Quantum computing could eventually weaken the encryption protecting business data and communications. Large-scale attacks on today’s public-key cryptography aren’t yet practical. But the “harvest now, decrypt later” threat is already real — attackers store encrypted data today and hold it until future computing capabilities make decryption possible. That’s an active risk. Not a theoretical one.
Post-quantum cryptography uses algorithms designed to resist both classical and quantum attacks. The six companies below address different aspects of the transition. Network protection and key management sit in different parts of the stack — and secure communications is a third problem entirely. They don’t occupy the same space — and the right choice depends on your existing systems and migration priorities.
1. Fortinet
Network security and VPN protection. That’s where Fortinet’s relevance to post-quantum readiness sits — firewalls and the key exchange mechanisms underneath them. Traditional methods could eventually become vulnerable to a sufficiently powerful quantum computer, so reviewing how VPNs establish keys and authenticate endpoints matters now.
Fortinet’s guide to Post Quantum Cryptography covers the technology and its security implications — a useful starting point before any internal review of VPN architecture or quantum readiness posture. Their IPsec VPN approach includes hybrid key exchange — traditional and post-quantum methods together — to support a phased transition where compatible infrastructure allows it.
Honestly, a vendor roadmap doesn’t mean every product or deployment is already quantum-safe. Check the FortiGate model and FortiOS version — supported algorithms and configuration requirements vary, and that gap matters before any planning commitment.
Suits: Network security teams reviewing VPN infrastructure and quantum-resistant key exchange.
2. IBM
IBM brings cryptographic research and enterprise technology into quantum-safe planning — relevant for organizations preparing complex IT environments where cryptography is embedded across all sorts of systems at once. The hard part isn’t picking algorithms. It’s finding where cryptography actually lives.
Applications, databases, identity systems, cloud workloads, communications — replacing algorithms without mapping those dependencies first creates compatibility problems. Or it leaves systems exposed in ways that aren’t obvious until something breaks.
IBM’s work supports assessments of cryptographic dependencies and what to prioritize first. But research expertise doesn’t mean every deployed system is protected. Confirm which specific products and services support required standards and how they integrate with your existing architecture before committing resources.
Fits best: Large enterprises mapping cryptographic dependencies across applications and legacy systems.
3. Zscaler
Maintaining visibility without disrupting legitimate connections — that’s the specific problem Zscaler addresses as cryptographic methods change. And it’s genuinely difficult to get right mid-migration.
Inspection tools examine encrypted traffic for threats and policy enforcement. Changes to key exchange can create visibility gaps if systems aren’t updated in step. Zscaler offers post-quantum reporting and logging to help administrators track cryptographic activity — the product context covers what that looks like in practice.
Check feature availability and maturity. Post-quantum reporting and TLS inspection aren’t the same as VPN support — and treating them as equivalent during evaluation is how gaps get missed. Whether features are generally available or still in development matters a great deal during procurement — and that distinction isn’t always front and centre in vendor materials.
Strongest match: Enterprises using cloud-delivered security that need visibility as cryptographic methods shift.
4. Thales
Thales focuses on cryptographic infrastructure and digital trust — the keys and certificates that underpin it, along with the signature mechanisms that verify authenticity. Not the perimeter. The foundation underneath it.
Hardware security modules and key management platforms sit at the centre of what Thales addresses. PKI is part of that picture too. Each one requires checking for compatibility with required post-quantum algorithms and key formats. A mismatch between the encryption layer and the key management layer surfaces quickly — and expensively — during deployment.
Frankly, a sound migration plan covers the full cryptographic lifecycle, not encryption in isolation. Verify HSM firmware support and key management workflows before deciding whether this fits your environment — PKI integrations deserve their own check. Worth being specific about what you’re actually trying to protect.
Works well for: Regulated industries managing hardware security modules and the key infrastructure underneath their cryptographic stack
5. Barracuda Networks
Barracuda Networks is relevant to organizations still in the assessment phase — working out which data requires long-term confidentiality and which systems run cryptography that quantum computing could eventually threaten. And plenty of organizations are still at that stage, which is fine, but the time to start isn’t later.
Practical preparation means reviewing vendor roadmaps and mapping where cryptographic dependencies actually sit. Legacy applications and exposed services all deserve scrutiny. Certificates do too. Barracuda’s verifying specific capabilities resource gives useful context on quantum-related cyber risk — use it to sharpen the questions you ask vendors, not substitute it for direct capability checks.
Separate general guidance from implemented product features — vendors produce all sorts of marketing material that sounds definitive but isn’t. Confirm specific capabilities and timelines directly before putting anything in a migration plan.
Relevant to: Organizations still mapping quantum-related risk and building out a readiness plan.
How to Choose a Post-Quantum Cryptography Provider
Start with what you have. Inventory certificates and applications first — then identify algorithms that need replacing for long-term confidentiality. That list drives the vendor comparison, not the other way around.
Assess standards support and integration fit. New algorithms can affect speed and resource consumption — these aren’t marginal issues at scale. Test changes before deployment. Request interoperability documentation and a clear roadmap from any vendor under consideration. A provider that can’t answer those questions specifically isn’t worth much for a production migration.
The coordinated roadmap for the transition to post-quantum cryptography from the European Commission provides wider regulatory and planning context — useful for understanding where compliance direction is heading.
ETSI’s post-quantum cryptography resources support technical teams following standards work closely. Use both as reference points to sharpen vendor questions — not as substitutes for testing product support directly. Standards publication and production-ready features are different milestones — a roadmap announcement sits somewhere in between. A pilot tests interoperability with partners and older systems before any wider rollout.
Conclusion
Each of the five providers above addresses a different aspect of quantum readiness. No single provider covers every organization’s needs — and any evaluation that doesn’t start from the same use case isn’t comparing like-for-like.
Identify vulnerable dependencies. Prioritize sensitive data. Validate vendor capabilities directly. A phased migration is far more manageable than an emergency one.
Frequently Asked Questions
1. What is post-quantum cryptography?
Algorithms designed to resist attacks from both conventional computers and sufficiently powerful quantum computers — running on current digital infrastructure without specialized hardware.
2. Why prepare now?
Migration takes time. Cryptography is embedded across systems and suppliers — and attackers may already be storing encrypted information for future decryption. The earlier the inventory starts, the more room there is to be methodical.
3. Is post-quantum cryptography the same as quantum key distribution?
No. PQC uses mathematically resistant algorithms on standard infrastructure. QKD uses quantum mechanics to distribute keys and usually requires specialized equipment. Different approaches, different deployment requirements — and the distinction matters during procurement.
4. How does an organization begin migration?
Inventory cryptography across the environment. Identify vulnerable public-key algorithms. Prioritize long-lived data. Review vendor roadmaps. Then test migration for interoperability and performance before rolling anything out broadly.
