On October 12, 2026, quantum computing company IonQ announced that it had signed a definitive agreement to acquire enterprise security company Elisity in an all-stock deal worth up to $1.3 billion. What IonQ is after is a system that controls "who can communicate with what" on enterprise networks, along with the customer base that already uses it. Updating cryptography to prepare for quantum computers means deciding which systems to migrate first while keeping existing operations running. By bringing in Elisity's customers and access control technology, IonQ aims to expand a business that supports this migration work.
Up to $1.3 billion buys a foothold in enterprise networks
According to IonQ's announcement, the "up to $1.3 billion" includes up to $150 million in additional consideration tied to Elisity's performance. The deal is expected to close in the fourth quarter of 2026, subject to conditions such as regulatory approval. The acquisition has not yet closed, and the maximum amount is not a fully committed payment.
The number of IonQ shares to be issued will be determined from the stock price just before closing. Specifically, the calculation uses the volume-weighted average price over the 20 trading days ending three business days before the closing date, with the price used in the calculation limited to a range of $33.07 to $49.61. This range does not guarantee a market share price; it sets the upper and lower bounds used when converting the consideration into a number of shares.
Elisity was founded in 2019 and, according to IonQ, has more than 100 customer deployments worldwide. IonQ says the company has doubled its revenue and customer base year over year, with zero churn among deployed customers. However, the announcement does not disclose absolute revenue or profit, so growth rates alone cannot show whether a $1.3 billion valuation is justified. After the deal closes, the existing management team, including CEO James Winebrenner, is expected to continue leading the business.
IonQ also hopes to convert this deployment record and Elisity's relationships with chief information security officers (CISOs) into sales of its own technology. Simply having cryptographic technology does not determine which of a customer's systems it should be deployed on, or in what order. Bringing in Elisity, which understands how enterprise networks operate, appears to be aimed at that gap.
How access control differs from cryptographic updates
Elisity's IdentityGraph layers identity information about users and devices with information gathered from other vendors' security products, among other sources, to decide which communications to permit. It also covers application runtime environments and AI agents, and it reportedly lets organizations test "least privilege" rules, which allow only necessary communications, before applying them. The functions are meant to narrow the paths by which attacks can spread inside a network.
IonQ, on the other hand, intends to combine this with post-quantum cryptography (PQC) and quantum key distribution (QKD). PQC refers to mathematical cryptographic methods designed to withstand attacks by quantum computers, while QKD refers to technology that uses quantum properties to generate and distribute the material for cryptographic keys. Elisity's access control, PQC-based cryptographic updates and QKD-based key distribution each protect different things and have different deployment requirements.
| Technology / function | What it mainly controls or protects | Deployment conditions and limits |
|---|---|---|
| Elisity access control | Whom users, devices and other entities can communicate with | Rules are applied on existing networks. Restricting communications does not itself replace a cryptographic method |
| PQC | Cryptographic processing designed with quantum-computer attacks in mind | Requires identifying the cryptography in use and migrating to a corresponding method. Compatibility between systems and performance must also be verified |
| QKD | Generation and distribution of key material used in encryption | Requires dedicated equipment and physical communication paths, and sender authentication must be arranged separately |
This table classifies information by what is protected and by deployment conditions, drawing on Elisity's October 12 explanation, NIST's PQC migration materials and the U.S. National Security Agency's (NSA) technical explanation of QKD. It is not a ranking of product performance, nor a comparison showing that an integrated product is already available. Strengthening access control does not eliminate the weaknesses of older cryptographic methods; that requires a separate update.
Winebrenner has described the difference as follows:
"Access control reduces the scope of exposure to risk, while updating cryptography addresses the underlying weakness."
QKD also has infrastructure constraints. The NSA cites issues such as dedicated equipment and authentication, and states that it does not recommend QKD for protecting U.S. National Security Systems (NSS) communications until those constraints are resolved. That does not amount to a blanket ban on private-sector use, but it would be a mistake to think that installing Elisity's software would make existing facilities QKD-ready as they are.
Connecting a cryptographic inventory to migration without halting operations
The two companies' joint roadmap includes a plan to add cryptographic asset information and risk information to IdentityGraph. Elisity says it would link that data to information on users and devices, their communications and the business operations affected, and use it to prioritize post-quantum migration according to business risk and importance. This extension is a future plan and is at a different stage from the existing communication controls.
The "cryptographic asset inventory" that NIST describes is broader than simply listing the names of cryptographic methods. It involves understanding the certificates and key management information in use, and recording which systems depend on that cryptography and what data it protects. It does not mean collecting the secret key material itself. Without knowing where cryptography is used, it is impossible to set update priorities.
Consider an organization that runs both a system handling long-retained medical data and ordinary workplace devices. Even with a list of cryptographic methods, it is hard to estimate the impact of an update if it is unclear which business communications each one is used for. If the necessary connections are understood in advance, the work of switching cryptography can be considered alongside the work of restricting unnecessary communications. This is an illustration of what the concept means, not a case in which the two companies have demonstrated migration results.
In this respect, the significance of adding Elisity lies in trying to give cryptographic information the context of an enterprise's operations. Elisity itself anticipates a situation in which older equipment and systems updated to post-quantum cryptography coexist for several years. Controls that maintain necessary communications and limit excess access during migration are likely to retain a role. However, just as NIST's migration activities treat interoperability and performance evaluation as pillars, once the inventory and rules are in place, there remains a step of verifying that the updated systems actually work together.
The integration will be judged on migration plans and deployment results
NIST explains that it is not known when a quantum computer powerful enough to break cryptography will appear. Even so, the reasons for urgency are that migration takes a long time and that encrypted data that retains value over many years could be stolen now and decrypted in the future. The first three PQC standards were finalized in 2024, so companies can start by checking how they use cryptography without waiting for future quantum computers.
The IonQ and Elisity announcements give no specific availability date or pricing for the integrated features, nor a confirmed list of supported products. Once the acquisition closes as planned, how far the combined offering can identify where cryptography is used, and how it ties that to existing communication rules, will be key factors in judging the product. If existing customers actually use it for migration and cases emerge that go as far as interoperability testing, expectations of expanded sales channels can be assessed against deployment results.
What enterprise security teams need is a procedure that lets them distinguish between equipment to keep using and equipment to update, and migrate while checking the impact on operations. The question is whether IonQ can connect everything from understanding cryptographic assets to communication control and post-update verification at customers' sites. The value of the $1.3 billion acquisition concept will be tested by how it is executed.