Cybersecurity is entering a new phase as organizations confront increasingly complex threats across enterprise networks, cloud platforms, connected devices, and AI powered systems. At the same time, advances in quantum computing are encouraging businesses to reassess whether their current encryption strategies will remain secure in the years ahead.
IonQ’s announced agreement to acquire Zero Trust cybersecurity company Elisity in an all stock transaction valued at up to $1.3 billion highlights the growing convergence of enterprise security and quantum technologies.
Announced on October 12, 2026, the proposed acquisition brings Elisity’s identity based access controls and network security capabilities together with IonQ’s post quantum cryptography and quantum key distribution offerings. The transaction is expected to close in the fourth quarter of 2026, subject to customary closing conditions and regulatory approval. The deal includes up to $150 million in performance based earnout consideration.
Beyond the financial value, the announcement reflects a broader industry shift: organizations need to defend against current cyber threats while preparing their infrastructure for emerging risks.
Why IonQ Is Acquiring Elisity
IonQ is known for its work in quantum computing and related technologies, including quantum networking and security. Elisity focuses on enterprise Zero Trust security, helping organizations control communications between users, devices, workloads, and AI agents.
The acquisition is intended to combine these complementary capabilities.
Elisity’s IdentityGraph technology brings together identity, asset, and risk information to help organizations determine which systems should communicate with one another. Its policy enforcement capabilities allow businesses to restrict unnecessary connections and apply least privilege access rules across their environments.
IonQ, meanwhile, offers security technologies including post quantum cryptography (PQC) and quantum key distribution (QKD).
The combined strategy aims to help organizations manage present day security risks while planning for future cryptographic challenges.
According to the companies’ announcement, Elisity has more than 100 customer deployments. Its existing customer relationships could also help IonQ expand its reach into enterprise and government security markets.
Understanding Zero Trust Security
Zero Trust is based on a simple principle: access should never be granted automatically just because a user, device, or application is already inside a trusted network.
Every access decision should be evaluated according to identity, authorization, context, and risk.
Traditional network security has often relied heavily on perimeter defenses. However, modern organizations operate across cloud platforms, remote offices, data centers, third party services, and connected devices. Once an attacker gains access to one part of an environment, excessive permissions and unrestricted network communication can make it easier to move toward other systems.
Zero Trust helps address this challenge through controls such as:
- Identity based access policies
- Least privilege permissions
- Continuous verification of access
- Network segmentation and microsegmentation
- Device and workload security
- Monitoring of suspicious activity
- Restricted communication between systems
- Centralized policy enforcement
These controls can help limit the impact of compromised credentials, ransomware, insider threats, and unauthorized access.
Why Microsegmentation Matters
Microsegmentation is an important component of modern Zero Trust architectures.
Rather than allowing broad communication across an internal network, organizations define which users, devices, applications, and workloads are permitted to interact.
For example, if a workstation is compromised, carefully designed segmentation policies can help prevent the attacker from reaching sensitive databases, administrative systems, or other critical workloads.
Microsegmentation can help organizations:
Limit lateral movement: Reduce the ability of attackers to move between systems after gaining initial access.
Protect critical assets: Restrict access to sensitive applications, business systems, and infrastructure.
Reduce the attack surface: Eliminate unnecessary network connections and permissions.
Improve visibility: Help security teams understand which identities and workloads communicate across the environment.
Support incident containment: Reduce the number of systems potentially affected by a compromised account or device.
For enterprises operating complex hybrid environments, these capabilities can strengthen resilience without requiring every underlying network component to be replaced.
The Quantum Computing Connection
One of the most significant aspects of the proposed acquisition is its connection to quantum security.
Quantum computing could eventually create risks for certain widely used public key cryptographic algorithms. Although practical, large scale quantum computers capable of breaking today’s commonly deployed public key systems are not yet a demonstrated reality, organizations should prepare for the possibility that cryptographic assumptions may change.
A particularly important concern is known as harvest now, decrypt later.
In this scenario, an attacker collects encrypted information today with the intention of decrypting it in the future if sufficiently capable quantum technology becomes available.
This risk is especially relevant for information that must remain confidential for many years, including sensitive government records, healthcare information, intellectual property, financial data, and critical infrastructure communications.
Organizations therefore need to consider not only today’s security requirements but also how long their information must remain protected.
Post Quantum Cryptography and Quantum Key Distribution
IonQ’s existing security portfolio includes two technologies that address different aspects of quantum related risk.
Post Quantum Cryptography
Post quantum cryptography uses cryptographic algorithms designed to resist attacks from both classical and sufficiently capable quantum computers.
Organizations can prepare for this transition by identifying where cryptography is used, determining which systems depend on vulnerable algorithms, and developing a phased migration plan.
Quantum Key Distribution
Quantum key distribution uses quantum communication principles to support the establishment of cryptographic keys and detect certain forms of interception under appropriate implementation conditions.
It is a specialized approach that may be useful for particular high security communication environments. It is not a universal replacement for conventional cryptography or post quantum cryptographic algorithms.
Both technologies require careful evaluation against an organization’s threat model, technical architecture, operational needs, and regulatory requirements.
Why Cryptographic Agility Is Becoming Essential
Preparing for quantum related threats is not simply a matter of installing a new encryption product.
Organizations often rely on cryptography across thousands of applications, network devices, APIs, cloud services, digital certificates, authentication systems, and third party integrations.
Without an accurate inventory, security teams may struggle to determine where vulnerable cryptographic algorithms are used or which systems should be prioritized for upgrades.
Cryptographic agility refers to an organization’s ability to replace or update cryptographic algorithms and protocols without requiring extensive redesign of its entire technology environment.
A practical strategy should include:
- Discovering cryptographic assets and dependencies
- Identifying systems that use vulnerable algorithms
- Assessing the sensitivity and expected lifetime of protected data
- Prioritizing high risk applications and critical infrastructure
- Evaluating post quantum cryptographic standards
- Testing compatibility and performance before migration
- Reviewing third party and supplier dependencies
- Monitoring the security of cryptographic implementations
- Maintaining a documented migration roadmap
The proposed integration of cryptographic inventory and risk information into Elisity’s IdentityGraph is intended to help organizations prioritize upgrades while maintaining visibility into access relationships and existing infrastructure.
AI Agents Introduce Another Identity Security Challenge
Modern enterprise environments increasingly include AI agents that can access applications, retrieve information, and execute tasks.
These agents may have permissions similar to those of users, service accounts, or applications. If access is excessive or poorly monitored, an AI agent could unintentionally expose information or become a pathway for unauthorized activity.
Zero Trust principles can help organizations manage these risks by treating AI agents and other non human identities as entities that require explicit authorization.
Organizations should consider:
- Assigning each agent only the permissions it needs
- Restricting access to sensitive applications and data
- Monitoring agent activity and tool usage
- Controlling communications between agents and other systems
- Reviewing credentials and service account privileges
- Logging important actions for investigation and audit
- Testing AI systems for unauthorized access and data exposure
As AI becomes more deeply integrated into enterprise operations, identity governance and least privilege access will become increasingly important elements of AI security.
What Organizations Should Do Now
Businesses do not need to wait for quantum computing advances or major technology acquisitions to strengthen their security posture.
Several practical measures can improve resilience today.
1. Assess your Zero Trust maturity.
Review identity controls, access policies, segmentation, privileged accounts, and remote access mechanisms. Identify where users and workloads have unnecessary permissions.
2. Map critical assets and communications.
Build an inventory of important applications, devices, workloads, data stores, and their network relationships. Use this information to identify paths an attacker could exploit.
3. Start a cryptographic inventory.
Determine where encryption, digital certificates, public key algorithms, and cryptographic libraries are used. Prioritize systems protecting long lived sensitive information.
4. Develop a post quantum readiness roadmap.
Evaluate relevant standards, vendor support, interoperability, operational impact, and migration timelines. Test proposed changes before deploying them in production.
5. Strengthen AI identity governance.
Treat AI agents, service accounts, and automated workflows as identities that require defined permissions, monitoring, and accountability.
6. Monitor access and network activity continuously.
Correlate identity events, endpoint activity, network communications, and unusual data access to improve detection and incident response.
7. Validate security through testing.
Penetration testing, architecture reviews, configuration assessments, and incident response exercises can help reveal gaps before attackers exploit them.
Industries That Should Pay Attention
The convergence of Zero Trust, quantum readiness, and identity security has implications across many sectors.
Financial Services and Banking
Banks, payment providers, investment firms, and fintech organizations manage sensitive financial data and high value transactions. Zero Trust architecture, identity security assessments, network segmentation, and cryptographic readiness reviews can help protect critical services and reduce unauthorized access.
Healthcare and Life Sciences
Healthcare organizations must protect patient information, medical applications, research data, and connected clinical systems. Access controls, secure network segmentation, cloud security assessments, and post quantum readiness planning can help safeguard sensitive information over its required confidentiality lifetime.
Government and Public Sector
Government agencies often manage sensitive records, critical services, and long term confidential information. Zero Trust assessments, network security testing, identity governance, cryptographic inventory, and post quantum migration planning can help strengthen national and organizational resilience.
Manufacturing and Industrial Organizations
Manufacturers depend on interconnected production systems, operational technology, enterprise applications, and supplier networks. Network segmentation, device access controls, vulnerability assessments, and security monitoring can help reduce the risk of attacks spreading between IT and operational environments.
Retail and E-commerce
Retailers handle customer data, payment systems, online applications, and third party integrations. Application security testing, API assessments, identity controls, and cloud security reviews can help protect digital services and reduce the risk of account compromise.
Technology and SaaS Companies
Technology providers often operate complex cloud environments and manage customer data across interconnected applications. Zero Trust architecture reviews, AI agent security assessments, secure development practices, cryptographic inventory, and penetration testing can help improve protection across their platforms.
Conclusion
IonQ’s proposed acquisition of Elisity for up to $1.3 billion highlights an important direction for cybersecurity: the convergence of Zero Trust access controls, enterprise network protection, and preparation for quantum related cryptographic risks.
Organizations must continue defending against today’s threats, including ransomware, compromised identities, lateral movement, and insecure AI integrations. At the same time, they should begin understanding their cryptographic dependencies and planning for future security transitions.
The path forward requires more than adopting a single product or technology. It involves understanding assets and identities, enforcing least privilege, improving network visibility, protecting sensitive information, and preparing for changes in the cryptographic landscape.
Businesses that begin these activities now will be better positioned to strengthen cyber resilience, manage emerging risks, and protect critical operations as cybersecurity technologies continue to evolve.
About COE Security
COE Security partners with organizations in financial services, healthcare, retail, manufacturing, and government to secure AI-powered systems and ensure compliance.
Our offerings include:
- AI-enhanced threat detection and real-time monitoring
- Data governance aligned with GDPR, HIPAA, and PCI DSS
- Secure model validation to guard against adversarial attacks
- Customized training to embed AI security best practices
- Penetration Testing (Mobile, Web, AI, Product, IoT, Network & Cloud)
- Secure Software Development Consulting (SSDLC)
- Customized CyberSecurity Services
Follow COE Security on LinkedIn for ongoing insights into safe, compliant AI adoption.
In addition, COE Security helps organizations strengthen Zero Trust architecture, identity and access management, network segmentation, cloud security, cryptographic risk assessment, AI agent security, vulnerability management, and incident response readiness.
For financial services and banking, we help assess identity systems, APIs, payment environments, privileged access, and network controls to reduce the risk of unauthorized access and protect sensitive financial information.
For healthcare and life sciences, we help secure patient information, clinical applications, cloud environments, connected devices, and third party integrations while supporting relevant data protection and compliance requirements.
For government and public sector organizations, we help evaluate access controls, critical infrastructure security, network segmentation, cryptographic dependencies, and security monitoring to strengthen resilience and support long term security planning.
For manufacturing and industrial organizations, we help assess IT and operational technology environments, review network segmentation, conduct penetration testing, identify vulnerabilities, and strengthen monitoring across connected infrastructure.
For retail and e-commerce businesses, we help protect customer facing applications, APIs, payment environments, digital identities, and cloud platforms through security assessments and targeted testing.
For technology and SaaS companies, we help strengthen cloud and application security, assess AI agent permissions, review identity architecture, test security controls, and evaluate cryptographic readiness as part of broader security improvement programs.
COE Security also helps organizations assess their readiness for emerging cybersecurity challenges through architecture reviews, penetration testing, vulnerability assessments, secure development consulting, AI security evaluations, and risk based recommendations aligned with business and compliance needs.
Our goal is to help organizations identify security gaps, reduce cyber risk, protect sensitive information, improve resilience, and maintain compliance as enterprise technologies and cybersecurity threats continue to evolve.
Follow COE Security on LinkedIn for practical insights into Zero Trust, AI security, quantum readiness, compliance, and emerging cyber threats to stay updated and cyber safe.
Click to read our LinkedIn feature article