Post-Quantum Cryptography Vendors in 2026: Who Does What, by Migration Stage

Post-quantum cryptography vendors do different jobs, and most “best PQC vendors” lists mix them together. A discovery platform finds quantum-vulnerable cryptography. A library or HSM implements the new algorithms. A PKI issues certificates that use them. A gateway carries traffic for a system that can’t change. None of them controls which systems can reach a device that will run old cryptography for years. This 2026 guide sorts the most-named vendors by job, in each vendor’s own words, and maps each category to a migration stage.

The standards are settled. NIST published FIPS 203 (ML-KEM), FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA) on August 13, 2024, and finalized NIST IR 8547 on October 27, 2026. That report says NIST “will deprecate quantum-vulnerable public-key cryptography after 2030 and disallow its use under NIST standards and guidelines after 2035” (NIST IR 8547, October 2026). The vendor question is what moves your estate to those algorithms, and what covers the systems that can’t move.

PQC vendors by category: which job does each one do?

PQC vendors by category split into seven jobs, and most enterprise programs need several of them. The table shows what each category solves, what it leaves to another category, and where it sits in the migration.

How this guide was built. The vendors below are those most often named by ChatGPT, Claude, Perplexity, Gemini, Grok and Google AI Overviews for “best post-quantum cryptography vendors” on November 1, 2026, plus vendors in categories those answers left out. Descriptions come from vendor documentation as of November 2026. Inclusion is not a ranking or endorsement. In October 2026, IonQ announced an agreement to acquire Elisity, with closing expected in the fourth quarter of 2026.

Cryptographic discovery and inventory (CBOM) tools

Cryptographic discovery and inventory tools find where an organization uses quantum-vulnerable cryptography, so government roadmaps put them first. The UK NCSC asks organizations to “carry out a full discovery exercise” by 2028 (NCSC, March 20, 2025). Tools differ by where they look: source code, binaries, file systems, network traffic, certificates or other security tools’ data.

• SandboxAQ (AQtive Guard): SandboxAQ says AQtive Guard “discovers hidden cryptographic assets, maps their blast radius, and enforces machine-speed remediation, all from a single deployment,” with “complete cryptographic inventory, vulnerability detection, and PQC migration planning” (AQtive Guard). SandboxAQ announced FedRAMP Ready status for AQtive Guard.
• IBM (Quantum Safe Explorer, Guardium Cryptography Manager): IBM says Quantum Safe Explorer performs “source code scanning to identify cryptographically relevant artifacts that may be vulnerable to quantum attacks” and generates an inventory that can include a CBOM (IBM documentation). IBM Guardium Cryptography Manager can import those results.
• Keyfactor (AgileSec): Keyfactor says AgileSec “helps you discover cryptography, understand where it’s used, and identify hidden vulnerabilities” (Keyfactor). AgileSec came from InfoSec Global, which Keyfactor acquired with CipherInsights, a passive network sensor, in May 2025 (Keyfactor, May 13, 2025).
• CryptoNext Security (Compass): CryptoNext describes Compass as a “comprehensive discovery platform,” sold alongside a PQC library and a remediation SDK (CryptoNext).
• ISARA (Advance): ISARA describes ISARA Advance as a cryptographic inventory and risk assessment product that catalogs cryptographic assets and scores risk (ISARA).
• AppViewX: AppViewX documents agentless scans whose results are “consolidated into the Crypto Inventory and evaluated for Post-Quantum Cryptography (PQC) readiness,” including data reused from vulnerability management platforms such as Tenable (AppViewX documentation).
• Entrust: Entrust says its PQC solutions help organizations “assess risks, inventory assets, prioritize data protection, and ensure crypto-agility” (Entrust).
• Palo Alto Networks: Palo Alto Networks says it provides visibility into cryptographic risk and vulnerable assets without new sensors (Palo Alto Networks); ask which traffic and devices that visibility covers.
• Elisity (Quantum Posture): Elisity Quantum Posture classifies the endpoints Elisity observes on the network (assets, internal services and external services) as quantum vulnerable, quantum ready or quantum safe, and labels an endpoint “insufficient evidence” when there isn’t enough to classify it, instead of guessing. It shows posture by scope and as a trend over time. Because the same platform identifies each device in IdentityGraph and enforces segmentation, a quantum-vulnerable asset that can’t migrate can be limited to the systems it must reach (see compensating controls). Like other network-based tools, it sees the cryptography in observed traffic, so code, binaries and firmware still need the tools above and manufacturer attestations, and a quantum safe result describes the cryptography observed, not the whole device.
• Encryption Consulting (CBOM Secure and advisory services): Encryption Consulting describes CBOM Secure as its “enterprise Cryptography Bill of Materials platform” and also sells PQC advisory services (Encryption Consulting, May 1, 2026).
• Open source: the Post-Quantum Cryptography Alliance publishes CBOMkit and sonar-cryptography for code scanning and CBOM generation, and Cisco’s Mercury network traffic analyzer includes a cryptographic assessment option.

No discovery tool finishes the job alone. GAO reports that officials at the Office of the National Cyber Director said “automated tools can assist with creating a cryptography inventory but cannot be relied on to fully complete one” (GAO-27-108740, October 6, 2026). Cryptography compiled into firmware and supplier components needs written vendor attestations, and CISA’s strategy for automated discovery and inventory tools (2024) sets out the federal approach.

PQC libraries, IP and hardware security modules

PQC libraries, IP cores and hardware security modules implement the new algorithms inside software, chips and key-protection hardware. Ask for the validation that matches the component you will deploy: a CAVP certificate validates an algorithm implementation, while a FIPS 140-3 (CMVP) certificate validates a whole cryptographic module. Confirm the certificate lists ML-KEM or ML-DSA as approved.

• PQShield: PQShield says PQCryptoLib-Core “is a FIPS 140-3 CMVP Certified / CAVP Compliant general-purpose cryptographic library,” offers PQMicroLib-Core for embedded and memory-constrained devices, and sells PQPlatform hardware IP with ML-KEM and ML-DSA (PQShield).
• SafeLogic: SafeLogic describes CryptoComply as “validated cryptographic software” and SafePQ as “enterprise PQC software for hybrid migration and quantum readiness” (SafeLogic).
• ISARA (Radiate): ISARA describes Radiate as a library and SDK with ML-KEM and ML-DSA for TLS upgrades, hybrid deployments and embedded systems (ISARA).
• DigiCert (TrustCore SDK): DigiCert lists a “C-SDK embedded security toolkit with support for ML-KEM, ML-DSA, TLS 1.3, and FIPS 140-3 certified crypto” (DigiCert documentation).
• Thales (Luna HSM): Thales documents that “ML-DSA and ML-KEM algorithms are available using Luna HSM Firmware 7.9.0 or newer,” a release dated July 2025, and LMS-HSS from firmware 7.8.9 (Thales documentation).
• Entrust (nShield): Entrust says its PQ-ready PKI issues “hybrid and pure PQC certificates backed by HSMs that support all standardized NIST algorithms,” and that its CodeSafe suite provides cryptographic functions based on the NIST PQC algorithms (Entrust solution brief).
• Utimaco: Utimaco says its u.trust General Purpose HSM with Quantum Protect “delivers high-performance, tamper-resistant execution of PQC algorithms” (Utimaco).
• Crypto4A (QxHSM): Crypto4A describes its HSMs as “purpose-built for post-quantum cryptography and modern key management” (Crypto4A).
• Open source: OpenSSL 3.5 added support for ML-KEM, ML-DSA and SLH-DSA, and the Open Quantum Safe project describes liboqs as “an open source C library for quantum-safe cryptographic algorithms” (Open Quantum Safe).

An HSM without a PQC firmware path is itself a system that can’t migrate.

PKI and certificate lifecycle for PQC

PKI and certificate lifecycle vendors issue the certificates that carry ML-DSA and SLH-DSA signatures and automate their renewal. The hard part is usually the relying side: browsers, devices and applications that must accept the new certificates.

• Keyfactor (EJBCA, Command): Keyfactor says “EJBCA issues PQC and hybrid certificates, and Keyfactor Command automates lifecycle at scale” (Keyfactor). EJBCA documents composite keys that combine an RSA, ECDSA or EdDSA key with an ML-DSA key (EJBCA documentation).
• DigiCert: DigiCert documents issuance of pure ML-DSA certificates through Private CA and says it “supports private certificates with ML-DSA, SLH-DSA, and ML-KEM algorithms, depending on the service” (DigiCert documentation).
• Entrust: Entrust’s PQ-ready PKI issues hybrid and pure PQC certificates, per its solution brief.

Quantum-safe network, VPN and SASE

Quantum-safe network, VPN and SASE vendors add PQC key exchange to equipment and services you may already run, which is often the cheapest route because the hardware is in place. CISA lists networking hardware and software among product categories still “transitioning” to PQC (CISA, January 23, 2026), so check your model, release and license.

• Cloudflare: Cloudflare says “all websites and APIs served through Cloudflare over TLS 1.3 support post-quantum hybrid key agreement,” supports hybrid key agreement to origins, and offers post-quantum IPsec tunnels (Cloudflare documentation).
• Palo Alto Networks: Palo Alto Networks documents quantum-resistant IKEv2 VPNs using RFC 8784 and, for hybrid post-quantum key exchange, RFC 9242 and RFC 9370 (Palo Alto Networks documentation).
• Fortinet: Fortinet documents PQC for IPsec key exchange in FortiOS 7.6.5 (Fortinet documentation) and, in FortiOS 8.0, IKEv2 signature authentication with ML-DSA and SLH-DSA (Fortinet documentation). Fortinet also notes that enabling PQC “can impact tunnel setup rates across most vendors” (Fortinet).
• Cisco: Cisco documents ML-KEM for IKEv2 on C8100 through C8500 Series Secure Routers from IOS XE 26.1 (Cisco documentation).
• Zscaler: Zscaler says Zscaler Internet Access “can now provide real-time inspection of PQC traffic,” using hybrid key exchange that recognizes ML-KEM (Zscaler solution brief).

Each protects traffic from the PQC-capable device onward, not the legacy hop behind it.

PQC gateways and network encryptors

PQC gateways carry a legacy system’s traffic over PQC-protected tunnels when the system itself can’t change, and network encryptors protect the links between sites. Gartner advises CISOs to “plan containment or accelerate the retirement of systems that cannot migrate,” using “encapsulation, cryptographic shims or PQC-protected channels only as governed interim measures” (Gartner research (Elisity reprint), September 17, 2026). Software gateways and inline network encryptors both fit that description.

• QuSecure (QuProtect R3): QuSecure says QuProtect R3 “discovers the cryptography in use across a network, changes it to NIST post-quantum algorithms by policy at the network layer without application code changes, and generates a CycloneDX cryptographic bill of materials on demand” (QuSecure).
• IBM (Quantum Safe Proxy): IBM lists a Quantum Safe Proxy in its Quantum Safe portfolio, which it says helps organizations “implement post-quantum cryptography, and manage cryptographic posture over time” (IBM).
• Quantum Xchange (Phio TX): Quantum Xchange says Phio TX “upgrades existing network infrastructure, including Cisco routers and SD-WAN environments,” to quantum-safe encryption without hardware replacement (Quantum Xchange).
• Arqit (NetworkSecure): Arqit says NetworkSecure “combines NIST-standardised post-quantum key exchange with proven quantum-safe cryptography” (Arqit).
• Palo Alto Networks: Palo Alto Networks describes real-time cipher translation for modern and legacy environments (Palo Alto Networks).
• SSH Communications Security (NQX): SSH says NQX “encrypts data in transit at Layer 2 (Ethernet) and Layer 3 (IP) at up to 100 Gbps line rate,” using hybrid key exchange with ML-KEM and FrodoKEM (SSH).
• Thales (High Speed Encryptors): Thales says HSE “supports NIST-standardized PQC: ML-KEM (FIPS 203) for quantum-resistant key establishment, and ML-DSA (FIPS 204) and SLH-DSA (FIPS 205) for digital signatures,” at up to 100 Gbps depending on platform and configuration (Thales solution brief).
• Senetas (CN Series): Senetas says it “already runs post-quantum algorithms in hybrid mode on certified encryptors” (Senetas).

A gateway protects traffic from itself to the far end. The device-to-gateway link keeps the device’s old cryptography, or none at all, and forged firmware signatures still pass, so place the gateway as close to the device as you can. Network encryptors protect links between sites; they protect a legacy system only from the site edge onward.

Compensating controls for systems that can’t migrate

Compensating controls for systems that can’t migrate limit who can reach a device that will keep quantum-vulnerable cryptography until it is replaced: PLCs, medical devices, building controllers, embedded IoT and applications with hardcoded cryptography. Most PQC vendor roundups omit this category; government guidance doesn’t. CISA wrote that “entities should prioritize network segmentation for legacy OT, end-of-life software, and platforms that require extensive time to apply updates” (CISA, Post-Quantum Considerations for Operational Technology, October 2024). Canada’s Cyber Centre says it “may be necessary to isolate such systems on the network,” or to tunnel their traffic (ITSM.40.001, June 23, 2025).

The approaches in this category:

• Identity-based microsegmentation: policy based on what each device is, enforced where it connects.
• OT segmentation and industrial firewalls: zones and conduits (IEC 62443) between plant cells and the enterprise; coarse within a cell, where devices on the same switch can still reach each other.
• Network access control (NAC) with access lists: port admission plus static switch access lists, maintained by hand on each switch.
• Host firewalls: where the device can run one, which many legacy devices can’t.

Elisity (identity-based microsegmentation). Elisity is a security platform for users, devices, workloads and AI agents. For systems that can’t migrate to post-quantum cryptography, it limits which systems can reach them. IdentityGraph identifies each device from network observations plus identity, endpoint, CMDB, IoT and cloud tools; policy is simulated against observed traffic before the Dynamic Policy Engine enforces it at supported enforcement points in your existing network infrastructure, anywhere on the asset’s traffic path, from where a device connects to the data center or cloud application it talks to, with no agent on the protected device. Elisity can restrict a device that can’t migrate to its PQC gateway and the few systems it must reach; that limits who can connect to the device but does not make the device-to-gateway hop confidential. To control who can reach that hop, an enforcement point has to sit between the device and the gateway, which in a plant is usually the industrial switch. If that switch isn’t a supported enforcement point, Elisity still enforces further along the path, such as at the data center or cloud application the device talks to, but traffic that stays between the device and its gateway on that switch, or passes directly between two clients of one wireless access point, isn’t controlled. Elisity does not encrypt, decrypt or alter traffic, does not protect permitted traffic from harvest-now-decrypt-later collection, and does not fix forged signatures. Its Quantum Posture view, listed under discovery above, shows which devices use quantum-vulnerable cryptography, so the ones that can’t migrate can be segmented first.

Microsegmentation does not replace cryptographic migration. Traffic on permitted paths can still be recorded now and decrypted later, and a device with a quantum-vulnerable signature check still accepts a forgery. Pair it with a PQC gateway and a dated replacement plan. Elisity’s guide to protecting systems that can’t be upgraded to post-quantum cryptography covers the gateway-plus-segmentation pattern.

Quantum key distribution (QKD) and quantum networking

Quantum key distribution (QKD) vendors distribute keys using quantum physics over dedicated optical hardware, a different technology from PQC algorithms, considered mainly for specific point-to-point links rather than a whole estate. QKD does not provide authentication, so it still depends on other cryptography, and the UK NCSC says it “will not support the use of QKD for government or military applications” (NCSC, Quantum networking technologies, August 5, 2025).

• Toshiba: Toshiba announced “combined post quantum cryptography (PQC) and quantum key distribution (QKD) capabilities natively available in Toshiba products” (Toshiba, March 5, 2025).
• ID Quantique: ID Quantique describes its Clavis XG QKD portfolio as covering “multiple use cases, from short to long distances,” with interoperability with major Ethernet and OTN encryption vendors (ID Quantique). Disclosure: IonQ owns ID Quantique; see “How this guide was built.”
• QNu Labs: QNu Labs sells Armos for QKD, Tropos for quantum random number generation and Hodos, which it describes as “NIST-compliant Post-Quantum Cryptography enhanced with quantum-physics entropy” (QNu Labs).
• Quantinuum (Quantum Origin): Quantinuum says Quantum Origin uses a quantum computer to generate a cryptographic seed, and that its software “uses the embedded seed to enhance existing randomness in the target system” (Quantinuum). It strengthens randomness; it is not a PQC algorithm.

How to choose PQC vendors by migration stage

Choose PQC vendors by migration stage, because each stage needs a different category, and the UK NCSC and US federal roadmaps both start with discovery.

Federal deadlines are now in force for high value assets and high impact systems. Executive Order 14412 directs agencies to “transition all HVAs and high impact systems to use PQC for key establishment by December 31, 2030” and for digital signatures by December 31, 2031 (EO 14412, June 22, 2026). NIST IR 8547, citing OMB M-26-15 (June 24, 2026), adds that “systems that cannot support post-quantum cryptography should be identified and prioritized for replacement or decommissioning.” For US national security systems, NSA’s CNSA 2.0 guidance expects new acquisitions to be CNSA 2.0 compliant from January 1, 2027, unless otherwise noted.

Before you buy, get the exact algorithms, the FIPS 140-3 module certificate and the points where protection ends in writing. The 2027 cybersecurity budget planning guide turns these stages into budget lines.

Post-quantum cryptography vendor list: summary table

This post-quantum cryptography vendor list summarizes the entries above, alphabetically, not ranked.

Frequently asked questions

What are the best post-quantum cryptography vendors in 2026?

There is no single best post-quantum cryptography vendor in 2026, because PQC vendors do different jobs. Discovery: SandboxAQ, IBM, Keyfactor, CryptoNext, Elisity. Libraries and HSMs: PQShield, Thales, Entrust, Utimaco, Crypto4A. PKI: Keyfactor, DigiCert, Entrust. Network and VPN: Cloudflare, Palo Alto Networks, Fortinet, Cisco, Zscaler. Gateways for legacy systems: QuSecure, Quantum Xchange, Arqit, and encryptors from Thales, Senetas and SSH. Compensating controls for systems that can’t migrate: microsegmentation vendors such as Elisity, which limits who can reach those systems but does not encrypt traffic. Choose by migration stage and test on your own systems.

Which PQC vendors do cryptographic inventory?

PQC vendors that do cryptographic inventory include SandboxAQ (AQtive Guard), IBM (Quantum Safe Explorer), Keyfactor (AgileSec), CryptoNext (Compass), ISARA (Advance), AppViewX, Entrust, Palo Alto Networks, Elisity (Quantum Posture), QuSecure and Encryption Consulting, plus open-source CBOMkit. Each scans different sources: code, binaries, certificates or network traffic. Officials told GAO that automated tools cannot fully complete an inventory, so add written vendor attestations for firmware and supplier components.

Does any vendor make systems quantum-safe without replacing them?

No vendor can change the cryptography inside a device that can’t run post-quantum algorithms. A PQC gateway protects the device’s traffic from the gateway onward, while the device-to-gateway link keeps its old cryptography, or none. Segmentation limits who can reach the device but encrypts nothing. Firmware signatures stay forgeable until the manufacturer ships PQC firmware or the device is replaced.

What is the difference between a PQC gateway and microsegmentation?

A PQC gateway protects traffic between the gateway and the far end with post-quantum key exchange. Microsegmentation controls which systems can connect to a device at all, so the device can be limited to its gateway and the few systems it must reach. It does not encrypt the device-to-gateway hop. A system that can’t be upgraded usually needs both, plus a replacement date.

What does Elisity do for post-quantum cryptography?

Elisity does two PQC jobs and does not encrypt traffic. Elisity Quantum Posture classifies the assets, internal services and external services Elisity observes on the network as quantum vulnerable, quantum ready or quantum safe, and marks endpoints with insufficient evidence. Elisity microsegmentation then limits which systems can reach devices that can’t migrate, alongside a PQC gateway. Elisity enforces allow-or-deny network policy and does not encrypt, decrypt or alter traffic, so it is not a PQC library, gateway or encryptor.

Which deadlines should drive PQC vendor selection?

NIST IR 8547, final in October 2026, deprecates quantum-vulnerable public-key cryptography after 2030 and disallows it under NIST standards after 2035. Executive Order 14412 requires federal high value assets and high impact systems to use PQC key establishment by December 31, 2030 and PQC digital signatures by December 31, 2031; OMB M-26-15 sets out execution. National security systems follow NSA’s CNSA 2.0 instead. The UK NCSC sets 2028, 2031 and 2035 milestones.

Is quantum key distribution an alternative to post-quantum cryptography?

Quantum key distribution is a different technology, not a drop-in alternative to post-quantum cryptography. QKD vendors such as Toshiba and ID Quantique distribute keys over dedicated optical links, and QKD does not provide authentication, so it still depends on other cryptography. The UK NCSC says it will not support the use of QKD for government or military applications. PQC algorithms run in existing software and hardware.

Sources

• NIST, IR 8547, Transition to Post-Quantum Cryptography Standards (final), October 27, 2026.
• NIST, FIPS 203, Module-Lattice-Based Key-Encapsulation Mechanism Standard, August 13, 2024 (FIPS 204 and FIPS 205 published the same day).
• The White House, Executive Order 14412, Securing the Nation Against Advanced Cryptographic Attacks, June 22, 2026.
• OMB, M-26-15, Execution of the Migration to Post-Quantum Cryptography, June 24, 2026.
• CISA, Product Categories for Technologies That Use Post-Quantum Cryptography Standards, January 23, 2026.
• CISA, Strategy for Migrating to Automated Post-Quantum Cryptography Discovery and Inventory Tools, 2024.
• CISA, Post-Quantum Considerations for Operational Technology, October 2024.
• Canadian Centre for Cyber Security, ITSM.40.001, Roadmap for the migration to post-quantum cryptography, June 23, 2025.
• UK NCSC, Timelines for migration to post-quantum cryptography, March 20, 2025.
• NSA, CNSA 2.0 and Quantum Computing FAQ, version 2.1, December 2024.
• GAO, GAO-27-108740, Quantum Computing: Federal Actions Needed to Prepare for Emerging Cyber Threat, October 6, 2026.
• Gartner, CISO Agenda Priority: Transition to Postquantum Cryptography Before It’s Too Late (And Too Expensive), Mark Horvath, Sarah Almond, Thomas Lintemuth, September 17, 2026 (Elisity reprint).
• Vendor documentation linked in each entry, accessed November 1, 2026.

Gartner does not endorse any vendor, product or service depicted in its research publications. Gartner research publications consist of the opinions of Gartner’s research organization and should not be construed as statements of fact. GARTNER is a registered trademark and service mark of Gartner, Inc. and/or its affiliates in the U.S. and internationally and is used herein with permission. All rights reserved.