IonQ, the Maryland-based quantum computing company, announced Monday that it has signed a definitive agreement to acquire Elisity Inc., a San Jose-based cybersecurity startup specializing in Zero Trust microsegmentation, in an all-stock deal valued at up to $1.3 billion. The transaction includes up to $150 million in performance-based earnout payments and is expected to close in the fourth quarter of 2026.

The deal is the first time a quantum computing company has paired hardware-level cryptographic defense — post-quantum cryptography (PQC) and quantum key distribution (QKD) — with software-defined network access control under a single roof. The combination gives enterprise security teams something they have not had before: a deployable, two-layer defense against the “harvest now, decrypt later” (HNDL) threat before Q-Day arrives.

What makes the Elisity layer specifically valuable against HNDL is a point the deal announcement did not foreground: microsegmentation does not merely contain blast radius after a breach. It limits how much data adversaries can reach and collect inside a network right now, during the harvest phase that precedes any future quantum decryption. A narrower blast radius today means a smaller cache of stolen data tomorrow — whether or not Q-Day ever arrives on schedule.

What Elisity Actually Does Inside a Network

Founded in 2019, Elisity sells software that restricts which users, devices, workloads, and AI agents can communicate on enterprise networks, based on least-privilege policies. The core product is its IdentityGraph platform, and the architecture is what distinguishes it from older microsegmentation approaches that required ripping out network hardware or deploying software agents on every endpoint.

IdentityGraph enforces policy through existing switches — Cisco Catalyst 9000-series, Juniper, and Arista hardware — using flow telemetry routed through cloud-based Virtual Edge connectors. The switches themselves do the enforcement; Elisity rewrites the policy logic above them. This means a security team can deploy microsegmentation across an enterprise site in under 30 minutes with no new hardware purchases and no scheduled downtime.

The “Identity” in IdentityGraph refers to what the platform builds its policy decisions on. IdentityGraph pulls identity, behavior, traffic, and risk signals from more than 25 tools an organization already owns — Active Directory, ServiceNow, CrowdStrike, and others — and synthesizes them into one real-time record per device. Access decisions then happen at sub-millisecond latency, meaning policy enforcement does not create noticeable network lag for users.

The commercial track record reflects the architecture’s enterprise-grade credentials. Elisity has deployed at more than 100 enterprise customers with zero customer churn and revenues that have doubled each year. The company raised more than $70 million before the acquisition, backed by Insight Partners, TCV, and Chevron Technology Ventures. Industry analysts recognized the platform in the Forrester Wave Microsegmentation Solutions Q3 2024 evaluation as a “Strong Performer” and in the 2025 Gartner Market Guide for Network Security Microsegmentation as a Representative Vendor.

Why “Harvest Now, Decrypt Later” Is a Network-Layer Problem, Not Just a Crypto Problem

The strategic logic behind the acquisition rests on a threat model that most enterprise security teams have not fully internalized. For years, security researchers have warned about HNDL attacks from nation-state adversaries — nation-state adversaries who copy encrypted data from compromised networks today, store it, and plan to decrypt it once a sufficiently powerful quantum computer exists.

IonQ’s own leadership has acknowledged that for decades the security community has lived with the knowledge that a sufficiently powerful quantum computer could one day crack public-key cryptography algorithms like RSA and Elliptic Curve Cryptography. De Masi has predicted that Q-Day — the moment when a quantum computer becomes powerful enough to break widely used encryption standards — could arrive as early as 2028. That timeline is aggressive; the Cloud Security Alliance has estimated April 14, 2030 as the date by which a quantum computer will be able to break current cybersecurity infrastructure, and Gartner has projected that asymmetric cryptographic algorithms will be unsafe by 2029.

Regardless of the exact date, the harvest phase is happening now. Salt Typhoon, a China-linked advanced persistent threat group, has compromised at least nine U.S. telecommunications companies and reached more than 600 organizations in over 80 countries — infrastructure consistent with long-term data collection that could be exploited once quantum decryption becomes feasible.

The standard response to HNDL has been to focus on the cryptographic layer: migrate to NIST-standardized post-quantum algorithms (FIPS 203, 204, and 205, finalized in August 2024) before Q-Day renders current encryption useless. But PQC migration addresses what adversaries will be able to do with stolen data in the future. It does not address what they can reach inside a network today. That is where Elisity’s Zero Trust microsegmentation enters: by enforcing least-privilege access policies at the network layer, it shrinks the set of data a successfully authenticated adversary can actually touch during the harvest phase. Less data harvested now means less data to decrypt later.

As Elisity CEO James Winebrenner wrote in a blog post announcing the deal, “access controls reduce exposure, while cryptographic upgrades address the underlying weaknesses.” Both layers are necessary; neither is sufficient alone.

IonQ’s Quantum-Safe Security Business

IonQ is not entering the enterprise security market from scratch. The company already sells what it calls a defense-in-depth quantum-safe network architecture integrating both PQC and QKD.

QKD uses the physics of quantum mechanics to distribute cryptographic keys such that any eavesdropping attempt disturbs the quantum states being transmitted — making interception detectable rather than invisible. IonQ acquired ID Quantique in May 2025, giving it commercial access to ID Quantique’s Clavis QKD hardware and Solteris Network Appliances. The company has since deployed hybrid QKD-plus-PQC networks linking IonQ sites in Geneva, partnered with Cisco on quantum-resistant network upgrades in Switzerland, and extended QKD deployments to Poland, Romania, and Slovakia.

The commercial security segment is also gaining traction. On September 8, 2026, IonQ signed an $8.18 million agreement with Congruity360 to deploy a defense-in-depth quantum-safe network architecture integrating PQC and QKD — described at signing as one of the largest commercial quantum security transactions in the United States to date. On IonQ’s second-quarter earnings call, COO and CFO Inder Singh noted that organizations increasingly want to understand not only how quantum computing can create new capabilities, but also how it could expose them to future cybersecurity threats.

IonQ CEO Niccolo de Masi has been more blunt. In a Bloomberg Television interview earlier this year, he said quantum security is “tip of the tongue now because people are realizing that the asymmetry of brands being tarnished, companies being kind of existentially hacked, is avoidable with relatively modest investments.”

The Elisity acquisition adds the missing network-access-control layer to a hardware-heavy portfolio. IonQ’s position is that the cryptographic stack and the access-control stack need to be sold and deployed together — and that being the company that offers both gives it a differentiated market position as enterprise demand for quantum-ready security accelerates.

What Washington Is Now Demanding

Government policy has put a compliance deadline on the cryptographic half of this problem. A White House executive order issued on June 22, 2026 — Executive Order 14412, “Securing the Nation Against Advanced Cryptographic Attacks” — pulled federal post-quantum compliance deadlines forward significantly. Under the order, federal agencies must implement FIPS 203 (ML-KEM, for key establishment) for high-value assets by December 31, 2030, and FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA) for digital signatures by December 31, 2031. The Federal Acquisition Regulation Council is directed to extend these requirements to federal contractors.

IonQ also cited a companion order — Executive Order 14413, also issued June 22, 2026, promoting U.S. quantum technology development — as a tailwind for the combined entity.

For private enterprises that do business with the federal government, the 2030–2031 deadlines are effectively their deadlines too. For those that do not, the orders signal where regulatory requirements are heading. ISACA research of more than 2,600 IT professionals found that only 5% of organizations have a formal quantum transition plan. IBM and the Cloud Security Alliance benchmarked large enterprises’ post-quantum readiness at an average score of 25 out of 100. Migration experts estimate that large enterprises face 12 to 15 years of cryptographic migration work.

That gap between the timeline and the state of enterprise readiness is the market IonQ is now formally entering. The Elisity acquisition gives it immediate commercial presence in a microsegmentation market estimated at more than $10 billion and forecast to grow at double-digit annual rates.

IonQ’s Acquisition Machine

The Elisity deal is the latest in an accelerating IonQ acquisition strategy that has made the company significantly more diversified than its quantum computing origins would suggest.

In July 2026, IonQ received final regulatory approval to complete its acquisition of SkyWater Technology — the largest exclusively U.S.-based semiconductor foundry and a Pentagon-accredited DMEA Category 1A Trusted Foundry — giving IonQ a fully domestic chip fabrication capability. Following the SkyWater close, IonQ raised its full-year outlook to between $450 million and $460 million.

The Elisity deal gives IonQ a different kind of foothold: immediate commercial revenue from an enterprise software business with zero churn and doubling revenue over consecutive years. Following the close, Elisity will continue to operate under IonQ while retaining its leadership team, with Winebrenner and the existing management remaining in charge of the business — the same retention structure IonQ used after the SkyWater integration.

IonQ is positioning the combined entity as a vertically integrated, full-stack quantum platform spanning computing, networking, sensing, and now enterprise cybersecurity — comparing the Elisity addition to how the SkyWater acquisition deepened its hardware capabilities.

Market Reaction and What Comes Next

Despite the strategic logic, investors were not immediately enthusiastic. IonQ shares fell nearly 10% in morning trading on Monday, a reaction that reflects both the dilution inherent in an all-stock transaction of this size and persistent skepticism about whether the quantum industry’s commercial moment has truly arrived — even as IonQ’s financial results increasingly suggest it has.

The company reported second-quarter 2026 revenue of $80.1 million, a 287% year-over-year increase, and its full-year guidance of $450 million to $460 million would mark a category-defining commercial milestone for quantum computing. The gap between that financial performance and the market’s cautious response to the Elisity deal suggests investors are not yet pricing in what a fully integrated quantum-plus-cybersecurity stack could generate in a market where both PQC compliance deadlines and Zero Trust adoption are accelerating simultaneously.

The combination is a bet that the harvest-now threat and the enterprise security response are converging faster than most organizations realize. If de Masi’s Q-Day timeline is right, every day that passes without network access controls shrinks the window enterprises have to limit what adversaries are already collecting. IonQ just paid $1.3 billion to be the company organizations call when they decide to close it.

Frequently Asked Questions

How does Zero Trust microsegmentation actually help against quantum attacks if it’s not a cryptographic tool?

Microsegmentation attacks the harvest phase of “harvest now, decrypt later” directly. Nation-state adversaries currently inside enterprise networks don’t encrypt what they steal — they copy it. Zero Trust policies enforced by Elisity’s IdentityGraph restrict which systems an authenticated user or device can communicate with, so an attacker who has compromised one credential or endpoint cannot freely move to the most sensitive data stores. The result: less data in the adversary’s future-decryption queue. This is why the two layers are complementary rather than redundant — Elisity limits what gets harvested now; IonQ’s PQC and QKD make whatever does get harvested unreadable when Q-Day arrives.

When does my organization actually need to act on this?

Federal agencies face hard deadlines: FIPS 203 compliance for high-value assets by December 31, 2030; FIPS 204 and 205 for digital signatures by December 31, 2031, per White House Executive Order 14412 issued June 22, 2026. Federal contractors are expected to face the same requirements through Federal Acquisition Regulation Council action. For private enterprises without federal contracts, the timeline is self-imposed — but migration experts estimate that large organizations face 12 to 15 years of cryptographic remediation work. That means a company that begins in 2027 might not finish until 2040, well past any credible Q-Day estimate. Zero Trust microsegmentation, by contrast, deploys in under 30 minutes per site and begins limiting exposure immediately, with no hardware replacement required.

What is Q-Day, and how sure is anyone that it’s actually coming?

Q-Day is the moment when a cryptographically relevant quantum computer (CRQC) becomes powerful enough to break RSA and Elliptic Curve Cryptography — the encryption that secures the majority of internet traffic, financial transactions, and government communications. IonQ CEO Niccolo de Masi has predicted Q-Day as early as 2028, though the Cloud Security Alliance has estimated April 14, 2030 as its projected date, and Gartner has said asymmetric cryptographic algorithms will be unsafe by 2029. The uncertainty in the specific date is less important than the asymmetry of the risk: if Q-Day arrives before an organization has migrated its encryption, every data store that nation-states have already harvested becomes readable. The NIST-standardized post-quantum algorithms (FIPS 203, 204, 205) are the accepted fix for the cryptographic layer, and the White House has now mandated their adoption by federal agencies.

How does IonQ’s QKD layer differ from post-quantum cryptography, and do enterprises need both?

Post-quantum cryptography (PQC) uses mathematical problems that are hard for quantum computers to solve, making encrypted data resistant to future quantum decryption. Quantum key distribution (QKD) uses quantum physics — specifically, the principle that measuring a quantum system disturbs it — to distribute encryption keys in a way that makes interception physically detectable. The two approaches address the same underlying problem from different directions: PQC is a software upgrade to existing encryption algorithms; QKD is a hardware-based key exchange that cannot be retroactively decrypted even if a quantum computer is later applied to the captured key material. IonQ’s position, demonstrated commercially through its Congruity360 agreement and Geneva deployment, is that a layered QKD-plus-PQC architecture provides defense-in-depth that neither approach delivers alone. Whether a given enterprise needs QKD depends on how sensitive its data is and how long it must remain confidential — highly sensitive, long-lived data (government, defense, financial) benefits from both layers; enterprises protecting shorter-horizon data may find PQC alone sufficient.