Cloudflare
NETNetwork and edge
San Francisco, United StatesHybrid post-quantum key agreement enabled by default across its edge network.
Company profileVendor landscape
Who supplies the post-quantum transition, from discovery tooling and PKI to secure silicon and quantum key distribution, plus where the capital is going.
- Companies tracked
- 20
- Funding rounds logged
- 10
- Disclosed capital
- $1.29B
Companies
CryptoNext Security
PQC libraries
Paris, FranceC-QRL post-quantum library and integrations for European enterprises.
Company profileDigiCert
PKI and certificates
Lehi, United StatesPublic CA piloting PQC certificate issuance and crypto-agility tooling.
Company profileEntrust
PKI and certificates
Minneapolis, United StatesPKI, HSM and certificate lifecycle products adding PQC support.
Company profileevolutionQ
Advisory and software
Waterloo, CanadaBasejumpQDN quantum-safe key distribution and risk advisory.
Company profileID Quantique
QKD and QRNG
Geneva, SwitzerlandQuantum key distribution systems and quantum random number generators.
Company profileIDEMIA
Secure elements
Courbevoie, FranceSmart cards and secure elements moving to PQC-capable chips.
Company profileInfineon
IFXSemiconductors
Neubiberg, GermanyTPM and secure element silicon with PQC firmware update paths.
Company profileISARA
PQC software
Waterloo, CanadaCrypto-agility tooling and PQC certificate management.
Company profileKeyfactor
Certificate lifecycle
Cleveland, United StatesMachine identity management with PQC-ready certificate automation.
Company profilePalo Alto Networks
PANWNetwork security
Santa Clara, United StatesQuantum-safe VPN and inspection features across its firewall line.
Company profilePQShield
PQC IP and libraries
Oxford, United KingdomHardware IP cores and embedded libraries implementing NIST PQC standards.
Company profileQuantinuum
Quantum and QRNG
Broomfield, United StatesQuantum Origin verifiable quantum randomness alongside quantum computing hardware.
Company profileQuantum Xchange
PQC networking
Bethesda, United StatesPhio TX quantum-safe key delivery across existing networks.
Company profileQuSecure
PQC software
San Mateo, United StatesQuProtect orchestration layer for post-quantum network overlays.
Company profileQuside
QRNG
Castelldefels, SpainQuantum entropy chips for high-throughput key generation.
Company profileSandboxAQ
PQC software
Palo Alto, United StatesCryptographic discovery, inventory and migration tooling (AQtive Guard) for large enterprises.
Company profileThales
HO.PAHSM and security hardware
Paris, FranceLuna HSMs and payment security hardware with PQC firmware support.
Company profileToshiba
6502QKD
Tokyo, JapanLong-distance QKD networking trials with telecom operators.
Company profileUtimaco
HSM and security hardware
Aachen, GermanyGeneral-purpose HSMs shipping quantum-safe firmware.
Company profileFunding rounds
| Company | Round | Amount | Lead investor | Announced |
|---|---|---|---|---|
| SandboxAQ | Growth extension | $450M | Nvidia / Google | 8 Apr 2025 |
| Quantinuum | Series B | $300M | JPMorgan Chase | 20 Nov 2024 |
| CryptoNext Security | Series A | $13M | Bpifrance | 2 Oct 2024 |
| PQShield | Series B | $37M | Addition | 19 Jun 2024 |
| Quside | Series A | $22M | Bullhost Capital | 5 Mar 2024 |
| SandboxAQ | Growth | $300M | T. Rowe Price | 14 Feb 2024 |
| QuSecure | Series A | $28M | Two Bear Capital | 24 Jan 2024 |
| Quantum Xchange | Series B | $15M | New Technology Ventures | 12 Sept 2023 |
| Keyfactor | Growth | $125M | Sixth Street Growth | 11 Jul 2023 |
| evolutionQ | Series A | $5M | Quantonation | 16 May 2023 |
National readiness
Scored on published mandates, standards alignment, inventory requirements and deadline clarity.
United States
North America90The most complete mandate regime in the world. NIST has published the FIPS 203/204/205 standards and set 2030 deprecation and 2035 disallowance for RSA and ECC in IR 8547, NSA CNSA 2.0 binds national security systems to a 2033 exclusive-quantum-resistant date, OMB M-23-02 forces annual cryptographic inventories, and CISA runs cross-sector migration guidance. Federal research funding through DARPA, IARPA and DOE is also aimed squarely at lowering the qubit cost of factoring, which is what actually sets the deadline.
5 programs · view detailGermany
Europe78BSI pushes hybrid key exchange and long-term confidentiality; strong guidance on Classic McEliece and FrodoKEM.
1 program · view detailFrance
Europe76ANSSI mandates hybrid schemes through at least 2030 and is skeptical of PQC-only deployments.
1 program · view detailUnited Kingdom
Europe74NCSC published a three-phase national timeline: discovery by 2028, high-priority migration by 2031, completion by 2035.
1 program · view detailNetherlands
Europe66AIVD/TNO PQC Migration Handbook is widely used across European enterprises.
1 program · view detailCanada
North America64CCCS aligned with NIST standards; federal roadmap targets high-priority systems by 2031.
1 program · view detailChina
Asia-Pacific62China is on a parallel and deliberately independent track. The Institute of Commercial Cryptography Standards ran a national next-generation commercial cryptography competition and shortlisted domestic lattice and hash based schemes rather than adopting the NIST portfolio, and the Cryptography Law plus GM/T commercial standards give Beijing a mandate lever most states lack. Public research output on reducing qubit and circuit requirements for factoring, including hybrid quantum-classical and annealing based attempts, is unusually heavy relative to its published hardware, which is why China is the hardest actor to score.
3 programs · view detailAustralia
Asia-Pacific62ASD set an aggressive 2030 deadline to remove RSA, ECDH and ECDSA from government systems.
1 program · view detailJapan
Asia-Pacific58CRYPTREC evaluating PQC for the next e-Government recommended ciphers list.
0 programs · view detailSouth Korea
Asia-Pacific52KpqC competition selected domestic PQC algorithms; migration master plan targets 2035.
1 program · view detailSingapore
Asia-Pacific50MAS advisory requires financial institutions to build crypto inventories and pilot PQC.
1 program · view detailIndia
Asia-Pacific40Early-stage national roadmap; RBI and MeitY issuing preparatory guidance.
0 programs · view detailDeep dive: the United States, China and the qubit question
Every migration deadline is really a bet on one number: how many qubits it takes to break RSA-2048. That number is not fixed. It has fallen by more than an order of magnitude in six years because the algorithms and error-correction schemes improved, not because the hardware did. Both the United States and China fund work aimed at pushing it lower.
United States
Standardize in the open, mandate hard dates- NIST published FIPS 203 (ML-KEM), 204 (ML-DSA) and 205 (SLH-DSA) in August 2024, with HQC selected in March 2025 as a code-based backup.
- NIST IR 8547 deprecates RSA and ECC at 112-bit security after 2030 and disallows them after 2035.
- NSA CNSA 2.0 binds national security systems to exclusively quantum-resistant algorithms by 2033, with browser, server and firmware milestones earlier.
- OMB M-23-02 and NSM-10 force annual cryptographic inventories and funded migration plans across federal agencies.
- Federal money also flows to the attack side: DARPA Quantum Benchmarking Initiative, IARPA and DOE work exists to find out how few qubits a real attack needs.
Scoring note
High mandate clarity, high standards leverage, uneven execution below the federal level.
China
Build a sovereign stack, disclose selectively- The Institute of Commercial Cryptography Standards ran a national next-generation commercial cryptography competition and shortlisted domestic lattice and hash based public-key schemes instead of adopting the NIST portfolio.
- The Cryptography Law plus GM/T standards let the state require approved domestic algorithms in critical information infrastructure once selection is final.
- Hardware programs are public and credible: the Zuchongzhi superconducting line and the Jiuzhang photonic line, both from CAS and USTC.
- Published Chinese research leans unusually hard on reducing the resource cost of attacks: hybrid quantum-classical factoring, quantum annealing approaches to lattice and factoring problems, and Schnorr-style sublinear-qubit claims.
- Verification is the problem. Capability disclosure is partial, so readiness scoring here carries a wider error bar than for any other tracked state.
Scoring note
Lower published mandate clarity, but a distinct standards path and heavy investment on both sides of the problem.
How many qubits does RSA-2048 actually need?
Shor 1994, textbook circuit
About 2n logical qubits
Roughly 4,100 logical qubits for RSA-2048, with no error correction accounted for. This is the number that gets misquoted.
Read the paperGidney and Ekera 2019
20 million noisy qubits, 8 hours
The reference surface-code estimate that anchored a decade of planning assumptions.
Read the paperGidney 2025
Under 1 million noisy qubits, about 1 week
A 20x reduction in qubit count in six years through approximate modular arithmetic, magic state cultivation and yoked surface codes. The trend line, not the endpoint, is the planning input.
Read the paperChevignard, Fouque and Schrottenloher 2024
About 1,730 logical qubits, very long runtime
Trades qubit width for circuit depth. Shows the qubit threshold is a dial, not a wall, if you are willing to run longer.
Read the paperAnnealing and hybrid claims
Contested
Chinese groups have published D-Wave assisted factoring and Schnorr-lattice hybrid results. Peer review has so far shown these do not scale to RSA-2048, but they define where the research pressure is.
Read the paperPlanning implication: do not anchor your timeline to a qubit count. Anchor it to the length of time your data must stay confidential plus the time your migration will take. If that sum crosses any credible Q-Day estimate, the harvest-now-decrypt-later exposure already exists today.