Business

IonQ to buy zero trust firm Elisity in $1.3bn quantum security bet

IonQ agrees all-stock deal worth up to $1.3bn for zero trust firm Elisity. What it means for UK post-quantum migration and segmentation plans.

Graphic announcing IonQ's up to $1.3bn acquisition of zero trust security firm Elisity

Quantum computing group IonQ has agreed to buy Elisity, a zero trust and microsegmentation company, in an all-stock deal worth up to $1.3bn. The deal shows a quantum vendor buying its way into enterprise network security, and UK buyers should think about what that means for their post-quantum plans.

What happened

On 12 October 2026 IonQ announced a definitive agreement to acquire Elisity, Inc., a US security company founded in 2019. The headline value is up to $1.3bn, paid entirely in IonQ shares. Up to $150m of that is an earnout that depends on how the Elisity business performs after the deal. The number of shares issued will be set at closing using a 20-day volume-weighted average price, with a floor of $33.07 and a cap of $49.61 per share. IonQ expects to complete the transaction in the fourth quarter of 2026, subject to regulatory approval.

According to IonQ, Elisity has more than 100 customer deployments and a track record of doubling its revenue and customer base year on year. Reporting citing the Journal says Elisity’s larger customers include healthcare providers and hospitals. Elisity chief executive James Winebrenner and his management team will stay in place after closing.

Investors were not impressed. IonQ shares fell sharply in Monday trading, with 24/7 Wall St putting the drop at around 9% in the morning session, deeper than the falls at rival quantum firms D-Wave and Rigetti. Because the deal is paid in stock, existing shareholders bear the cost through dilution, and 24/7 Wall St sees that as the main driver of the selloff.

This is not IonQ’s first large purchase. It closed its roughly $1.8bn purchase of chipmaker SkyWater Technology on 31 July. Earlier it completed the purchase of Oxford Ionics, the UK trapped-ion specialist, and took a majority stake in Swiss quantum key distribution firm ID Quantique.

The detail

Elisity sells microsegmentation, which means limiting which users, devices, workloads and, increasingly, AI agents are allowed to talk to each other on a corporate network. Its IdentityGraph component pulls together identity, asset and risk data from its own data and partner tools. It uses that data to recommend least-privilege policies, which administrators can simulate before they enforce them. In practice the aim is to stop ransomware and hands-on-keyboard attackers moving sideways once they are inside.

IonQ’s security portfolio is different. It covers post-quantum cryptography (PQC), quantum key distribution (QKD) and what it calls quantum-safe posture management. IonQ says it has built national quantum-safe communications networks in Switzerland, Poland, Romania and Slovakia. The plan is to sell these products through Elisity’s existing relationships with CISOs, and to add cryptographic inventory and risk data to IdentityGraph so customers can see which systems depend on vulnerable public-key algorithms.

IonQ chief executive Niccolo de Masi framed the purchase around “Q-Day”, the point at which a quantum computer can break widely used public-key cryptography. He also pointed to US executive orders pushing federal agencies towards PQC. Speaking to the Journal, he described the coming period as “the most dangerous years” for cyber risk, citing both AI and quantum capability.

The two halves of the combined business deal with separate problems. Microsegmentation contains attackers who are already inside the network today. PQC protects data against a future capability, including the “harvest now, decrypt later” risk to information with a long shelf life.

Key figures from IonQ's agreement to acquire Elisity, alongside the NCSC 2035 post-quantum migration target

Why it matters for UK organisations

The NCSC has already given UK organisations a timetable. Its PQC migration guidance, aimed primarily at larger organisations and critical national infrastructure operators, says they should finish discovery and an initial migration plan by 2028, complete their highest-priority migrations by 2031 and finish migrating all systems by 2035. The discovery step, working out where cryptography sits across the estate and which suppliers it depends on, is exactly the market IonQ is targeting with cryptographic inventory in IdentityGraph.

IonQ also has real roots in Britain. Oxford Ionics, which it now owns, gives it a UK research base, and it has said it wants to grow in the UK and Europe. UK security teams should expect quantum vendors to pitch them more often, now bundled with familiar zero trust tooling rather than sold as a separate science project.

There is a consolidation angle too. Security vendors continue to consolidate, with SecurityWeek counting roughly 300 deals so far in 2026, and buyers now include companies from outside the traditional security industry. For UK customers that changes product roadmaps, support arrangements and, sometimes, where data is processed. Any organisation using Elisity, or weighing up a segmentation purchase, should ask what the change of ownership means for those points before renewal.

Expert view

From a testing point of view, the Elisity half of this deal is what matters to defenders now. When we test flat networks, lateral movement is nearly always how a foothold on one laptop becomes domain-wide compromise. Microsegmentation that is actually enforced, not just left in monitoring mode, is one of the most effective controls I see. It is also among the hardest to finish, because few businesses know which systems genuinely need to talk.

The quantum half needs more caution. PQC migration is real and the NCSC dates are sensible, but most of the work is unglamorous: building a cryptographic inventory, finding hard-coded algorithms, chasing suppliers for roadmaps and replacing long-lived hardware. QKD is a niche technology that needs specialist hardware and dedicated links, so for most organisations software-based PQC is the practical route. Be wary of any pitch that suggests buying quantum hardware is a substitute for the inventory work.

In my experience, mergers like this succeed or fail on integration. Paying in stock with an earnout gives Elisity’s team a reason to keep growing the existing product, which is good for current customers. The risk is that the roadmap starts serving the parent’s cross-selling goals more than the customer’s segmentation problem.

What to do now

  1. Start or refresh your cryptographic discovery. List where public-key cryptography is used, including VPNs, TLS termination, code signing, PKI and embedded devices, so you are on course for the NCSC’s 2028 milestone.
  2. Put PQC questions into supplier reviews. Ask key vendors for their post-quantum roadmaps and for how they would handle crypto agility, and record the answers in your supply chain risk register.
  3. Prioritise lateral movement controls today. Segmentation and least-privilege access support the Cyber Essentials firewall, secure configuration and user access control themes, and they limit ransomware damage regardless of any quantum timeline.
  4. Check change of ownership terms. If you use Elisity or a similar vendor that is being acquired, review contract clauses on data location, support levels and termination rights before the deal closes.
  5. Treat quantum pitches with healthy scepticism. Judge bundled PQC or QKD offers against NCSC guidance, and expect evidence of standards-based algorithms rather than proprietary claims.

Bottom line

IonQ is paying up to $1.3bn in its own shares to gain an enterprise security business and a sales route to CISOs, and its investors have doubts. For UK defenders, the useful point is not the quantum branding but the reminder that two jobs run side by side: containing attackers already on the network now, and finding and replacing vulnerable cryptography before the NCSC’s 2035 target date.

Sources

Related Posts