The short answer
IonQ is buying a network access control vendor, not another quantum lab, and the bet is that post-quantum migration will be planned network by network. On October 12, 2026, IonQ agreed to acquire Elisity in an all-stock deal worth up to $1.3 billion, aiming to tie least-privilege segmentation to its post-quantum cryptography products.
For buyers of enterprise software, the useful signal is the scope of Elisity’s policy model: it explicitly covers AI agents alongside users, devices and workloads. Teams that already run security audits and penetration tests on their networks should expect those reviews to start asking two new questions: which agents can reach what, and which connections still depend on keys a future quantum computer could break.
What exactly is IonQ buying?
Elisity sells identity-based microsegmentation. Instead of carving networks with VLANs and firewall rules, its IdentityGraph builds a map of every user, device, workload and AI agent, enriches it with context and risk data from tools the customer already runs, and enforces least-privilege rules on which of them may talk to each other. Policies can be simulated before they are switched on, which is the step where most segmentation projects stall.
IonQ, best known for trapped-ion quantum computers sold through the cloud, has been assembling a security line next to its hardware business. It offers post-quantum cryptography and quantum key distribution and points to national quantum-safe network projects in Switzerland, Poland, Romania and Slovakia. Bloomberg framed the purchase as a move to bolster that cyber unit; CNBC noted IonQ wants Elisity’s relationships with security leaders to sell its other products to enterprise and government buyers.
Why put zero trust and post-quantum crypto in one product?
Both problems start with the same question: what is connected to what, and how is that connection protected. A segmentation engine already holds the asset inventory and traffic context. Adding which cipher suites and key types each flow uses turns that map into a prioritized post-quantum backlog, ranked by business criticality rather than by the order systems were discovered.
The timing reflects regulatory pressure. NIST published its first post-quantum standards (FIPS 203, 204 and 205) in August 2024, US federal agencies are under orders to inventory vulnerable cryptography, and the European Commission’s 2025 coordinated roadmap asks member states to begin the transition by the end of 2026, with critical infrastructure first. The worry behind the deadlines is “harvest now, decrypt later”: traffic captured today could be decrypted once large quantum machines exist.
The AI agent angle matters just as much. Agents that call internal APIs, databases and SaaS tools are a new kind of identity on the network, often running with broad service-account permissions. If you are building AI agents for internal workflows, giving each one its own identity and least-privilege network policy limits how far a hijacked or misbehaving agent can move.
What it means for US & EU software teams
First, expect consolidation in the tools you depend on. Elisity customers keep the same management for now, but any change of ownership is a good moment to recheck data processing terms, where telemetry is stored and how policies could be exported if you ever switch vendors. EU customers should confirm the data flows still fit their GDPR records.
Second, treat cryptography as an asset attribute. Long-lived data in FinTech, HealthTech and public-sector systems is the first post-quantum priority. Record where RSA and elliptic-curve keys protect that data, in TLS endpoints, VPNs, message queues, code signing and backups, and give each entry an owner. Under NIS2 and DORA that inventory also doubles as evidence of risk management.
Third, give non-human identities first-class policies. Workloads, CI runners and AI agents now outnumber people on many networks. Segmentation that only understands users and laptops leaves the largest and fastest-growing group with default access.
What should teams do this quarter?
- Map who and what can reach your critical services. Include service accounts, CI pipelines and AI agents, not only employees and devices.
- Start a cryptographic inventory. List the key types and protocols behind each critical flow and mark data that must stay confidential for 10 years or more.
- Simulate before you enforce. Run new segmentation rules in monitor mode first to see what they would block, then enforce in stages.
- Give every AI agent its own identity. Scope its network and API access to the tasks it performs and log every call.
- Ask vendors for post-quantum roadmaps. Add hybrid key exchange support and crypto agility to security questionnaires and renewal checklists.
Frequently asked questions
What did IonQ announce?
On October 12, 2026, IonQ said it signed an agreement to acquire Elisity, a zero trust network security company, in an all-stock deal worth up to $1.3 billion, including up to $150 million in performance-based earnouts. The deal is expected to close in the fourth quarter of 2026, subject to regulatory approval.
What does Elisity do?
Elisity sells identity-based microsegmentation software. Its IdentityGraph combines asset identity, context and risk data to enforce least-privilege rules on which users, devices, workloads and AI agents can talk to each other on an enterprise network, and lets teams simulate policies before enforcing them.
Why would a quantum computing company buy a zero trust vendor?
IonQ already sells post-quantum cryptography and quantum key distribution. Elisity brings more than 100 enterprise deployments and relationships with security teams. IonQ plans to add cryptographic inventory and risk data to IdentityGraph so customers can prioritize post-quantum upgrades by business risk.
Does this change anything for current Elisity customers?
Not immediately. Elisity CEO James Winebrenner and the existing management team will keep running the business after closing. Customers should still ask about roadmap, data handling and contract terms during the ownership change.
What should engineering teams do about post-quantum risk now?
Build a cryptographic inventory of where RSA and elliptic-curve keys protect long-lived data, tie each item to the business service it supports, and plan migration to the NIST post-quantum standards published in 2024, starting with data that must stay confidential for many years.
Sources
IonQ — IonQ to acquire Elisity to accelerate zero trust for the quantum era
CNBC — IonQ to acquire cybersecurity firm Elisity in an all-stock deal for up to $1.3 billion
Bloomberg — IonQ to buy Elisity for up to $1.3 billion to bolster cyber unit
SecurityWeek — IonQ to acquire zero trust firm Elisity for up to $1.3 billion