IonQ acquires Elisity to merge zero-trust controls with quantum security

Organisations facing accelerating timelines for post-quantum cryptography adoption are seeing a major consolidation in the security sector, as quantum computing firm IonQ moves to acquire zero-trust vendor Elisity. The Maryland-based company announced on Monday that it has signed a definitive agreement to buy the California-based security firm in an all-stock transaction valued at up to $1.3 billion. According to SecurityWeek, the deal includes up to $150 million in earnout consideration, contingent on future business performance, and is expected to close in the fourth quarter of 2026.

The acquisition merges Elisity’s enterprise access control technology with IonQ’s existing portfolio of post-quantum cryptography (PQC) and quantum key distribution (QKD) solutions. Elisity, founded in 2019, provides software that restricts network communication between users, devices, workloads and AI agents based on least-privilege policies. Its IdentityGraph component aggregates data from identity, asset and risk tools to guide access decisions. IonQ plans to leverage Elisity’s more than 100 customer deployments and established relationships with chief information security officers to expand its reach into enterprise and government sectors.

What we know

The strategic rationale behind the deal centres on addressing what the companies describe as a two-front security challenge: conventional machine-speed attacks and the long-term risk of quantum decryption. IonQ Chairman and CEO Niccolo de Masi stated that "Q-Day is coming much faster than predicted," referring to the point when quantum computers could break widely used public-key encryption. This urgency is compounded by recent White House executive orders that have pushed federal agencies to accelerate their migration to PQC, with some industry leaders moving their own timelines to 2029 or earlier.

Elisity CEO James Winebrenner noted that customers need to prioritise post-quantum initiatives while securing existing assets to keep essential operations running. He wrote that access controls reduce exposure, while cryptographic upgrades address underlying weaknesses. The two companies plan to integrate cryptographic inventory and risk data into IdentityGraph. This enhancement will help organisations determine which post-quantum upgrades to tackle first by weighing business risk against the criticality of affected operations.

According to CyberScoop, Elisity reports no churn among its deployed customers and has doubled its revenue and customer base year over year. The startup has raised more than $70 million. Once the acquisition closes, Winebrenner and the existing Elisity management team will retain control of the business. Industrial Cyber reported that the move opens access to a microsegmentation market estimated at more than $10 billion with double-digit compound annual growth rates.

Defender's checklist

• Review current network access policies to ensure they enforce least-privilege principles for all users, devices and AI agents, independent of underlying network technology.
• Identify critical infrastructure and data assets that require immediate protection against conventional attacks while longer-term cryptographic upgrades are planned.
• Assess existing cryptographic inventories to understand which systems rely on public-key encryption that may be vulnerable to future quantum decryption techniques.
• Monitor official guidance from federal agencies and industry bodies regarding accelerated timelines for post-quantum cryptography adoption and migration strategies.

Background: Post-quantum cryptography

Post-quantum cryptography replaces standard encryption algorithms with mathematical problems resistant to quantum computing attacks. It protects long-term data but increases computational load and key sizes. Adopt it only for sensitive, long-lived data or systems with long upgrade cycles, as it offers little benefit for short-lived sessions.

Read the full guide: Post-Quantum Cryptography: Real Benefits and Hidden Costs

What to do and how to stay safe: IonQ

• Audit your organisation’s identity and access management systems to verify that least-privilege controls are applied consistently across all network segments and cloud environments.
• Catalogue all cryptographic assets and dependencies to create a baseline for prioritising post-quantum cryptography upgrades based on business risk and asset criticality.
• Engage with security vendors to understand how their existing solutions, including zero-trust platforms, plan to integrate post-quantum cryptography capabilities in future updates.
• Develop a phased migration plan for cryptographic upgrades that balances immediate operational security needs with long-term resilience against quantum decryption threats.

General security guidance from the TechWire Beat newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

When is the IonQ acquisition of Elisity expected to close?

IonQ expects to complete the acquisition in the fourth quarter of 2026, according to the definitive agreement announced on Monday.

How does Elisity’s technology complement IonQ’s existing security offerings?

Elisity’s least-privilege access controls and IdentityGraph platform will be integrated with IonQ’s post-quantum cryptography and quantum key distribution capabilities to help customers prioritise security upgrades.

What is the financial structure of the deal between IonQ and Elisity?

The transaction is an all-stock deal valued at up to $1.3 billion, with up to $150 million in earnout consideration contingent on Elisity’s future business performance.