventory, a prioritized migration plan, and the capabilities and governance to carry it out. Its stated aim is quantum resilience across the financial sector "before the end of this decade." On August 31, MAS renewed its financial-sector technology grant scheme, FSTI 4.0, with S$220 million over three years and tracks that cover quantum technology. IonQ is already present: ID Quantique supplies the quantum key distribution behind Singtel's national quantum-safe network, and IonQ was a lead investor in the $110 million financing of Singapore-headquartered Horizon Quantum in December 2025. Every element Singapore is asking for maps onto IonQ with Elisity:
With Elisity, IonQ can walk into Singapore's banks, payment operators and critical-infrastructure owners with one supervisory-ready answer.
In South Korea the opportunity is written into law. The amended Quantum Technology Industry Act was approved by the Cabinet on May 12 and takes effect six months after promulgation. It requires the central government, local governments and public institutions to plan and implement quantum security technologies, and it names post-quantum cryptography and quantum key distribution. It also requires impact assessments before quantum projects in space, defense, telecommunications, energy, finance and transportation. The science ministry and KISA, Korea's internet and security agency, are funding a ₩4.5 billion post-quantum pilot transition this year. Korean industry expects the public-sector market to open in the second half of 2027 and the private market from 2029. ID Quantique's quantum random number generator chips already ship in Korean smartphones through SK Telecom. IonQ already holds a Ministry of Science and ICT agreement and a growing partnership with KISTI. Korea's experience with major telecom and financial breaches is a reminder that identity, not only encryption, is where attackers walk in. Elisity closes that gap for a market that is now legally required to buy.
Critical infrastructure is where the stakes are highest and the fit is clearest. Power grids, water systems, hospitals, ports and telecommunications networks are full of connected devices that were never designed to defend themselves, and they are exactly where state actors have chosen to position. U.S. authorities have warned that Chinese state hackers have pre-positioned inside American critical infrastructure. Russian and Chinese attention to European energy, ports and undersea links is well documented, and Korea's new law reaches its public institutions. IonQ's partnership with EPB in Chattanooga, which places quantum technology inside a live utility network, shows the energy sector is already preparing for the quantum era.
Utilities need a way to contain an intruder before it reaches the control systems that keep the lights on. Identity-based segmentation does that. Paired with quantum-safe keys on the links between substations, control centers and data centers, it gives grid and infrastructure operators protection that neither technology could give alone. For governments, this is not an IT upgrade. It is national resilience, and IonQ can now offer it as a single, trusted package.
Switzerland, Italy, Singapore and South Korea tell one story, and they are examples rather than exceptions. Their challenges and needs show why IonQ needed Elisity, and why the combined company now holds a position of global market leadership. Each faces the same Russian, Chinese and North Korean pressure. Each regulator is converging on the same playbook: inventory, contain, migrate and verify. And each wants a trusted vendor that can deliver the whole playbook without handing control of its networks to anyone else. China, meanwhile, is offering the world its own stack: its clouds, its standards, its quantum-secured links.
Before this deal, IonQ could answer the migrate and verify parts better than almost anyone. After it, IonQ can answer all four, through a single relationship that begins with a product the customer needs today. As Niccolo de Masi put it, Elisity "will bring proven enterprise policy enforcement scale and deployment experience to our quantum security strategy and will give IonQ a strong growth platform to serve customers." That is how a quantum company becomes a security platform with worldwide reach, and how quantum revenue stops depending on when a customer is ready to buy a quantum computer. And as Part Two shows, these four countries are far from alone: governments across Europe, the Five Eyes, Asia and the Gulf face the same challenges and are setting the same kinds of deadlines.
How IonQ Will Put Elisity to Work
IonQ is not buying Elisity to leave it alone. The company has said what it will do. It will combine its post-quantum cryptography and quantum key distribution with Elisity's Zero Trust platform, integrate those capabilities with its quantum security products, extend IdentityGraph with cryptographic inventory and risk information, and sell complementary products across both customer bases. Elisity keeps its leadership, including chief executive James Winebrenner, so the product and the customer relationships stay intact while IonQ adds scale behind them.
The groundwork is already in place. In March 2026 IonQ began working with ARLIS, the University of Maryland's Applied Research Laboratory for Intelligence and Security, on a Zero Trust framework for quantum computers under an Air Force-sponsored program. Niccolo de Masi called the shift from perimeter security to Zero Trust "a strategic imperative." In September IonQ signed an $8.18 million deployment with Congruity360 that combines post-quantum cryptography with QKD on ID Quantique's Clavis devices and Solteris appliances. At Investor Day de Masi warned that "replacing long-lived certificates, device identities and other roots of trust can take years." Elisity supplies exactly the device and identity layer he was describing.
"Elisity will give us the ability to not only move faster … but also broaden the customer base and give us a fantastic team that can integrate our product offerings and offer that defense-in-depth strategy to those government and enterprise on both sides of the Atlantic."
Niccolo de Masi, IonQ Chairman and CEO, Bloomberg Open Interest, October 12, 2026
We expect IonQ to move fast, in four steps:
The first step is IonQ's stated plan; the phasing is our expectation. IonQ's record supports it: nine acquisitions since January 2025, each followed by dated products, contracts or leadership roles, and no impairments.
The structure of the deal reflects the same discipline. It is paid entirely in stock, with a price collar between $33.07 and $49.61 per IonQ share. Up to $150 million of the value comes as a contingent earnout, which ties part of the price to Elisity's future performance. Elisity's leadership stays in place, and its owners become IonQ shareholders with a direct stake in the combined company's success. The milestones ahead are concrete: the deal's expected close in the fourth quarter, Korea's mandate taking effect, and the NSA's 2027 CNSA 2.0 milestone. The signals that will show the deal working are joint IonQ– Elisity offers to banks and ministries, cryptographic inventory appearing inside IdentityGraph, and early wins in Korea's mandated public sector. Each of these is within reach in the months ahead.
We believe the market has not yet priced this in. It is the same blind spot our China research exposed: the assessments most officials still rely on describe a Chinese quantum program that Beijing has already moved past. Markets tend to value what they can measure this quarter, and the security consequences of quantum computing build quietly until a mandate, a breach or a deadline makes them impossible to ignore. Those deadlines are now on the calendar: Korea's quantum-security mandate, Singapore's supervisory expectations, the NSA's 2027 CNSA 2.0 milestone, and China's own 2027 target for a global quantum communication service. In our view, Elisity is the piece that lets IonQ turn its quantum leadership into sales across every one of those markets. It is a strategic deal of real importance for IonQ, and we expect its significance to become clearer as each of those dates arrives.
PART TWO · THE WORLD FACES THE SAME DEADLINES
Switzerland, Italy, Singapore and South Korea are not special cases. We searched government and regulatory sources in German, French, Spanish, Dutch, Japanese, Hindi and Tamil, Arabic, Turkish, Malay and Indonesian, Persian, Czech, Swedish, Thai and Vietnamese, as well as English, Russian and Chinese. We found the same challenge, and increasingly the same deadlines, across the developed world and well beyond it. Governments and financial regulators on four continents now set dates by which organizations must inventory their cryptography, protect their most critical systems and finish moving to quantum-safe security. Nearly all of them follow the same sequence that Switzerland, Italy, Singapore and Korea follow: inventory, contain, migrate and verify. That sequence is exactly what IonQ, with Elisity, can now deliver end to end.
The European Union's coordinated roadmap, adopted by the member states in June 2025, says all member states "should start transitioning to PQC by the end of 2026." High-risk use cases are to move "no later than by the end of 2030," and medium- and low-risk migrations are to be completed "as much as feasible" by the end of 2035. The EU warns that "store now, decrypt later" attacks "are already likely occurring." National agencies are setting their own dates on top of that:
Across the Five Eyes the dates are just as concrete:
The G7's Cyber Expert Group has told the financial sector to prioritize its most critical systems in roughly 2030–32, with 2035 as the overall target.
NATO has put the alliance itself on the calendar. Its Quantum Technology Roadmap, approved by Allies on July 30 and summarized publicly on September 29, 2026, lists the adoption and implementation of post-quantum cryptography standards as ongoing work. It sets Q4 2027 for the Quantum Zero Beacon Project, a pilot between NATO headquarters in Brussels and SHAPE in Mons meant "to demonstrate and validate a practical pathway for NATO's transition to quantum-resilient communications." This is the alliance's own answer to the Moscow–Beijing quantum partnership described in Part One, and it creates demand for exactly the kind of in-alliance stack IonQ now offers.
Q4 2027 | NATO The Quantum Zero Beacon Project will pilot quantum-resilient communications between NATO headquarters in Brussels and SHAPE in Mons. |
Japan's government aims, "in principle," to move its agencies to post-quantum cryptography by 2035, with a national roadmap due in fiscal 2026. Its Financial Services Agency wants banks' high-priority systems ready by the mid-2030s. Japan is also building a roughly 600-kilometer quantum key distribution network linking Tokyo, Nagoya and Osaka for medical, financial and power-sector users. India's National Quantum Mission published a roadmap in May 2026 with the tightest timetable we found for critical infrastructure. It names "Harvest Now, Decrypt Later" as a critical risk, and it notes that China has not disclosed a migration timeline of its own.
Two of Asia's financial centers set dates this summer. The Hong Kong Monetary Authority launched a Quantum Preparedness Index on July 27, 2026, with the aim of "full sectoral readiness (a QPI score of 10) by 2030." The banking sector's initial score was 2.3 out of 10, which shows how much work, and buying, remains. Taiwan's Financial Supervisory Commission issued a post-quantum migration guideline for the financial sector on June 18, 2026. It sets governance, inventory and crypto-agility for 2026–2027, pilots and joint testing for 2027–2029, and migration of high-risk and mission-critical systems by 2035.
2.3 / 10 | HONG KONG BANKS The banking sector's starting score on the HKMA's Quantum Preparedness Index. The target is 10, full readiness, by 2030. |
Southeast Asia is moving too:
Vietnam has also put money behind the effort: Decision 1226/QĐ-TTg sets up a civil cryptography program for 2026–2030, with an outlook to 2035, that includes three to five national key laboratories for applied and post-quantum cryptography.
New Zealand has not set a date. Its Information Security Manual tells agencies to inventory their cryptography, flag quantum-vulnerable systems and set priorities now, and to prepare to move off classical algorithms "possibly in the next 2-3 years," although no post-quantum systems are yet approved for use. The direction is set even where the calendar is not.
The Gulf is moving quickly, and it is moving through its financial regulators and cyber authorities.
Latin America and Central Asia are starting
Brazil has begun at the root of trust. Under Normative Instruction 35 of January 30, 2026, the National Institute of Information Technology (ITI) is moving ICP-Brasil, the national digital-certificate system, and the Gov.br digital signature, which handles more than a million signatures a day, to post-quantum algorithms. Kazakhstan's digital ministry and security experts met in Astana in May 2026 to assess the country's readiness for the new algorithms. Neither has set a migration deadline, but both are moving, and both start with the certificate and identity layer.
China and Russia are writing their own standards
Beijing and Moscow are not waiting for NIST. China's Institute of Commercial Cryptography Standards launched a Next-generation Commercial Cryptographic Algorithms Program on February 5, 2025, with post-quantum public-key algorithms as a focus. Submissions closed on June 30, 2026, and evaluation rounds follow. In Russia, the TC 26 standards committee is developing domestic post-quantum schemes such as the Shipovnik signature, which remain candidates rather than adopted national standards. Separate standards mean separate ecosystems. Every government that does not want its keys tied to Chinese or Russian algorithms will want a trusted supplier that follows NIST and allied standards, and IonQ is one.
The countries and their deadlines
Country or bloc | Authority and document | Key milestones | Public IonQ / ID Quantique footprint | Regional market pool, est. 2030 |
United States | Executive Order 14412 (June 2026); OMB M-26-15 (June 2026); NSA CNSA 2.0 | Agency plans Oct. 22, 2026; 2027: CNSA 2.0 support for national security systems; end-2030 PQC key establishment for high-value systems; end-2031 signatures | Headquarters; EPB network; IonQ Federal; SkyWater Trusted Foundry | U.S.: $17–31B |
Canada | Cyber Centre ITSM.40.001; Treasury Board notice | Plans April 2026; high-priority end-2031; all systems end-2035 | CMC Microsystems agreement (2026) | Rest of world†: $7–13B |
United Kingdom | NCSC migration timelines | Discovery and plan 2028; priority migration 2031; complete 2035 | Oxford Ionics, IonQ's UK base | W. Europe: $8–14B |
European Union | Coordinated Implementation Roadmap (June 2025) | Start end-2026; high-risk end-2030; others by 2035 as feasible | ID Quantique national networks in Romania and Slovakia; Poland | W. Europe: $8–14B |
Germany | BSI TR-02102 (2026) | Classified sensitive data 2030; classical public-key encryption alone ends 2031; signatures 2035 | — | W. Europe: $8–14B |
France | ANSSI | No certification without PQC from 2027; stop buying non-PQC products from 2030 | — | W. Europe: $8–14B |
Netherlands | Government-wide quantum strategy (Oct. 2026) | High-risk end-2030; medium-risk end-2035 | — | W. Europe: $8–14B |
Spain | EU roadmap; Quantum Technologies Strategy 2025– 2030 | EU dates; EuroQCI-Spain national phase complete (June 2026) | — | W. Europe: $8–14B |
Sweden | NCSC recommendations (May 2026) | Long-lived sensitive data 2030; all by end-2035 | — | W. Europe: $8–14B |
Poland | Cybersecurity Strategy 2025– 2029 (March 2026) | PQC migration plan; EU dates | ID Quantique national network | Rest of world†: $7–13B |
Lithuania | Ministry of National Defence working group (2025) | National transition plan Q3 2026; EU dates | — | Rest of world†: $7–13B |
Czech Republic | NÚKIB cryptographic requirements v2.0 (Feb. 2025) | Critical-level key establishment end-2030 | — | Rest of world†: $7–13B |
Switzerland | NCSC Switzerland (Dec. 2025 brief); FINMA Guidance 05/2026 | Post-quantum-first; financial institutions' PQC roadmaps by mid-2027 | ID Quantique headquarters; national network | W. Europe: $8–14B |
Italy | ACN cryptography guidelines; national quantum strategy | EU dates; inventory, migration roadmap and crypto-agility | IonQ Italia | W. Europe: $8–14B |
NATO | Quantum Technology Roadmap (Sept. 2026) | PQC standards adoption ongoing; Quantum Zero Beacon pilot, NATO HQ–SHAPE, Q4 2027 | — | Spans regions |
Singapore | CSA Quantum-Safe Migration Handbook; MAS | CII plans March 2027; quantum-safe-ready buying 2028; CII complete 2031; financial sector "before the end of this decade" | ID Quantique behind Singtel's network; Horizon Quantum investment | Asia-Pacific*: $3–5B |
South Korea | Amended Quantum Technology Industry Act (Cabinet, May 2026) | Quantum security (PQC, QKD) compulsory for government and public institutions, effective six months after promulgation; impact assessments in six sectors | MSIT agreement; KISTI partnership; ID Quantique QRNG chips in SK Telecom phones | Asia-Pacific*: $3–5B |
Hong Kong | HKMA Quantum Preparedness Index (July 2026) | Banking sector full readiness by 2030; starting score 2.3 of 10 | — | Asia-Pacific*: $3–5B |
Taiwan | FSC financial-sector PQC guideline (June 2026) | Inventory 2026–27; pilots 2027–29; high-risk systems by 2035 | — | Asia-Pacific*: $3–5B |
Japan | Cabinet Secretariat interim summary (Nov. 2025); FSA | Roadmap FY2026; government agencies by 2035; banks' priority systems mid-2030s | Toyota Tsusho distributor partnership; AIST agreement | Rest of world†: $7–13B |
India | DST National Quantum Mission roadmap (May 2026) | Critical infrastructure 2027/2028/2029; enterprises 2028/2030/2033 | — | Asia-Pacific*: $3–5B |
Australia | ASD Information Security Manual | Plan 2026; begin 2028; cease traditional public-key crypto 2030 | — | Asia-Pacific*: $3–5B |
New Zealand | NZISM | Inventory and prioritize now; no date set | — | Asia-Pacific*: $3–5B |
Thailand | NCSA draft framework 2026– 2035 | Inventory 2026–27; hybrid trials 2027–30; critical systems 2030–35 | — | Asia-Pacific*: $3–5B |
Vietnam | Decision 1226/QĐ-TTg; proposed roadmap (July 2026) | PQC research labs and inventory, risk assessment and testing, 2026–2030 (roadmap proposed) | — | Asia-Pacific*: $3–5B |
Brunei | National PQC Migration Framework (July 2026) | Deprecate RSA/ECC 2030; complete 2035 | — | Asia-Pacific*: $3–5B |
Malaysia | NACSA; MyKriptografi Action Plan 2026–2030 | National migration plan and sandbox | — | Asia-Pacific*: $3–5B |
Indonesia | BSSN task force (Aug. 2026) | National migration roadmap in drafting | — | Asia-Pacific*: $3–5B |
Saudi Arabia | SAMA circular (Aug. 2026); NCA standards | Bank crypto inventory end-2026; risk assessment March 31, 2027 | — | Middle East‡: $0.6–1.1B |
United Arab Emirates | National Encryption Policy (Nov. 2025) | Approved PQC transition plans for government entities | IonQ–Technology Innovation Institute partnership | Middle East‡: $0.6–1.1B |
Qatar | HBKU, Ooredoo, Ministry of Defence | First quantum-safe link (June 2026) | Developed in collaboration with ID Quantique | Middle East‡: $0.6–1.1B |
Bahrain | National Cyber Security Center (Dec. 2025) | Government-wide PQC program across 60+ ministry environments | — | Middle East‡: $0.6–1.1B |
Jordan | Central Bank of Jordan (Jan. 2026) | Sector roadmap from inventory to full migration | — | Middle East‡: $0.6–1.1B |
Israel | Bank of Israel supervisory letter (Jan. 2025) | Bank preparedness plans and encrypted-asset mapping within one year | — | Rest of world†: $7–13B |
Türkiye | Turkcell | Intercontinental QKD trial over fiber (2025) | ID Quantique | Rest of world†: $7–13B |
G7 financial sector | G7 Cyber Expert Group (Jan. 2026) | Critical systems about 2030–32; 2035 overall | — | Spans regions |
Brazil | ITI Normative Instruction 35 (Jan. 2026) | National certificate system and Gov.br signatures moving to PQC algorithms | — | Rest of world†: $7–13B |
Kazakhstan | Digital ministry readiness review (May 2026) | Readiness assessment; no date | — | Rest of world†: $7–13B |
China | ICCS next-generation algorithms program (Feb. 2025) | Own post-quantum algorithms; submissions closed June 2026 | — | Largely closed to Western vendors |
Russia | TC 26 (Rosstandart) | Domestic post-quantum candidates (e.g., Shipovnik) | — | Closed to Western vendors |
* IDC's Asia-Pacific excluding Japan and China; Hong Kong's and Taiwan's placement in IDC's regions may differ. † Japan, Canada, China, Central and Eastern Europe, Israel, Türkiye, Africa and Latin America. ‡ Part of the rest-of-world pool, sized by Gartner's Middle East and North Africa share of security spending. Each pool is our estimate of a 2030 global quantum-safe market of $36–65 billion split by the region's 2026 share of security spending; countries share their region's pool.
How large each region's market could be
Country-level security spending data are too thin to size each country honestly, so we split our 2030 estimate of the quantum-safe migration market, $36–65 billion (Part Four), by each region's share of 2026 security spending as reported by IDC. These are our estimates, not forecasts.
Region | 2026 security spending (IDC) | Share | Est. 2030 quantum-safe market |
United States | $150 billion | 49% | $17–31 billion |
Western Europe | $69 billion | 22% | $8–14 billion |
Asia-Pacific excluding Japan and China | $26 billion | 8% | $3–5 billion |
Rest of world | $63 billion | 20% | $7–13 billion |
of which Middle East and North Africa | About $4 billion (Gartner) | About 1.6% | $0.6–1.1 billion |
World | $308 billion | 100% | $36–65 billion |
$17–31B | U.S. MARKET POOL Our estimate of the 2030 U.S. share of the quantum-safe market, on the U.S.'s 49 percent of world security spending. |
The two official anchors fit. OMB's $7.1 billion for priority federal civilian systems is spread over 2025–2035, about $0.65 billion a year. That is a small slice of a U.S. pool of $17–31 billion that also covers defense, state governments and the entire private sector. Korea's industry estimate of about $1.7 billion to replace its financial sector's cryptography, spread over the years to 2035, is roughly $0.2 billion a year, which fits within an Asia-Pacific pool of $3–5 billion shared with Singapore, India, Australia and the rest of the region. If anything, apportioning by today's spending understates Asia, where India, Singapore and Korea have some of the tightest deadlines.
What the global pattern means for IonQ
Three lessons stand out, and each one strengthens the case for the acquisition.
Read as a calendar, these deadlines become a buying sequence. Spending starts with inventory and containment in 2026– 2027, moves to priority migration from 2027 to 2031, and ends with completion and verification by 2035. IonQ with Elisity has a lead offer for each window, and the first window, now under way, belongs to the layer Elisity sells.
No other quantum company we have identified can bring the full sequence: inventory and segmentation, post-quantum cryptography, quantum key distribution, quantum randomness, quantum networking and trusted U.S. manufacturing. IonQ also brings a footprint that already spans the United States, Europe, the Gulf and Asia. That is what global market leadership looks like in quantum-era security.
Many countries have not yet set dates. We found no official migration deadline in Spanish-speaking Latin America, Brazil, Egypt, Pakistan, Bangladesh, the Philippines, Oman or Kuwait, nor national dates in Norway, Finland, Denmark, Poland or Ukraine beyond the EU and NATO frameworks that apply to several of them. Iran's discussion is academic. These markets are likely to follow the path of the countries above as standards mature and regulators act. When they do, the same sequence will apply. IonQ, with Elisity, will already be the company that has delivered it elsewhere.
PART THREE · FROM ONE HOSPITAL NETWORK TO SIX MORE ECOSYSTEMS
St. Luke's University Health Network is a good example of how this deal expands IonQ's reach. Fifteen hospitals, 85,000 devices, segmented in 46 days. It shows what Elisity does today, and it opens a sector IonQ has not sold security into before. Our coverage has long tracked IonQ's work in life sciences, energy, finance, government and telecommunications. Healthcare is where those threads meet, and it is the clearest place to see how one Elisity customer leads to the next ecosystem.
46 days | ST. LUKE'S Fifteen hospitals and 85,000 devices fully segmented with zero outages and no new hardware. |
Healthcare: the new revenue ecosystem
Healthcare is the most attacked, most expensive and most device-dense sector in security.
Regulation is moving toward exactly what IonQ and Elisity sell.
What IonQ can now sell into a hospital system. Elisity is the entry point: segmentation of every clinical device and user, now. Behind it come post-quantum cryptography for records that must stay confidential for a lifetime, and ID Quantique's QKD and quantum random number generators for links between data centers. On the research side, IonQ's existing life sciences work is relevant:
Before this deal, IonQ had no public hospital or health-system security footprint. Elisity's customers give it one immediately. The forecasts for this market are large but dated: one firm projected healthcare cybersecurity at $92 billion by 2032 and medical device security at $17.5 billion. They point the same way as everything above.
How healthcare correlates to six more ecosystems
Every ecosystem around healthcare has the same core problem: networks full of connected devices and identities, and attackers who get in once and move sideways. Each connection below is already visible in Elisity's customer list or IonQ's existing business.
Ecosystem | How it connects to healthcare | Verified proof point | Where IonQ and Elisity already stand |
Pharma and biomanufacturing | Hospitals and drug makers share patient data, trials and supply chains | The DOJ charged a hacker allegedly directed by China's Ministry of State Security with targeting U.S. COVID-19 vaccine researchers (July 2025) | GSK, Haleon and Andelyn Biosciences are Elisity customers; IonQ's drug-development work with AstraZeneca, AWS and NVIDIA. The same company can buy quantum chemistry and quantum-safe security for its intellectual property. |
Energy and utilities | Hospitals cannot run without power; utilities face the same industrial-device problem | CISA warned that Volt Typhoon pre-positioned on IT networks to move laterally to OT, holding some footholds for at least five years. FERC Order 907 now requires monitoring of "east-west (i.e., lateral) network traffic" for high-impact grid systems (effective Sept. 2025). | EPB partnership in Chattanooga; Elisity supports Hirschmann industrial switches and maps to NERC CIP; Chevron Technology Ventures is an Elisity investor |
Manufacturing | Medical devices, drugs and supplies are manufactured on OT networks | Manufacturing took 27.7 percent of all attacks in 2025, the most of any industry for the fifth straight year (IBM X-Force) | Shaw Industries (27 sites) and a 53-site electronics manufacturer are Elisity customers; SkyWater gives IonQ its own manufacturing base |
Financial services | Healthcare runs on payment and claims networks; Change Healthcare was a payments clearinghouse | Treasury launched a Quantum-Readiness Task Force with a "third-party and vendor readiness" workstream (Aug. 2026); MAS, SAMA and FINMA deadlines (Part Two) | ID Quantique's work with banks; MAS sandbox banks; the Congruity360 QKD deal |
Government and defense | HHS is the lead federal agency for the health sector | EO 14412 requires sector agencies to "assist critical infrastructure owners and operators in developing their PQC migration plans" (June 2026) | IonQ Federal; Vector Atomic's DARPA clocks; Capella's NRO contract; SkyWater's Trusted Foundry |
Telecom carriers | Hospitals' networks run over carrier infrastructure | The FBI said Salt Typhoon hacked at least 200 U.S. companies, with victims in 80 countries (Aug. 2025) | Quantum-safe work with Singtel, SK Telecom, Turkcell and Ooredoo through ID Quantique |
Why the correlation matters commercially. Each ecosystem raises the value of the others, because the same platform serves all of them. A hospital system that segments with Elisity becomes a reference for the drug maker it works with. That drug maker may already be talking to IonQ about quantum chemistry. The utility that powers the hospital faces the same lateral-movement rule from FERC. The bank that processes the hospital's claims answers to the Treasury task force and the G7 timetable. And the carrier that connects them all is already an ID Quantique partner. One customer becomes many introductions. Before this deal, IonQ's security business reached these ecosystems mainly through national networks and carriers. After it, IonQ enters through the front door of every regulated organization with a network of connected devices. We believe that is the most important commercial consequence of the acquisition, and the one the market has least appreciated.
PART FOUR · ANSWERING THE SKEPTICS: THE FINANCIAL CASE
On the day IonQ announced the deal, its shares fell more than 9 percent. One widely shared critique put the case against it plainly: "$1.3B worth of $IONQ stock for a little known security firm doing tens of millions of revenue," in a deal that "seems counterproductive to the goal of digesting previous acquisitions." We take that seriously and answer it on the numbers. The critique values Elisity as a stand-alone security company. That is the wrong frame. The right questions are how large a market this deal opens, how well IonQ is placed to win it, and what the deal does to the value of everything else IonQ sells in security. On all three, the answer favors IonQ.
The market IonQ can now sell into is more than three times larger than before, and the quantum-safe market around it is larger still. Before the deal, IonQ's security business sold mainly into the quantum-specific markets: post-quantum cryptography and quantum key distribution. Elisity adds the control layer, microsegmentation and network access control, which is already a large part of enterprise security spending. Around that core sits the rest of what every migration deadline forces organizations to buy: the public-key infrastructure and certificates that must be reissued with new algorithms, and the services firms that do the work. The forecasts below come from different research firms and partly overlap, so we show ranges and deduct overlap.
$36–65B | QUANTUM-SAFE MARKET, 2030 The market around IonQ's offer by 2030, after deducting overlap; about $94–161 billion by 2035. |
Tier | Market | Forecast | Source |
Quantum-specific (before the deal) | Post-quantum cryptography | $2.8B to about $7.9B by 2030; $13B by 2035 to $30B by 2034 | MarketsandMarkets; Grand View Research (2030 implied by its 37.8% growth rate); Juniper Research; Precedence Research |
| Quantum key distribution | $0.5B (2024) to $2.6B (2030) | MarketsandMarkets |
| Subtotal | About $5–11B by 2030 |
|
Control layer (added by Elisity) | Microsegmentation | $12.5B to $16.2B by 2030 | Exactitude, cited by Insight Partners; Market Glass |
| Network access control | $17.1B by 2030; $48.8B by 2035 | Grand View Research; SNS Insider |
| Core directly addressable market after the deal | About $18B to $44B by 2030, more than three times the quantum-specific market. The low end uses the lowest PQC forecast and assumes network access control fully overlaps microsegmentation. |
|
Migration layer (what every deadline forces) | Public-key infrastructure and certificates | $13.6B to $19.7B by 2030; $28.5B by 2034 | The Business Research Company; Grand View Research; Global Market Insights |
| Post-quantum migration services | $2.3B (2026) to $55B (2036); about $8B in 2030 on its 37.4% growth rate | Fact.MR |
| Quantum-safe migration market | About $36–65B by 2030 and $94–161B by 2035, after deducting about 10 percent for overlapping definitions | Friends of IonQ calculation |
Adjacent (where IdentityGraph already plays) | Identity and access management | $26.0B (2025) to $42.6B (2030) | MarketsandMarkets |
| Operational technology security | $23.5B (2025) to $50.3B (2030) | MarketsandMarkets |
Umbrella | Zero Trust security | $36.5B (2024) to $78.7B (2029) | MarketsandMarkets |
| All information security spending | $244B in 2026, up 13% | Gartner |
Long-range | Quantum communication | $1.2B (2024) to $10.5–14.9B (2035) | McKinsey Quantum Technology Monitor |
How we built the ranges. The low case takes the lowest available forecast in each segment: MarketsandMarkets' $2.8 billion for post-quantum cryptography, Exactitude's $12.5 billion for microsegmentation and The Business Research Company's $13.6 billion for public-key infrastructure. It counts network access control as entirely overlapping microsegmentation. The high case takes Grand View Research's post-quantum forecast ($2.2 billion in 2026 growing 37.8 percent a year, about $7.9 billion in 2030), Market Glass's $16.2 billion for microsegmentation, and Grand View's $17.1 billion for network access control and $19.7 billion for public-key infrastructure. Both cases include Fact.MR's migration-services forecast, about $8.2 billion in 2030 on its stated growth rate, and both deduct about 10 percent for products and services counted in more than one forecast. The 2035 view uses Juniper ($13 billion) and Precedence Research ($30 billion, for 2034) for post-quantum cryptography, McKinsey's $10.5–14.9 billion for quantum communication, Global Market Insights' $28.5 billion (2034) for public-key infrastructure, about $40 billion of migration services, and in the high case SNS Insider's $48.8 billion for network access control. It holds microsegmentation at its 2030 level, which understates it. We also leave out hardware security modules, which need new algorithms too, so the totals are conservative on that count.
Why the wider market matters to IonQ. IonQ does not sell certificates or consulting today, and we do not count that market as directly addressable. It matters for two reasons. The inventory step that opens every migration project, and that decides where the certificate and services money goes, is the step Elisity's IdentityGraph roadmap is built to own. And the keys being replaced across that market are exactly what IonQ's post-quantum, QKD and quantum-randomness products supply.
Four forces make this market grow, and each one plays to IonQ.
82 : 1 | MACHINE IDENTITIES CyberArk found 82 machine identities for every human. Each must be governed, which is IdentityGraph's core job. |
What Governments Say the Migration Will Cost
Only one government has priced the job, and almost none has budgeted for it. That gap is itself a market signal. We searched for official cost estimates in English, French, German, Dutch, Japanese, Korean, Russian and Chinese.
$7.1B | OMB ESTIMATE The cost of migrating priority U.S. federal civilian systems, 2025–2035. No other government has published a full estimate. |
Singapore's S$100 million quantum and AI program fund quantum work broadly, not migration.
The pattern is consistent. Deadlines have been set, inventories are being ordered, and budgets have not caught up. The one complete estimate, $7.1 billion for one government's civilian priority systems, sits beside an industry figure of about $1.7 billion for one mid-sized country's banks. Together they suggest the worldwide bill for governments and regulated industries will run to many tens of billions of dollars. That is our inference, and most of that money has not yet been appropriated. As budgets catch up with the deadlines in Part Two, the spending will flow first to the step every program starts with, the cryptographic inventory and containment layer that Elisity provides. It will then flow to the post-quantum and QKD products IonQ already sells.
The stakes explain why budgets will follow. A 2023 Hudson Institute study estimated that a quantum-enabled attack on Fedwire, the Federal Reserve's payment system, would cut U.S. GDP by 10 to 17 percent. It put indirect losses at $2 trillion to $3.3 trillion. When the downside is measured in trillions, spending of tens of billions on protection is modest, and regulators are now writing that spending into rules.
What capturing a share of this market would mean for IonQ. IonQ reported $130 million in revenue in 2025 and guides to $450–460 million in 2026. Against that base, even small shares of the core market are transformative. At 1 percent of the $18–44 billion core market, the business would bring in about $180–440 million a year, roughly 40 to 97 percent of IonQ's entire 2026 guidance. At 3 percent it would be about $540 million to $1.3 billion, and at 5 percent about $900 million to $2.2 billion. A 1 percent share of the wider $36–65 billion quantum-safe market would be about $360–650 million. If IonQ held one-fifth of McKinsey's 2035 forecast for quantum communication, that alone would be about $2.1–3.0 billion a year.
Share of the market (2030) | Low case | High case | Versus IonQ's 2026 guidance (~$455M) |
0.5 percent of the $18–44B core | About $90 million | About $220 million | 0.2–0.5 times |
1 percent of the core | About $180 million | About $440 million | 0.4–1.0 times |
2 percent of the core | About $360 million | About $880 million | 0.8–1.9 times |
3 percent of the core | About $540 million | About $1.3 billion | 1.2–2.9 times |
5 percent of the core | About $900 million | About $2.2 billion | 2.0–4.8 times |
1 percent of the $36–65B quantum-safe market | About $360 million | About $650 million | 0.8–1.4 times |
One-fifth of McKinsey's 2035 quantum communication market | About $2.1–3.0 billion |
| 4.6–6.6 times |
Why a range, not a single number. Network access control decides which devices may join a network, and microsegmentation decides what they may reach once inside. The two are converging, and Elisity competes for both budgets: its customers replaced tools such as Forescout and planned Cisco ISE rollouts. Adding the two forecasts would double-count. The low case therefore counts only microsegmentation, and the high case assumes no overlap. The true serviceable market lies in between. Elisity's direct displacement opportunity is the share of network access control spending that moves to identity-based segmentation. The more useful way to read it is in layers:
These figures are not forecasts. They show why security and networking could, within a few years, rival IonQ's quantum computers as a source of revenue. That revenue does not have to wait for fault-tolerant quantum computing, because it is driven by deadlines governments have already set.
2. Why IonQ Is Positioned to Win
IonQ is the only company we have found with assets at every layer of quantum-era security, from the silicon to the policy engine. Each item below is public:
$286M | R&D, FIRST HALF 2026 IonQ's R&D spending, more than twice the $133 million Rigetti, D-Wave, Quantum Computing Inc. and Infleqtion spent combined. |
No commercial rival matches the combination. The closest comparable stack belongs to a state, not a company.
| Quantum computing | Trusted chip foundry | QRNG in mass-market devices | National QKD networks | Satellite and optical links | PQC | Identity Zero Trust / segmentation |
IonQ + Elisity | Yes | Yes (SkyWater) | Yes (Samsung) | Yes (Romania, Switzerland, Poland, Slovakia, Singapore) | Yes | Yes | Yes |
IBM | Yes | No | No | No | No | Yes | Identity tools, no segmentation |
Quantinuum | Yes | No | No | No | No | Partial | No |
Toshiba | No | No | No | Yes | No | Limited | No |
Palo Alto, Cisco, Zscaler | No | No | No | No | No | Yes | Yes |
China's state stack (China Telecom, QuantumCTek, CETC) | Yes | State fabs | Quantum SIM | Yes, 25+ cities, 7.2 million users | Next satellites in procurement | Own standards | Domestic |
Scoring the comparison makes the gap plain. We scored each company across six layers: quantum computing, QKD, quantum random number generation, post-quantum cryptography, identity-based Zero Trust and quantum networking with satellites. A full capability scores 2, a partial, limited or research-only capability scores 1, and none scores 0, for a maximum of 12.
12 / 12 | CAPABILITY SCORE IonQ with Elisity covers all six layers. On equal weights, no commercial rival reaches 7. |
The shapes below show why. Each rival is strong on one side of the stack: quantum computing, QKD networks, or enterprise Zero Trust. Only IonQ with Elisity fills the whole outline. The scores are our own simple count, and a buyer would weigh the layers differently. But on any weighting, no rival covers all six.
Our scoring rubric. "Yes" means a generally available commercial product or service sold today. "Partial" means limited, research-stage or adjacent tooling, such as identity products without segmentation. "No" means nothing found in the company's public portfolio. Equal weights are only one view. A CISO might weight post-quantum cryptography and Zero Trust most heavily, and a quantum buyer might weight computing and networking. We tested both:
Company | Equal weights (max 12) | Security-buyer weights (max 15) | Quantum-first weights (max 15) |
IonQ + Elisity | 12 (100%) | 15 (100%) | 15 (100%) |
Cisco | 5 (42%) | 9 (60%) | 4.5 (30%) |
IBM | 6 (50%) | 8 (53%) | 8 (53%) |
Palo Alto Networks | 4 (33%) | 8 (53%) | 3 (20%) |
Toshiba | 6 (50%) | 7 (47%) | 8 (53%) |
Quantinuum | 5 (42%) | 5 (33%) | 7 (47%) |
Rigetti, D-Wave | 2 (17%) | 1 (7%) | 4 (27%) |
The security-buyer weights are quantum computing 0.5, PQC and Zero Trust 2 each, and the rest 1. The quantum-first weights are quantum computing 2, QKD and networking 1.5 each, Zero Trust 0.5, and the rest 1. Under every weighting, the best rival reaches about 60 percent of IonQ's score. The gap is structural, not an artifact of the scoring.
The last row of the capability table, China's state stack, makes the point. The only other entity assembling everything from quantum computers to quantum-secured networks to satellites is the Chinese state, which is now offering its stack abroad. Russia is doing the same at home: in June, Russian Railways opened its 7,858-kilometer quantum network, which runs through 206 trusted nodes, to commercial customers. For allied governments and companies, the choice is between a trusted, in-alliance provider and an adversary's carrier. With Elisity, IonQ is the only commercial provider of the complete stack we have identified.
In the end, this is a question of sovereignty and standards, not only of capability. Allied governments and critical-infrastructure operators want an option they can trust: U.S. Trusted Foundry silicon, NIST and CNSA 2.0 post-quantum algorithms rather than Chinese or Russian ones, quantum networks run by the nations that own them, and identity control that stays in the customer's hands. That is what IonQ with Elisity offers, and it is what a state carrier offering its own algorithms and its own trusted nodes cannot.
IonQ can reach this market through three channels at once:
Post-quantum encryption is becoming free, so the value is moving to the control point. The standard post-quantum algorithm, ML-KEM (FIPS 203), is a public NIST standard anyone can implement. Chrome, Edge and Firefox now enable post-quantum key exchange by default, and Cloudflare reported that more than half of the human-initiated traffic crossing its network was already post-quantum protected by October 2025. The algorithm is turning into a feature built into browsers, operating systems and firewalls. In quantum-era security, value is moving to the control point: knowing where vulnerable cryptography sits, deciding who may reach it, enforcing that across the network and proving it to a regulator. That is IdentityGraph. Without it, IonQ's quantum products risked becoming components in someone else's platform. With it, IonQ owns the layer where buying decisions are made.
Why the new algorithms cannot simply be switched on. Post-quantum key exchanges are larger than today's. An IETF draft published in July 2026 notes that they enlarge the TLS handshake. That "can increase the likelihood of fragmentation" and "may expose interoperability problems in deployments involving legacy network devices, middleboxes," while raising costs for constrained endpoints. In a hospital or a factory full of devices that cannot be upgraded, migration will be uneven for years. That is where the combined company acts as a crypto-agility engine:
IonQ has described the inventory roadmap. The rest of this sequence is our reading of how the pieces fit.
A hardware-to-policy chain of trust. SkyWater is a DMEA-accredited Category 1A Trusted Foundry, ID Quantique's quantum random number generator chips already ship in phones, and Elisity assigns identity and policy across the network. Together they make possible a chain that runs from trusted U.S. silicon and quantum-random keys up to the policy that decides who may reach what. No rival can manufacture such a chain from end to end. This is our assessment of an opportunity; IonQ has not announced such a product.
What about the hyperscalers? Amazon, Microsoft and Google offer quantum computers through their clouds, are building quantum hardware of their own, and ship post-quantum algorithms in their software. None sells QKD hardware, runs national quantum-key networks, makes quantum random number chips for phones or owns a Trusted Foundry. None enforces segmentation on the switches inside a customer's hospital or plant the way Elisity does. They are channels and partners as much as rivals; Elisity already integrates with Microsoft's identity and Defender tools.
The big platforms were already buying this layer. Palo Alto Networks paid about $25 billion for CyberArk, saying identity has become the primary attack path. ServiceNow paid $7.75 billion in cash for Armis, about 23 times its recurring revenue. Zscaler bought Airgap Networks for its "agentless, identity-based approach to network segmentation," Elisity's own category. Google agreed to pay about $32 billion for Wiz, roughly 45 to 65 times its recurring revenue. Had a platform bought Elisity, IonQ would have been left supplying parts to a rival's stack. Instead, it secured one of the leading independents.
Revenue flows in both directions. Elisity brings more than 100 deployments, a growing Fortune 500 roster and customers in healthcare, manufacturing and critical infrastructure. All of them face post-quantum migration and are natural buyers of IonQ's products. De Masi put it plainly on the day of the deal: Elisity "brings us 100 new customers and a channel for … carrying our products into the enterprise, as well as a number of government partners." IonQ brings sovereign relationships Elisity could never have reached alone:
Who Elisity Is: The Evidence Behind the Price
Elisity is not "little known" to the people who buy and evaluate network security. Its founders, Burjiz Pithawala, Sundher Narayan and Srinivas Sardar, came from Cisco. Its chief executive, James Winebrenner, previously led go-to-market at Viptela, the software-defined networking company Cisco acquired. Its backers are serious security investors:
Chevron's venture arm is notable because its parent runs some of the world's largest industrial control networks.
Analysts and outside judges have placed it among the leaders in its category:
Its customers are exactly the regulated, device-heavy organizations that post-quantum mandates reach first.
Customer | Sector | Scale | Reported result |
St. Luke's University Health Network | Health system, 15 hospitals | 85,000 devices, 23,000+ users, 350+ practices | Fully segmented in 46 days with zero outages and no new hardware |
MultiCare Health System | Health system, 13 hospitals, 350+ clinics | 40,000+ connected devices | Run by two full-time staff; 80 percent of supported sites done in the first year; 2026 CSO Award |
Main Line Health | Health system, Pennsylvania | Hospitals and practices across the system | Integrated with Armis on existing Cisco switches; 2024 CSO Award |
Unnamed top-10 U.S. health system | Health system, 800+ hospitals | Hundreds of clinics | Forecast spend cut from $38 million to $9 million versus the prior plan |
GSK | Global biopharma | 275 sites | Rollout from about one year per site to three or four sites per week; project cost cut from $200 million to $50 million; 2023 CSO50 Award |
Haleon | Consumer health | Global operations | CISO cites the ability "to scale policy deployment across the business" |
Andelyn Biosciences | Cell and gene therapy manufacturing | 2,700+ policies within weeks | "We made it further in the first two days of the POC than we did in the first two years" with a prior vendor |
Shaw Industries | Manufacturing | 27 sites | First two sites deployed in under an hour, per Elisity |
Unnamed industrial electronics manufacturer | Manufacturing | 53 facilities | More than $18.5 million in capital costs avoided |
The operating record is consistent across customers. In January 2025, Elisity reported an average of 14 days from deployment to the first enforced policy. It said more than 83 percent of its Fortune 500 customers had enforced critical policies across their entire infrastructure within 90 days. IonQ, which has seen the books, says Elisity has more than 100 deployments, revenue and customers doubling year over year, zero churn among deployed customers and "significant recurring revenue."
100+ | ELISITY TODAY Deployments worldwide, with revenue and customers doubling year over year and zero churn among deployed customers, according to IonQ. |
The product is built for where the market is going.
A note on sources: customer metrics come from Elisity's case studies and releases, and analyst placements are as Elisity reported them. Elisity's website identifies MultiCare's CISO, whose quote appears in its release, as a paid advisor to the company. The CSO, CSO50 and Deloitte recognitions come from independent bodies. Readers should weigh the vendor-reported figures accordingly. The pattern across nine organizations in four sectors is nonetheless hard to dismiss.
How Elisity Compares With Its Direct Rivals
Elisity competes in a crowded field, and it wins on a specific, defensible edge. The table compares how each rival enforces segmentation and where it fits.
Vendor | Enforcement model | Agent needed? | Unmanaged IoT, OT and medical devices | Cloud and Kubernetes | QKD, QRNG and quantum networks behind it |
Elisity (with IonQ) | Identity-based policy on existing switches | No | Native | Limited | Yes |
Illumio | Host agent, plus agentless visibility | Yes (primary) | Limited, monitoring-focused | Yes | No |
Akamai Guardicore | Host agent; agentless for some cloud services | Yes (primary) | Limited | Yes | No |
Cisco Secure Workload | Agent using operating-system firewalls | Yes | Limited | Yes | No |
ColorTokens | Agent, agentless and cloud-native options | Optional | Yes | Yes | No |
Zero Networks | Agentless network rules plus multifactor checks | No | Via network rules | Yes | No |
Zscaler | Host agent; acquired Airgap's agentless technology (2024) | Mostly | Limited | Yes | No |
Forescout | Agentless network access control | No | Yes | Not its focus | No |
Ordr | Agentless device visibility; enforces through firewalls and NAC | No | Yes, strong in medical | Not its focus | No |
Sources: Elisity's vendor comparison (updated August 2026) for most rows; vendor documentation and our reading for Zscaler's Airgap, Forescout and Ordr. Vendor-published comparisons favor their authors, and buyers should test against their own estates.
Where Elisity wins, and where it does not. Most leaders in Forrester's evaluation enforce through software agents on servers and workloads. That suits data centers and clouds. It does not suit an MRI scanner, an infusion pump or a factory controller, which cannot run an agent. Elisity enforces policy on the switches those devices already plug into, which is why its customer list is full of hospitals and manufacturers. The gap is just as clear: Elisity itself rates its cloud and Kubernetes support as "Limited" and says its "strength is on-premises and campus segmentation," so a cloud-native estate may pair it with a cloud-focused tool. For IonQ's first targets, hospitals, utilities, factories, bank campuses and government sites, the campus is where the unprotectable devices sit and where risk is hardest to contain. The forecasts show that this segment alone is worth $12–16 billion by 2030.
Cryptographic inventory is a contested race. Elisity's cryptographic inventory is an announced roadmap item, not yet a shipping feature. Others already sell discovery. SandboxAQ's AQtive Guard has a five-year agreement with the Department of War's chief information officer to discover and inventory cryptographic assets, and it runs Bahrain's government program. Keyfactor, Entrust and IBM sell cryptographic discovery tools as well. IonQ's answer is that discovery alone produces a report. Combined with enforcement, a buyer can act on what it finds: fence off the devices that cannot migrate, and replace the keys on those that can with IonQ's post-quantum, QKD and quantum-randomness products. We have not identified an inventory vendor that also enforces network policy and sells quantum key hardware. Shipping the inventory feature quickly is the integration milestone that matters most.
What customers gain from buying the stack from one vendor:
$200M → $50M | GSK Segmentation project cost cut by three-quarters, with rollout sped from about one year per site to three or four sites a week. |
Six More Ways the Deal Creates Value
1. It improves the quality of IonQ's revenue. Public markets typically value recurring software revenue more highly than hardware and systems revenue, and recent security deals show how highly: ServiceNow paid about 23 times recurring revenue for Armis, and Google about 45 to 65 times for Wiz. IonQ paid about $1.15 billion upfront. If Elisity's revenue falls in the $25–60 million range we illustrate below, that is roughly 19 to 46 times revenue, in line with those deals. IonQ paid in stock that itself trades at about 32 times its 2026 revenue guidance. In other words, IonQ used its own highly valued shares to buy recurring software at a multiple consistent with the market for such assets. As Elisity becomes a larger share of IonQ's revenue, the mix shifts toward the kind of revenue the market tends to reward. This is a valuation argument, not a price target.
2. It secures a scarce asset before a rival could. The large platforms have been buying this layer: Zscaler acquired Airgap Networks for agentless, identity-based segmentation, ServiceNow bought Armis and Palo Alto Networks bought CyberArk. Of the dozen segmentation products in Elisity's own comparison, only a few enforce without agents, and Elisity is the one built around identity-based policy on the campus switches customers already own. Once a platform owns such a company, it is no longer available as a neutral partner. IonQ now owns one.
3. It opens new routes to market. ID Quantique already works with carriers that sell security to business customers, including Singtel, SK Telecom, Turkcell and Ooredoo. Those carriers are natural partners to package Elisity's segmentation with quantum-safe links as a managed service. Elisity, in turn, integrates with Cisco, Arista, Juniper, HPE Aruba, Microsoft, CrowdStrike and ServiceNow, whose partners and resellers reach the CISO. Neither company has yet announced a carrier or managed-security program for Elisity; IonQ's release speaks of expanded channels. We see this as one of the clearest near-term opportunities.
4. It builds a data advantage. IdentityGraph already maps the users, devices, workloads and AI agents in each deployment. Once cryptographic inventory is added, the combined company will be able to see, across sectors, which kinds of devices still run vulnerable cryptography, how exposed they are and how quickly they can be migrated. That knowledge would help customers set priorities, help IonQ design products and give regulators evidence they currently lack. This is our inference from the announced roadmap; IonQ has not described such a dataset.
5. AI agents create a second reason to buy. Gartner predicts that 40 percent of enterprise applications will feature task-specific AI agents by the end of 2026, up from less than 5 percent in 2025. Every agent is an identity that needs limits on what it can reach. A security team may come to Elisity to govern AI agents long before it has a quantum budget. Elisity has opened a command-line interface so customers' own agents can manage segmentation, with a human approving every change, and it joined the Open Secure AI Alliance in October. That gives the combined company a buying trigger that does not depend on quantum deadlines. De Masi makes the same point: "you need things like Elisity's Zero Trust strategy and our quantum key distribution today to keep you safe from the threats of LLMs."
6. It makes IonQ's security business less dependent on QKD. The NSA does not recommend QKD for national security systems unless its limitations are overcome, and Germany, France, the Netherlands, Switzerland and Singapore put post-quantum cryptography first. Before the deal, that doctrine was a headwind for a company known for QKD. Now IonQ can lead everywhere with inventory, segmentation and post-quantum migration, and treat QKD as upside where fixed, high-value links justify it, as in Romania, Slovakia, Singapore and Qatar.
The break-even math is modest. We use roughly 400 million IonQ shares (381 million on July 29, 2026 per the 10-Q, higher after the SkyWater close), which puts 2026 guidance at about $1.14 of revenue per share. The upfront price is about $1.15 billion in stock. That is roughly 32 million new shares at today's price of about $36, and at most about 35 million at the collar's $33.07 floor. Elisity therefore needs about $36 million a year in revenue to be neutral on revenue per share at today's price. That rises to about $40 million at the collar's floor and falls to about $26 million at its $49.61 cap. The critic says Elisity is doing "tens of millions," and IonQ says its revenue is doubling every year. On those terms, Elisity should cross that line within about a year of closing, before counting a single cross-sale.
$26–40M | BREAK-EVEN Illustrative Elisity revenue needed to break even on IonQ revenue per share, across the full price collar. |
TThe full break-even grid. The table below shows IonQ's 2026 revenue per share after closing, for three illustrative Elisity revenue levels and three settlement prices across the collar. It assumes about 400 million IonQ shares before closing, the $450–460 million guidance midpoint, $1.15 billion of upfront stock, and no cross-selling. The pre-deal figure is about $1.14. Elisity's revenue is undisclosed, so these are illustrations, not estimates.
Settlement price (20-day VWAP) | New shares (upfront) | Dilution | Elisity at $25M | Elisity at $40M | Elisity at $60M | Break-even revenue |
$33.07 (collar floor) | 34.8M | 8.7% | $1.104 (−2.9%) | $1.139 (+0.1%) | $1.185 (+4.1%) | About $40M |
$36.14 (Oct. 12 close) | 31.8M | 8.0% | $1.112 (−2.3%) | $1.146 (+0.8%) | $1.193 (+4.8%) | About $36M |
$49.61 (collar cap) | 23.2M | 5.8% | $1.134 (−0.3%) | $1.170 (+2.8%) | $1.217 (+7.0%) | About $26M |
The up to $150 million earnout is excluded. Its form of payment has not been disclosed; if paid entirely in stock at the floor, it would add about 4.5 million shares. Because Elisity has been doubling, a business at $25 million today would be near $50 million a year later. On these assumptions it would be accretive to revenue per share anywhere in the collar.
Three ways the deal could play out. Elisity's revenue is undisclosed, so we frame scenarios by their drivers rather than by invented totals. The break-even figure above is an illustration built on undisclosed numbers, and it should be read that way. We separate Elisity's standalone growth from the IonQ products it pulls through:
Scenario | Elisity standalone | IonQ pull-through (PQC, QRNG, QKD) | What would signal it |
Conservative | Growth slows below doubling as competition from Zscaler, Palo Alto Networks and Cisco intensifies | Little attach in the first year; security revenue still led by national networks | Elisity growth disclosed below 50%; few joint deals |
Base | Keeps doubling, as IonQ says it has been; clears break-even within about a year | Early attach in healthcare and banks under the 2026–2027 inventory deadlines | First joint offers; cryptographic inventory shipped inside IdentityGraph |
Upside | Doubling plus new sovereign and utility channels through IonQ's networks | Broad attach in healthcare, utilities and the national networks in Europe and Asia | Wins in mandated markets such as Korea, Singapore, Saudi Arabia and U.S. federal |
In every scenario the mix improves. Elisity adds recurring software revenue, which typically carries higher margins, to a company whose revenue is moving toward hardware and systems.
Paying in stock is the disciplined choice. ServiceNow and Google paid cash. IonQ paid in shares and keeps about $2 billion in cash for research and manufacturing. Three features protect shareholders:
IonQ is exchanging stock valued at about 32 times this year's revenue for a business doubling with zero churn.
This is the easiest kind of acquisition to absorb. IonQ's other recent deals involved physics, fabs and hardware roadmaps. Elisity is software with its own leadership and sales team, and it runs on hardware customers already own. One customer, Shaw Industries, deployed it at two sites in under an hour, Elisity reports. The integration work is a product roadmap, chiefly bringing cryptographic inventory into IdentityGraph, not a factory consolidation. It also adds software revenue, which typically carries higher margins, to a company whose revenue is increasingly tied to hardware.
The record answers the "digesting" concern with evidence. IonQ has closed nine acquisitions since January 2025. De Masi says he has closed about 57 acquisitions as a public-company leader over his career and calls integration "a core competence of IonQ," adding that "customers are buying more than one solution and it is fueling acceleration in our growth." The test of digestion is whether each one shows up afterward in products, contracts, leadership and the financial statements. Here is what the public record shows:
Acquisition | Closed | What it added | Dated evidence since closing |
Qubitekk | Jan. 6, 2025 | Quantum networking hardware | $21.1 million Air Force Research Laboratory quantum-networking contract, facilitated through Qubitekk (Jan. 2025) |
ID Quantique (controlling stake) | Apr. 30, 2025 | QKD, quantum random number generators | Slovakia's national network (Dec. 2025); Romania's national network, 36 links over 1,500+ km (Feb. 2026); Poland's national network (2026); Clavis XG Multiplex launched (June 2026); $8.18 million Congruity360 QKD deal (Sept. 2026) |
Lightsynq | May 30, 2025 | Quantum memory and interconnects | Co-founder Mihir Bhaskar now leads IonQ's global R&D; IonQ and EPB launched a $15 million, five-year research center to house a commercial quantum memory in a live network (Aug. 2026) |
Capella Space | July 11, 2025 | Radar imaging satellites | Commercial InSAR service launched (May 2026); National Reconnaissance Office Radar Commercial Augmentation contract (Aug. 2026) |
Oxford Ionics | Sept. 16, 2025 | Chip-based trapped-ion control | IonQ reported a world-record two-qubit fidelity above 99.99 percent (Oct. 2025); co-founder Chris Ballance named IonQ President of Quantum Computing; Oxford became IonQ's global R&D hub and EMEA headquarters |
Vector Atomic | Oct. 2025 | Quantum sensing and atomic clocks | $28 million DARPA award for 25 Evergreen-05 clocks, with a $30 million option for 100 more (Aug. 2026); co-founder Marty Boyd directs IonQ's timekeeping division |
Skyloom | Jan. 28, 2026 | Free-space optical communications | Terminals on Space Development Agency Tranche 1 satellites; IonQ reports 84 on-orbit installations (Aug. 2026); CEO retained |
SkyWater Technology | July 31, 2026 | DMEA Category 1A Trusted Foundry | CEO Thomas Sonderman stays; 2026 revenue guidance raised to $450–460 million |
Nexus Photonics | Sept. 10, 2026 | Integrated photonics | Integration into IonQ atomic clocks and gravimeters already begun |
Elisity | Expected Q4 2026 | Identity-based Zero Trust | CEO James Winebrenner stays |
The financial statements tell the same story. IonQ's second-quarter 2026 filing states: "No impairment loss was recognized for any of the three or six months ended June 30, 2026 and 2025." No acquisition has been written down. Acquisition and integration costs were $28.1 million in the first half of 2026, small against $3.0 billion in cash and investments at the end of June. The headline second-quarter GAAP loss of about $1.87 billion was driven mainly by a $1.65 billion non-cash change in the fair value of warrants, not by operations. Meanwhile:
0 impairments | INTEGRATION RECORD Nine acquisitions since January 2025, and IonQ's filing reports no impairment loss on any of them. |
The founders and chief executives of the acquired companies are running divisions inside IonQ rather than leaving: Ballance, Bhaskar, Boyd, Sonderman, Skyloom's leadership and now Winebrenner. That is a company turning acquisitions into deployed products. Integration still costs money: the adjusted EBITDA loss was $120 million in the second quarter.
The risks are real and manageable. IonQ will compete with Zscaler, Palo Alto Networks, Cisco and independents such as Illumio. It must keep Elisity's team and customers while absorbing other recent acquisitions. Quantum key distribution faces skepticism in some markets: the NSA says it "does not recommend the usage of quantum key distribution" for national security systems unless its limitations are overcome, and several European agencies prefer post-quantum cryptography. That limits QKD sales in those markets, and it is precisely why Elisity matters, because IonQ's security business no longer depends on QKD adoption. Elisity's revenue has not been disclosed, and the market will rightly want to see it. Three signals will settle the debate:
Ten Moves That Would Prove the Thesis
The strategic case is strong. Execution will decide how quickly the market sees it. These are our recommendations for the first year after closing. Each one turns a claim in this report into something customers, regulators and investors can verify.
1. Make cryptographic inventory the flagship product. Ship it inside IdentityGraph within 6–12 months of closing, with a compliance view mapped to EO 14412 and OMB M-26-15, the EU roadmap, MAS, FINMA and SAMA. Every program in Part Two starts there. It converts "the missing layer" into something a CISO can buy now.
2. Lead with inventory, agentless segmentation and post-quantum cryptography; add QKD where it pays. The message is "inventory and contain today, migrate with PQC, add ID Quantique QKD only where fixed, high-value links justify it." That matches the doctrine of the NSA, Germany, France, the Netherlands, Switzerland and Singapore, and it turns a past headwind into an advantage.
3. Disclose Elisity's recurring revenue, growth rate and gross margin at or before closing. Even a range would let investors test the break-even math in this report with real numbers, alongside the collar and earnout.
4. Win three public references in 12–18 months. One U.S. federal or critical-infrastructure customer, one European national-network customer, and one large health system or drug maker. Named wins will do more for the stock than any market-size estimate.
5. Report the attach rate. The market-size figures in this report are the ceiling. The number that matters first is how many Elisity customers add an IonQ quantum-safe product; we model it below.
6. Use agentless enforcement as the wedge. Target hospitals, plants, utilities and critical infrastructure, where agents cannot be installed and where Cisco, Palo Alto Networks, Illumio and Zscaler are weakest. Address the cloud-native gap with partners or the roadmap rather than claiming universal coverage.
7. Protect Elisity's team, brand and customers. Keep James Winebrenner and the existing sales organization in place, as announced, and avoid forced product or sales-process changes in the first two quarters. Zero churn is part of what IonQ paid for. De Masi's own words point the same way: Elisity "brings us a fantastic leader in James Winebrenner. It brings a fabulous cultural fit with our team. Culture eats strategy for breakfast."
8. Publish a simple, dated integration scorecard. The four measures below would answer the "digesting acquisitions" critique with facts each quarter.
9. Lead with sovereignty in government markets. Present trusted U.S. silicon, NIST post-quantum algorithms, sovereign networks and customer-controlled identity as the in-alliance alternative to state carriers.
10. Keep the cash for building. The all-stock structure preserves about $2 billion for SkyWater, quantum hardware and new security products. Each update should restate share-count impact across the collar so dilution stays visibly bounded.
The scorecard we will track.
Measure | What would confirm the thesis | When |
Cryptographic inventory in IdentityGraph | Generally available, with regulator-mapped reporting | Within 6–12 months of closing |
Joint offers and closed joint deals | First joint deals announced; three public references | Within 12–18 months |
Elisity revenue growth | Disclosed, and still near doubling | At closing, then quarterly |
Impairments and integration cost | No impairment; integration cost small relative to cash | Each quarterly filing |
A base case built on attach, not market share. Elisity has more than 100 deployments, which de Masi described as "100 new customers." If 10 to 20 percent of them add one IonQ quantum-safe product within 18–24 months, that is roughly 10 to 20 customers. IonQ has not disclosed security pricing, so the annual values below are illustrations; for scale, its one disclosed combined PQC and QKD deployment, with Congruity360, is worth $8.18 million.
Customers adding an IonQ product | At $0.5M a year each | At $1M a year each | At $2M a year each |
10 (about 10% of deployments) | $5M | $10M | $20M |
15 (about 15%) | $7.5M | $15M | $30M |
20 (about 20%) | $10M | $20M | $40M |
On these illustrations, attach revenue alone could reach $5–40 million a year from Elisity's existing base, before any new Elisity customers, IonQ's sovereign channels or the market-size upside. Added to Elisity's own growth, that would put the deal past the $26–40 million break-even range sooner than Elisity's standalone growth would by itself. These are illustrations, not forecasts.
The critique values a security company. We value a market and a position. The deal lifts IonQ's core addressable security market to between $18 billion and $44 billion by 2030, more than three times what it was, inside a quantum-safe market worth about $36–65 billion by 2030 and $94–161 billion by 2035. It places IonQ beside adjacent identity and industrial-security markets worth more than $90 billion. And it makes IonQ the only commercial company with assets at every layer, from a trusted U.S. chip foundry and quantum chips in consumer phones to national quantum networks, satellites and now the policy engine that decides who may reach what. Each 1 percent share of the core market would equal roughly 40 to 97 percent of IonQ's entire 2026 revenue guidance. IonQ paid for this position in stock, with dilution capped and part of the price tied to performance, and it should break even within about a year. We believe the market will come to see this deal the way it eventually came to see China's and Russia's quantum advances: later than it should have.
Friends of IonQ owns equity positions in several quantum technology companies.
Sources are grouped by theme. Customer metrics and analyst placements for Elisity are as reported by Elisity unless stated otherwise. Forecasts come from different research firms and partly overlap.
Deal terms and IonQ financials
IonQ integration evidence: AFRL/Qubitekk (Converge Digest): https://convergedigest.com/ionq-secures-21-1-million-air-force-contract-for-quantum-networking/ ; Clavis XG Multiplex: https://www.idquantique.com/clavis-xg-multiplex-announcement/ ; Congruity360: https://investors.ionq.com/news/news-details/2026/IonQ-and-Congruity360-Partner-to-Enhance-Quantum-Safe-Protection/default.aspx ; EPB center: https://investors.ionq.com/news/news-details/2026/IonQ-and-EPB-Partner-to-Launch-the-Tennessee-Quantum-Communications-Research-Center/default.aspx ; Capella NRO: https://investors.ionq.com/news/news-details/2026/IonQs-Space-Division-Awarded-NRO-Radar-Commercial-Augmentation-Contract/default.aspx ; 99.99% fidelity: https://www.businesswire.com/news/home/20251021636686/en ; DARPA clocks: https://investors.ionq.com/news/news-details/2026/UPDATED-DARPA-Selects-IonQ-to-Produce-Next-Generation-Atomic-Clocks/default.aspx ; Skyloom terminals: https://investors.ionq.com/news/news-details/2026/IonQs-Skyloom-Optical-Communications-Terminals-Reach-84-On-Orbit-Installations-Following-Latest-Launch/default.aspx ; SkyWater close: https://investors.ionq.com/news/news-details/2026/IonQ-Completes-Acquisition-of-SkyWater-Technology/default.aspx ; Q2 2026 10-Q (impairment statement): https://www.sec.gov/Archives/edgar/data/0001824920/000119312526341001/ionq-20260630.htm
R&D, six months ended June 30, 2026 (Form 10-Q / results): IonQ https://www.sec.gov/Archives/edgar/data/0001824920/000119312526341001/ionq-20260630.htm ; D-Wave https://www.sec.gov/Archives/edgar/data/0001907982/000190798226000129/qbts-20260630.htm ; Rigetti https://www.stocktitan.net/news/RGTI/rigetti-computing-reports-second-quarter-2026-financial-i812eesegntu.html ; Quantum Computing Inc. https://www.sec.gov/Archives/edgar/data/0001758009/000121390026087267/ea030143301ex99-1.htm ; Infleqtion https://www.sec.gov/Archives/edgar/data/0002007825/000162828026057508/infq-20260630.htm
IonQ Italia: https://www.ionq.com/news/ionq-appoints-dr-marco-pistoia-as-ceo-of-ionq-italia-to-spearhead-strategic
IonQ, Elisity acquisition: https://www.ionq.com/news/ionq-to-acquire-elisity-to-accelerate-zero-trust-for-the-quantum-era
Niccolo de Masi interview, Bloomberg Open Interest, with Dani Burger (Oct. 12, 2026); quotations from our transcript of the broadcast
IonQ and ARLIS Zero Trust framework (Mar. 9, 2026): https://www.businesswire.com/news/home/20260309106618/en/IonQ-and-ARLIS-Partner-to-Establish-Zero-Trust-Security-Framework-for-Mission-Critical-Quantum-Architectures
Benzinga, stock move and terms: https://www.benzinga.com/m-a/26/10/62300971/ionq-to-acquire-elisity-in-1-3-billion-deal
IonQ Q2 2026 results: https://ionq.com/news/ionq-announces-record-second-quarter-2026-revenues-growing-287-yoy
The Quantum Insider, Investor Day: https://thequantuminsider.com/2026/09/08/ionq-uses-investor-day-to-detail-superion-roadmap-skywater-strategy-and-quantum-security-plans/
IonQ, SkyWater acquisition: https://www.businesswire.com/news/home/20260125927336/en/
IonQ share count (TIKR): https://www.tikr.com/de/blog/ionqs-cash-pile-hit-2-1-billion-every-investor-should-look-at-its-share-count-now
Elisity: customers, validation and product (customer metrics are vendor-reported)
Elisity, microsegmentation vendor comparison (updated Aug. 10, 2026): https://www.elisity.com/blog/top-microsegmentation-solutions
Elisity, zero trust microsegmentation solutions: https://www.elisity.com/microsegmentation/best-zero-trust-microsegmentation-solutions
Illumio, Forrester Wave Q3 2026: https://www.illumio.com/blog/forrester-wave-microsegmentation-leader-2026
Akamai, Forrester Wave Q3 2026: https://www.akamai.com/blog/security/akamai-2026-forrester-wave-leader-microsegmentation
ColorTokens, Forrester Wave Q3 2026: https://colortokens.com/?p=29252
SandboxAQ and DoW CIO: https://www.prnewswire.com/news-releases/sandboxaq-and-dow-cio-partner-to-strengthen-us-defenses-against-quantum-and-ai-driven-cyber-threats-302637305.html
Elisity founders, funding and customers (Elisity, VentureBeat, Pillsbury); St. Luke's: https://www.elisity.com/video/cs/st-lukes-university-health-network ; MultiCare (May 11, 2026): https://www.elisity.com/news/multicare-health-system-wins-2026-cso-award-for-from-department-of-no-to-culture-of-yes-microsegmentation-initiative ; Andelyn: https://www.elisity.com/blog/microsegmentation-case-study-how-andelyn-biosciences-accelerated-zero-trust-in-weeks-not-years ; ROI snapshots (GSK, health system, manufacturer): https://www.elisity.com/hubfs/ds/Elisity%20ROI%20Case%20Study%20Snapshots.pdf ; GSK CSO50 2023: https://www.elisity.com/news/archive/2023/10 ; 2024 momentum release: https://www.elisity.com/news/elisity-achieves-record-momentum-in-2024-as-adoption-of-identity-based-microsegmentation-accelerates ; Forrester Wave: https://www.businesswire.com/news/home/20240828317795/en/ ; open CLI: https://www.elisity.com/news/elisity-launches-open-cli-for-customer-built-ai-agents-on-its-microsegmentation-platform ; Rosenblatt (GuruFocus): https://www.gurufocus.com/news/9119598/
Elisity: Gartner Cool Vendor (Sept. 2025): https://www.elisity.com/news/elisity-named-a-cool-vendor-in-the-gartner-cool-vendors-in-cyber-physical-systems-security-2025 ; SINET16, Forrester Wave and Gartner Market Guide: https://www.elisity.com/news/elisity-named-a-2025-sinet16-innovator-award-winner ; CyberSecurity Breakthrough Award: https://www.businesswire.com/news/home/20251010638229/en/ ; Deloitte Fast 500: https://www.elisity.com/news/elisity-ranked-number-13-fastest-growing-company-in-north-america-on-the-2025-deloitte-technology-fast-500; St. Luke's: https://www.elisity.com/news/elisity-microsegmentation-enables-st.-lukes-to-secure-85000-medical-devices-and-unlocks-clinical-innovation-in-46-days
Elisity hardware compatibility: https://support.elisity.com/hc/en-us/articles/15540856958740-Hardware-Compatibility-Matrix
Elisity integrations: https://www.elisity.com/integrations-overview
Insight Partners, Elisity Series B: https://www.insightpartners.com/ideas/elisity-raises-37m-series-b-to-fuel-ai-innovation-in-identity-based-microsegmentation/
IonQ integration record and footprint
IonQ acquisitions: Qubitekk https://ionq.com/news/ionq-completes-acquisition-of-qubitekk-solidifying-leadership-in-quantum ; Oxford Ionics https://ionq.com/news/ionq-completes-acquisition-of-oxford-ionics-rapidly-accelerating-its-quantum ; Oxford R&D hub https://datacentrenews.uk/story/ionq-makes-oxford-global-r-d-hub-after-usd-1b-deal ; Vector Atomic https://thequantuminsider.com/2025/10/08/ionq-completes-acquisition-of-vector-atomic/ ; Skyloom https://ionq.com/news/ionq-completes-acquisition-of-skyloom-expanding-quantum-networking-and-secure-communications-capabilities ; Nexus Photonics https://ionq.com/news/ionq-completes-acquisition-of-nexus-photonics-securing-scalable-manufacturing-for-quantum-systems ; Lightsynq, Capella and SkyWater dates: https://en.wikipedia.org/wiki/IonQ
Horizon Quantum financing with IonQ (The Quantum Insider): https://thequantuminsider.com/2025/12/05/horizon-quantum-secures-110-million-pipe-with-ionq-among-lead-investors-to-support-spac-merger/
IonQ–TII: https://ionq.com/news/ionq-announces-agreement-with-the-united-arab-emirates-technology-innovation
IonQ–Toyota Tsusho: https://investors.ionq.com/news/news-details/2025/IonQ-Signs-Historic-Agreement-with-Toyota-Tsusho-Corporation-to-Advance-Quantum-Computing-Opportunities-in-Japan/default.aspx
IonQ, Romania QKD network: https://investors.ionq.com/news/news-details/2026/IonQ-Delivers-One-of-the-Largest-Operational-Quantum-Key-Distribution-Networks-in-Europe/default.aspx
The Quantum Insider, Samsung quantum smartphone: https://thequantuminsider.com/2020/05/25/a-quantum-smartphone-samsung-and-sk-telecom-super-secured-by-id-quantiques-quantum-chip/
Market forecasts and comparable deals
Grand View Research, post-quantum cryptography: https://www.grandviewresearch.com/industry-analysis/post-quantum-cryptography-market-report
Precedence Research, post-quantum cryptography (via MojoAuth): https://mojoauth.com/news/post-quantum-cryptography-market-to-reach-usd-2995-bn-by-2034
Market Glass, microsegmentation: https://giikorea.co.kr/report/go1765065-microsegmentation.html
SNS Insider, network access control: https://www.globenewswire.com/news-release/2026/07/02/3321137/0/en/Network-Access-Control-Market-Projected-to-Reach-48-84-Billion-by-2035-SNS-Insider.html
Grand View Research, public key infrastructure: https://www.grandviewresearch.com/press-release/global-public-key-infrastructure-market
The Business Research Company, public key infrastructure: https://www.thebusinessresearchcompany.com/report/public-key-infrastructure-global-market-report
Global Market Insights, public key infrastructure: https://www.gminsights.com/industry-analysis/public-key-infrastructure-pki-market
Fact.MR, post-quantum migration services: https://www.factmr.com/report/post-quantum-migration-services-market
IDC, worldwide security spending (Mar. 3, 2026): https://www.idc.com/resource-center/press-releases/wwsecuritysg/
Gartner, MENA security spending: https://www.gartner.com/en/newsroom/press-releases/2025-10-06-gartner-forecasts-mena-end-user-spending-on-information-security-to-total-4-billion-usd-in-20260
Gartner, AI agents in enterprise apps: https://www.gartner.com/en/newsroom/press-releases/2025-08-26-gartner-predicts-40-percent-of-enterprise-apps-will-feature-task-specific-ai-agents-by-2026-up-from-less-than-5-percent-in-2025
McKinsey Quantum Technology Monitor: https://www.mckinsey.com/capabilities/tech-and-ai/our-takeaways/the-year-of-quantum-from-concept-to-reality-in-2025
Hudson Institute: https://hudson.org/technology/prosperity-risk-quantum-computer-threat-us-financial-system
Gartner security spending (via Software Strategies Blog): https://softwarestrategiesblog.com/2026/03/24/information-security-spending-2026/amp/
MarketsandMarkets, Zero Trust: https://www.marketsandmarkets.com/PressReleases/zero-trust-security.asp
MarketsandMarkets, IAM (via SecurityWorldMarket): https://www.securityworldmarket.com/na/News/Business-News/identity--access-management-sector-to-surpass-42-billion-by-2030
MarketsandMarkets, OT security: https://www.prnewswire.co.uk/news-releases/operational-technology-ot-security-market-worth-50-29-billion-by-2030--exclusive-report-by-marketsandmarkets-302442392.html
MarketsandMarkets, PQC: https://www.marketsandmarkets.com/PressReleases/post-quantum-cryptography.asp
MarketsandMarkets, QKD: https://prnewswire.co.uk/news-releases/quantum-key-distribution-market-worth-2-63-billion-by-2030--exclusive-report-by-marketsandmarkets-302369748.html
Juniper Research PQC (via ICTbusiness): https://www.ictbusiness.biz/analysis/post-quantum-cryptography-market-to-exceed-13-billion-by-2035
Grand View Research, NAC: https://www.grandviewresearch.com/press-release/global-network-access-control-market
IoT Analytics: https://iot-analytics.com/number-connected-iot-devices/
CyberArk 2025 Identity Security Landscape: https://www.silicon.co.uk/press-release/machine-identities-outnumber-humans-by-more-than-80-to-1-new-report-exposes-the-exponential-threats-of-fragmented-identity-security
NIST FIPS 203: https://nvlpubs.nist.gov/nistpubs/fips/nist.fips.203.pdf
Cloudflare post-quantum traffic (PostQuantum): https://postquantum.com/industry-news/cloudflare-pqc-majority-traffic/
Zscaler–Airgap (SecurityWeek): https://www.securityweek.com/zscaler-to-acquire-network-segmentation-tech-startup-airgap-networks/
Palo Alto Networks–CyberArk: https://paloaltonetworks.com/company/press/2026/palo-alto-networks-completes-acquisition-of-cyberark-to-secure-the-ai-era
ServiceNow–Armis (TechCrunch): https://techcrunch.com/2025/12/23/servicenow-to-acquire-cybersecurity-startup-armis-for-7-75b
Google–Wiz (Acquiry): https://www.acquiry.com/deal-analysis/google-wiz-acquisition/
Government deadlines, mandates and cost estimates
OMB Memorandum M-26-15 (June 24, 2026): https://www.whitehouse.gov/wp-content/uploads/2026/06/M-26-15-Execution-of-the-Migration-to-Post-Quantum-Cryptography.pdf
Poland Cybersecurity Strategy 2025–2029, PQC plan (ITwiz): https://itwiz.pl/?p=71874
Lithuania PQC working group (Ministry of National Defence): https://kam.lt/en/?p=100245
Brazil ITI Normative Instruction 35 (Convergência Digital): https://convergenciadigital.com.br/governo/iti-certificado-digital-e-assinatura-gov-br-adotam-criptografia-quantica/
Vietnam Decision 1226/QĐ-TTg (LuatVietnam): https://luatvietnam.vn/tin-van-ban-moi/den-nam-2035-viet-nam-se-dao-tao-it-nhat-5000-chuyen-gia-mat-ma-va-an-toan-thong-tin-186-110302-article.html
Kazakhstan readiness review (24KZ): https://24.kz/ru/news/social/770748-novyj-uroven-zashchity-tsifrovykh-sistem-obsudili-v-kazakhstane
HKMA Quantum Preparedness Index (July 27, 2026): https://www.hkma.gov.hk/eng/news-and-media/press-releases/2026/07/20260727-3/
Taiwan FSC PQC guideline (UDN, June 18, 2026): https://udn.com/news/story/7239/9575116
NATO Quantum Technology Roadmap (Sept. 29, 2026): https://nato.int/en/about-us/official-texts-and-resources/official-texts/2026/09/29/quantum-technology-roadmap
NÚKIB, Minimum Requirements for Cryptographic Algorithms, annex v2.0: https://nukib.gov.cz/download/publications_en/Annex%20to%20the%20document_Minimum%20Requirements%20for%20Cryptographic%20Algorithms.pdf
Swedish NCSC recommendations (Nordic Defence Sector): https://nordicdefencesector.com/en/article/ncsc-sweden-should-be-quantum-secure-by-2035
Bank of Israel letter (Jan. 7, 2025): https://boi.org.il/media/sm4f1ssu/202501en.pdf
Thailand NCSA draft framework (Bangkok Biz News): https://www.bangkokbiznews.com/tech/ai/1245255
Thailand Quantum-Ready 2030 (Daily News): https://www.dailynews.co.th/articles/5980152/
Vietnam proposed roadmap (VietnamPlus): https://en.vietnamplus.vn/vietnam-begins-shift-to-post-quantum-cryptography-for-digital-trust-post351859.vnp
Bahrain NCSC and SandboxAQ (Intelligent CIO): https://www.intelligentcio.com/me/2025/12/23/bahrain-government-takes-definitive-step-toward-building-a-quantum-safe-economy/
New Zealand Information Security Manual, section 2.4: https://nzism.gcsb.govt.nz/ism-document/pdf/Section/12224
China ICCS Next-generation Commercial Cryptographic Algorithms Program (IETF 125): https://datatracker.ietf.org/meeting/125/materials/slides-125-saag-introduction-to-the-next-generation-commercial-cryptographic-algorithms-program-01
Russia TC 26 post-quantum schemes (Habr): https://habr.com/ru/articles/834088
OMB M-23-02 (Nov. 18, 2022): https://bidenwhitehouse.archives.gov/wp-content/uploads/2022/11/M-23-02-M-Memo-on-Migrating-to-Post-Quantum-Cryptography.pdf
Quantum Computing Cybersecurity Preparedness Act, Public Law 117-260: https://www.govinfo.gov/app/details/PLAW-117publ260
Executive Order 14412 (June 22, 2026): https://www.presidency.ucsb.edu/documents/executive-order-14412-securing-the-nation-against-advanced-cryptographic-attacks
IETF draft on ML-KEM key-share size and fragmentation (July 2026): https://www.ietf.org/archive/id/draft-rosomakho-tls-ecdhe-mlkem512-00.html
Cost estimates: OMB Report on PQC (July 2024): https://bidenwhitehouse.archives.gov/wp-content/uploads/2024/07/REF_PQC-Report_FINAL_Send.pdf ; Korea pilot (The Elec): https://www.thelec.kr/news/articleView.html?idxno=51478 ; Korea budgets and financial-sector estimate (Data Economy Daily): https://www.dataeconomy.co.kr/news/articleView.html?idxno=42679 ; Netherlands Court of Audit: https://zoek.officielebekendmakingen.nl/blg-1234353.pdf; UK DSIT-commissioned study: https://assets.publishing.service.gov.uk/media/692820edb3b9afff34e960f6/Regulator_and_industry_perspectives_on_the_current_plan_for_PQC_transition.pdf; Canada ITSM.40.001 (cost-estimate requirement); MAS S$100 million: https://www.mas.gov.sg/news/media-releases/2024/mas-commits-up-to-s$100-million-to-support-quantum-and-artificial-intelligence-capabilities
FINMA Guidance 05/2026 (CMS summary): https://cms.law/en/che/legal-updates/finma-guidance-warns-swiss-financial-institutions-should-prepare-for-post-quantum-cyber-risks
Italy ACN cryptography guidelines (Cybersecurity360): https://www.cybersecurity360.it/soluzioni-aziendali/crittografia-e-transizione-post-quantum-cosa-cambia-con-le-nuove-linee-guida-acn/
Korea amendment (Money Today, May 2026): https://www.mt.co.kr/tech/2026/05/12/2026051217163497339 ; (CEO Score Daily): https://ceoscoredaily.com/page/view/2026051311103120185 ; (MTN): https://news.mtn.co.kr/news-detail/2026051314223661482
NSA on QKD: https://nsa.gov/Cybersecurity/Post-Quantum-Cybersecurity-Resources
MAS–Banque de France PQC experiment (Markets Media, Nov. 2024): https://www.marketsmedia.com/banque-de-france-mas-conduct-post-quantum-cryptography-experiment
MAS QKD sandbox report (The Asian Banker, Sept. 2025): https://www.theasianbanker.com/press-releases/mas-and-industry-partners-release-quantum-safe-finance-sandbox-report
CSA Quantum-Safe Migration Handbook (PostQuantum): https://postquantum.com/security-pqc/singapore-cii-quantum-safe-milestone/
MAS FSTI 4.0 (The Asian Banker, Aug. 31, 2026): https://www.theasianbanker.com/press-releases/mas-commits-s-220-million-to-support-next-phase-of-fintech-innovation
EU post-quantum cryptography policy: https://digital-strategy.ec.europa.eu/en/policies/post-quantum-cryptography
Germany BSI TR-02102 deadlines (t3n, Feb. 2026): https://t3n.de/news/?p=1729485
France ANSSI PQC FAQ: https://cyber.gouv.fr/enjeux-technologiques/cryptographie-post-quantique/faq-pqc/
France certification from 2027 (The Quantum Insider, June 2026): https://thequantuminsider.com/2026/06/18/france-says-it-will-wont-certify-security-products-that-arent-quantum-resistent-starting-in-2027/
Netherlands quantum strategy (ioplus, Oct. 2026): https://ioplus.nl/nl/posts/nederland-lanceert-nationale-quantumstrategie-voor-2035
Spain EuroQCI (Indra, June 2026): https://www.indragroup.com/cms-content/2026/06/260602-NP-Indra-Group-EuroQCI.pdf
UK NCSC migration timelines: https://www.ncsc.gov.uk/guidance/pqc-migration-timelines
Canada ITSM.40.001: https://cyber.gc.ca/en/guidance/roadmap-migration-post-quantum-cryptography-government-canada-itsm40001
Australia ASD: https://www.cyber.gov.au/business-government/secure-design/planning-for-post-quantum-cryptography
Executive Order 14412: https://www.presidency.ucsb.edu/documents/executive-order-14412-securing-the-nation-against-advanced-cryptographic-attacks
G7 Cyber Expert Group statement: https://home.treasury.gov/system/files/136/G7-CEG-Quantum-Roadmap.pdf
Japan PQC interim summary (Cabinet Secretariat): https://www.cas.go.jp/jp/seisaku/pqc/dai2/shiryo1.pdf
Japan FSA PQC report: https://www.fsa.go.jp/singi/pqc/houkokusyo.pdf
Japan Tokyo–Nagoya–Osaka QKD network (NTT, June 2026): https://www.ntt.com/about-us/press-releases/news/article/2026/0630_2.html
India DST roadmap (May 2026): https://dst.gov.in/sites/default/files/Quantum-Safe-Ecosystem-in-India.pdf
Saudi SAMA circular (Okaz): https://www.okaz.com.sa/economy/na/2264171 ; (PostQuantum): https://postquantum.com/security-pqc/sama-quantum-circular-inventory/
Saudi NCA consultation: https://nca.gov.sa/ar/news/2078/
UAE National Encryption Policy (Sharjah24): https://sharjah24.ae/ar/Articles/2025/11/27/al014
Jordan central bank roadmap (Al Mamlaka): https://www.almamlakatv.com/news/186950
Qatar quantum-safe link (HBKU): https://www.hbku.edu.qa/en/news/qatars-first-quantum-safe-communications-link
Türkiye Turkcell–IDQ (The Quantum Insider): https://thequantuminsider.com/2025/02/26/turkcell-and-id-quantique-demonstrate-first-intercontinental-qkd-over-fiber-in-istanbul/
Brunei PQC Migration Framework: https://csb.gov.bn/sites/default/files/downloads/PQC/PQC_MIGRATION_FRAMEWORK.pdf
Malaysia (RTM, Sept. 2026): https://berita.rtm.gov.my/?p=694413
Indonesia (Antara, Aug. 2026): https://megapolitan.antaranews.com/berita/545013
EU PQC roadmap (CyberInsider): https://cyberinsider.com/eu-charts-roadmap-for-transition-to-quantum-resistant-cryptography-by-2035/
GAO-27-108740: https://files.gao.gov/reports/GAO-27-108740/index.html
Healthcare and adjacent ecosystems
Healthcare and ecosystems: HHS HIPAA NPRM fact sheet: https://hhs.gov/hipaa/for-professionals/security/hipaa-security-rule-nprm/factsheet ; Change Healthcare (HHS OCR): https://hhs.gov/hipaa/for-professionals/special-topics/change-healthcare-cybersecurity-incident-frequently-asked-questions/index.html ; 2025 breaches (HIPAA Journal): https://www.hipaajournal.com/december-2025-healthcare-data-breach-report/; IBM 2025 healthcare cost (TechTarget): https://www.techtarget.com/healthtechsecurity/news/366628031/ ; AHA Fast Facts 2026: https://www.aha.org/system/files/media/file/2026/02/Fast-Facts-on-US-Hospitals-2026-Infographics.pdf ; Claroty Team82: https://claroty.com/press-releases/new-research-from-clarotys-team82-highlights-riskiest-medical-device-exposures-in-healthcare-environments ; FDA 524B FAQ: https://www.fda.gov/medical-devices/digital-health-center-excellence/cybersecurity-medical-devices-frequently-asked-questions-faqs ; Europol HNDL report: https://www.europol.europa.eu/cms/sites/default/files/documents/Harvest-now-decrypt-later.pdf ; NCSC genomics fact sheet: https://archive.dni.gov/files/NCSC/documents/SafeguardingOurFuture/NCSC_China_Genomics_Fact_Sheet_2021revision20210203.pdf ; healthcare and medical device security markets (GMI): https://gminsights.com/pressrelease/healthcare-cybersecurity-market ; IonQ–AstraZeneca–AWS–NVIDIA: https://www.businesswire.com/news/home/20250609358259/en/ ; IonQ Gothenburg: https://nordiclifescience.org/american-ionq-opens-operation-in-gothenburg/ ; IonQ–CCRM: https://thequantuminsider.com/2025/12/01/ionq-and-ccrm-announce-strategic-quantum-biotech-collaboration-to-accelerate-development-of-advanced-therapeutics/ ; DOJ Xu Zewei: https://justice.gov/opa/pr/justice-department-announces-arrest-prolific-chinese-state-sponsored-contract-hacker ; Volt Typhoon (TechTarget on CISA AA24-038A): https://techtarget.com/searchSecurity/news/366569227/ ; FERC Order 907: https://www.govinfo.gov/content/pkg/FR-2025-07-02/html/2025-12309.htm ; IBM X-Force 2026 (Manufacturing Dive): https://www.manufacturingdive.com/news/manufacturing-sector-saw-most-cyberattacks-in-2025-IBM-X-Force/813063/ ; Treasury task force (Orrick): https://infobytes.orrick.com/2026-08-28/treasury-announces-quantum-readiness-task-force/ ; EO 14412: https://www.whitehouse.gov/wp-content/uploads/2026/06/eo-14412.pdf ; Salt Typhoon (FBI via Yahoo/WaPo): https://finance.yahoo.com/news/fbi-says-china-salt-typhoon-193940012.html
Threat environment and China–Russia research
Russian Railways quantum network (ComNews): https://www.comnews.ru/content/246222/2026-06-29/2026-w27/1018/uslugi-magistralnoy-kvantovoy-seti-oao-rzhd-stali-dostupny-vsem-zainteresovannym-potrebitelyam
China Telecom quantum-communication users, 2026 interim results (C114): https://m.c114.com.cn/w5285-1316036.html ; metro networks in 25 cities, Dec. 2025 (C114): https://m.c114.com.cn/w5285-1303905.html
Friends of IonQ owns equity positions in several quantum technology companies.
