The 2029 Encryption Deadline: Mapping M&A and Investment in Post-Quantum Cryptography

Most of the internet’s security relies on public-key cryptography such as RSA and elliptic curves. A large, error-corrected quantum computer could break both. For years that seemed a distant problem. The estimates have now moved sharply.

Recent research suggests breaking 256-bit elliptic curve cryptography (ECDLP-256) may need about 20 times fewer physical qubits than earlier estimates. IonQ has published a blueprint for a fault-tolerant trapped-ion machine that could solve ECDLP-256 in about 26 days using 19,397 physical qubits. Google has set 2029 as the deadline to migrate its own authentication services.

There is a second reason for urgency: harvest now, decrypt later. Data intercepted today can be stored and decrypted once capable machines exist, so anything that must stay secret for years needs protecting now.

NIST’s post-quantum programme (opens in a new tab) published the first three standards in August 2024 and selected HQC in 2025 as a mathematically different backup. NIST has also proposed deprecating today’s quantum-vulnerable public-key algorithms by 2030 and disallowing them by 2035.

The hard part is not the algorithms. It is finding every place cryptography lives inside a large organisation and replacing it without breaking anything. That is a software, services and hardware opportunity measured across every bank, government and cloud.

• IonQ: building a full-stack quantum security platformIonQ acquired ID Quantique, a pioneer in quantum key distribution and quantum random number generation, and Qubitekk, a quantum networking specialist. Together they give a hardware company a commercial security and networking business.
• Quantum Computing Inc.: room-temperature and manufacturing capabilityQCI completed its acquisition of NuCrypt, a quantum communications and photonics company, for $5m on 5 March 2026, then NHanced Semiconductors for an initial $73.1m plus up to $72m in earnouts on 22 June 2026. Both now operate as wholly owned subsidiaries.

The NHanced structure is instructive. An earnout nearly equal to the upfront price lets the buyer pay for proven commercial delivery rather than promise. Our earnout modelling tool shows how those structures shift risk.

• Cryptographic discovery and migration softwareTools that inventory where cryptography is used and automate the move to post-quantum algorithms. Every regulated enterprise needs them before the 2030 deprecation window.
• PQC-ready hardware and secure elementsHardware security modules, chips and devices with post-quantum algorithms built in, sold into payments, telecoms, defence and automotive.
• Quantum networking and key distributionSpecialist capability that hardware leaders are buying rather than building, as IonQ’s acquisitions show.

For cybersecurity founders, a credible post-quantum roadmap is fast becoming a diligence question in its own right. For acquirers, the window to buy specialist teams before the 2029 rush is open now.