Every encrypted message captured today by an adversary patient enough to hold it for fifteen years is, in 2026, a candidate for retroactive decryption. That is the simple and uncomfortable shape of the harvest-now-decrypt-later threat model that drives the work of the top post-quantum cryptography companies and the standards bodies they orbit. By 2035 NIST expects organisations to have retired the public-key algorithms that secure most of the internet. Some industries (defence, banks holding long-lived secrets, government archives) are expected to migrate well before then. This article is a working guide to what the algorithms are, who builds them, and which infrastructure providers have already started shipping them in production.
What Q-Day means for your data
Q-Day is the working name cryptographers give to the moment a sufficiently large fault-tolerant quantum computer first runs Shor’s algorithm against the public-key systems most of the world relies on: RSA, Diffie-Hellman, and elliptic-curve variants. Nobody knows exactly when Q-Day arrives. Estimates from serious researchers cluster between 2030 and 2040, but the threat model that matters now is not Q-Day itself. It is the much earlier reality that an adversary recording encrypted traffic today can store it cheaply for a decade or more and then decrypt it on the day a useful quantum computer comes online.
That is why the migration timeline is being pulled forward across regulated industries. Independent threat-model research like Project Eleven’s 2033 Q-Day baseline scenario places the cryptographically relevant breakthrough inside the planning horizon for almost every enterprise IT roadmap. The US National Institute of Standards and Technology (NIST) has set a target of deprecating quantum-vulnerable algorithms by 2035 in its post-quantum cryptography programme. High-risk systems are expected to transition much earlier.
Cloudflare and Google have publicly committed to 2029 deadlines for full post-quantum migration of their own infrastructure. Apple, Signal, and a handful of other messaging platforms shipped post-quantum protections already, and Microsoft and AWS are partway through hyperscale rollouts. The canonical reference is the NIST PQC project page tracking algorithms and post-quantum cryptography companies by status.
For everyone else, the practical question is no longer whether to migrate but in what order. That order, in turn, is shaped by which algorithms NIST has finalised, which post-quantum cryptography companies sell production-grade implementations of those algorithms, and which infrastructure layers (TLS, code-signing, identity, document signing, secure messaging) carry the longest-lived secrets.
How NIST chose the post-quantum cryptography standards
NIST opened the post-quantum cryptography standardisation competition in late 2016 with sixty-nine submissions from cryptographers worldwide. The criteria mixed mathematical security, performance on constrained hardware, key and signature sizes, and the diversity of mathematical foundations. NIST wanted a portfolio that would survive a breakthrough against any one family of problems. The history of quantum computing gave the standards body real reason to plan for that breakthrough rather than assume current cryptography would last.
The competition ran for nearly eight years. Several early candidates fell to creative attacks during the third round, most famously SIKE (Supersingular Isogeny Key Encapsulation), which was broken on a laptop in an afternoon by Wouter Castryck and Thomas Decru in 2022. Lattice-based schemes survived intense cryptanalysis and emerged as the workhorses of the new standards. Hash-based and code-based schemes were retained as conservative alternatives in case the lattice family later cracks. On 13 August 2024 NIST published the first three FIPS post-quantum cryptography standards. A fourth, FN-DSA (Falcon), is in active standardisation as a compact-signature alternative, and a fifth, Hamming Quasi-Cyclic or HQC, was selected on 11 March 2025 as a code-based backup to ML-KEM.
The three finalised FIPS standards
FIPS 203 ML-KEM (formerly CRYSTALS-Kyber)
FIPS 203 specifies Module-Lattice-based Key-Encapsulation Mechanism, or ML-KEM, the algorithm most people will encounter first as their TLS handshake silently switches to a post-quantum hybrid. ML-KEM replaces the Diffie-Hellman key exchange that secures HTTPS, IKE, secure shell, and a long list of other protocols. Its security is reduced to the Module Learning with Errors problem, a lattice problem believed to be hard for both classical and quantum computers.
The standard ships three parameter sets: ML-KEM-512, ML-KEM-768, and ML-KEM-1024, corresponding loosely to AES-128, AES-192, and AES-256 security levels. Performance is excellent: ML-KEM-768 keys are around 1,200 bytes for the public key and 1,100 bytes for ciphertext, with sub-millisecond software performance on commodity CPUs. The main cost is the bytes added to each TLS handshake. AWS measured the overhead at roughly 1,600 additional bytes and 80 to 150 microseconds of compute per connection. That is the price of post-quantum cryptography in the TLS path: small, but enough that some embedded and IoT scenarios still need careful planning.
FIPS 204 ML-DSA (formerly CRYSTALS-Dilithium)
FIPS 204 specifies the Module-Lattice-based Digital Signature Algorithm, ML-DSA, with parameter sets ML-DSA-44, ML-DSA-65, and ML-DSA-87. ML-DSA replaces RSA and ECDSA in roles where speed matters more than signature size: code signing, certificate signing, document signing, and a long tail of internal signing systems. The signatures are noticeably larger than ECDSA (around 2 to 4 KB depending on parameter set) but verification is fast and key generation is cheap, which is what most large signing systems care about.
For most enterprises, ML-DSA is the algorithm that touches the most internal systems during migration. Code-signing pipelines, internal certificate authorities, software supply chain attestations, and document signing all rely on signature schemes that ML-DSA can replace. Microsoft’s SymCrypt now ships ML-DSA in production, AWS KMS supports ML-DSA quantum-resistant signatures and roots of trust, and several certificate authorities have begun issuing test certificates that combine ECDSA with ML-DSA in hybrid form.
FIPS 205 SLH-DSA (formerly SPHINCS+)
FIPS 205 is the conservative pick: Stateless Hash-Based Digital Signature Algorithm, SLH-DSA, derived from SPHINCS+. SLH-DSA does not rely on lattice mathematics. Its security reduces to the security of cryptographic hash functions. If a future cryptanalytic breakthrough invalidates the lattice family (the underlying problem class for both ML-KEM and ML-DSA), SLH-DSA continues to work because its security model is fundamentally different.
The cost of that hedge is signature size. SLH-DSA signatures are between 8 KB and 50 KB depending on parameter set, far larger than ML-DSA. Signing is also slower. Most organisations will not deploy SLH-DSA as the default signature, but they will keep it in the toolbox for high-value, low-volume signing where the resilience guarantee matters more than the byte count: long-lived root signing keys, software bill-of-materials attestations, and certain government archive signing scenarios.
FIPS draft: FN-DSA and HQC
Two further algorithms are in active standardisation. FN-DSA, the FIPS 206 draft based on Falcon, offers compact signatures (around 1 KB) using a different lattice construction (NTRU). The trade-off is implementation complexity: Falcon needs floating-point arithmetic in its signing path, which raises the bar for constant-time, side-channel-resistant implementations. NIST is finalising the standard with help from cryptographers who have rebuilt Falcon’s signing routine in fixed-point arithmetic.
HQC is the code-based fallback for ML-KEM, selected on 11 March 2025. Like SLH-DSA, HQC sits in the portfolio as insurance: if a future attack breaks lattice-based key encapsulation, organisations have a code-based alternative ready. The draft standard is expected in early 2026 with the final in 2027. Most post-quantum cryptography companies are already tracking HQC as a roadmap item rather than a production deliverable.
The post-quantum cryptography vendor landscape
The pure-play post-quantum cryptography companies ship the libraries, hardware, and platforms that enterprises and integrators consume. Eight vendors stand out in 2026 across four categories: cryptographic libraries and toolkits, full quantum-safe platforms, hardware security modules, and QKD-PQC hybrid networks. Funding ranges from ten-figure venture rounds (SandboxAQ at $1.4 billion plus) to undisclosed-but-modest rounds at the QKD vendors. Customer concentration is heavy in defence, financial services, and central banking.
What the vendor list reveals
Three things are worth noting about this vendor list. First, the geography skews heavily towards Anglosphere countries plus continental Europe. There is no Chinese vendor on the list because the Chinese PQC ecosystem is structured around government and academic institutions rather than independent companies.
Second, the QKD-PQC hybrid vendors (QuintessenceLabs and Quantum Xchange) sell a fundamentally different product from the pure-PQC vendors. They serve a much narrower market: organisations that have a regulatory or threat-model requirement for fibre-grade key delivery in addition to algorithmic security. For background on how the optical-fibre side works, our primer on quantum key distribution covers the BB84 family of protocols, decoy-state methods, and the operational realities of running QKD over commercial fibre.
Third, several of the most influential post-quantum cryptography companies are not in the list at all because they are not commercial entities: NIST itself, the IRTF Crypto Forum Research Group, the Open Quantum Safe project at the University of Waterloo, and the academic research groups at IBM, ETH Zurich, CWI Amsterdam, and Cloudflare Research that contributed the algorithms in the first place.
Big-cloud and big-tech rollouts
The integrators are where post-quantum cryptography reaches scale. Six big-cloud and big-tech rollouts cover most internet traffic, almost all consumer messaging at scale, and a growing share of enterprise infrastructure. The pattern is consistent: each integrator first ships ML-KEM in TLS or in messaging key establishment, then adds ML-DSA for signatures, with SLH-DSA following for conservative high-value paths.
The Cloudflare and Google 2029 deadlines deserve attention. Two majority infrastructure providers committing publicly to the same timeline is rare and creates an industry coordination point that other vendors implicitly track against. Cloudflare’s roadmap is the most detailed in the public domain. Google has been quieter on the milestone schedule but committed to the same 2029 endpoint in a March 2026 announcement. Apple and Signal already shipped, in different ways: Apple PQ3 reaches Level 3 PQ messaging by using ML-KEM in the ongoing ratchet, while Signal PQXDH uses ML-KEM only at session initialisation (Level 2). Both protocols are deployed at scale, putting post-quantum cryptography on roughly two billion endpoints.
When your organisation should migrate
Step one: cryptographic inventory
The honest answer for most organisations in 2026 is: start the inventory work now, even if the migration itself is two or three years off. The first practical step is producing a cryptographic bill of materials, an inventory of which systems use which algorithms, which protocols, and which key sizes, with owners and renewal cadences attached. The Cloud Security Alliance recently published an industry guide for transitioning to post-quantum cryptography that walks through the inventory step in detail.
That inventory is the bottleneck for almost every PQC migration. The longest part of the work is finding all the places cryptography is used and quietly assumed to be RSA or ECDSA. The post-quantum cryptography companies in the list above all sell some flavour of cryptographic inventory and migration tooling because customers asked for it before they asked for the algorithms themselves.
Step two: order by risk and lifetime
Once the inventory exists, the migration path tends to follow risk: start with anything that protects long-lived confidentiality (medical records, government archives, financial transaction histories), then move to authentication-critical systems (code signing, certificate authorities, identity), then everything else. Hybrid deployments (ML-KEM plus the existing classical algorithm in parallel) buy time during the cutover and are the dominant pattern across cloud providers today. Pure post-quantum deployments come later, once the algorithms have racked up another two or three years of production use.
What your cloud provider does for you
For organisations that build software on cloud providers, much of the migration is being done for them. AWS, Microsoft, Google, and Cloudflare are switching their default algorithms underneath their customers, which means a TLS connection from an AWS customer to an AWS service is increasingly post-quantum without the customer doing anything. The customer’s job is to keep TLS clients and SDKs current and to update internal systems that do not run on hyperscaler infrastructure.
Frequently asked questions
Who are the leading post-quantum cryptography companies in 2026?
The leading pure-play vendors are PQShield, SandboxAQ, ISARA, Crypto4A, evolutionQ, Post-Quantum, QuintessenceLabs, and Quantum Xchange. The major integrators rolling NIST-standardised PQC out at scale are Cloudflare, AWS, Microsoft, Google, Apple PQ3, and Signal PQXDH. Pure-play post-quantum cryptography companies ship the libraries and platforms; integrators consume those algorithms and deploy them to billions of endpoints.
Which NIST post-quantum cryptography standards have been finalised?
NIST released FIPS 203 ML-KEM (formerly CRYSTALS-Kyber) for key encapsulation, FIPS 204 ML-DSA (formerly CRYSTALS-Dilithium) for digital signatures, and FIPS 205 SLH-DSA (formerly SPHINCS+) for hash-based signatures on 13 August 2024. HQC was selected as a code-based backup on 11 March 2025; the draft standard is expected in early 2026 with the final in 2027. FN-DSA (Falcon) is in active standardisation as a compact-signature alternative.
What is the difference between PQC and QKD?
Post-quantum cryptography (PQC) is a family of mathematical algorithms designed to resist quantum cryptanalysis. It runs on ordinary computers and replaces the public-key parts of TLS, signatures, and key agreement. Quantum key distribution (QKD) is a different approach that uses quantum-physics properties of single photons to detect eavesdropping during key exchange, and requires dedicated optical fibre. For most internet and enterprise workloads, NIST PQC alone is sufficient. QKD is useful only where dedicated fibre and very specific threat models exist; the QKD-PQC hybrid vendors in this guide combine both layers.
When should my organisation migrate?
Start the cryptographic inventory in 2026 if you have not already. NIST targets 2035 as the deprecation deadline for quantum-vulnerable algorithms, but high-risk systems (defence, finance, government archives) are expected to migrate much sooner. Cloudflare and Google have publicly committed to 2029. Harvest-now-decrypt-later means data with a confidentiality requirement past 2035 should already be moving. Most post-quantum cryptography companies recommend starting cryptographic inventory work now and beginning hybrid deployments within the next 12 to 18 months.
Is harvest-now-decrypt-later actually happening?
Probably yes, although by definition it is hard to confirm. State-level intelligence agencies have the storage capacity, the patience, and the strategic interest to capture encrypted traffic at scale and hold it. Several published incidents (large-scale TLS metadata collection by intelligence services in the 2010s) suggest the operational pattern was already in place. The conservative assumption is that any data encrypted today with classical public-key cryptography and intercepted now should be considered at risk of future decryption.
Are these post-quantum cryptography companies publicly traded?
Most are privately held. SandboxAQ has raised over $1.4B at a $5.3B valuation and is widely expected to IPO in late-2026 or 2027. PQShield is private with backing from Addition, Chevron Technology Ventures, Legal and General, and Oxford Science Enterprises. Among the integrators, Cloudflare, Amazon (AWS), Alphabet (Google), Microsoft, and Apple are publicly traded, but PQC is a small line item in their broader infrastructure businesses.
