The (01) Quantum Window Is Fast Approaching

2026 Has Strengthened the Case for Acting Before Q-Day

When Sophic Capital published our Report, The Quantum-AI Convergence, the central argument was that cybersecurity to protect against threats from quantum computing was already becoming a current problem, even if the exact arrival of Q-Day (a future moment when quantum computers become powerful enough to break current standard encryption technologies) remained uncertain. Even as governments and enterprises were already beginning the long process of migrating away from quantum vulnerable cryptography, harvest-now-decrypt-later (“HNDL”) attacks meant sensitive information stolen today could potentially be decrypted in the future. A lot has happened since.

Since then, the case for acting early has strengthened. Google has reduced its estimate of the quantum resources needed to break widely used elliptic-curve cryptography, NVIDIA is using AI and software to accelerate quantum development, Microsoft and IBM have sharpened their quantum roadmaps, and governments are moving from policy statements toward implementation and procurement.

None of these developments’ pinpoints whether Q-Day will occur in 2029, 2030, or any other specific year. Quantum timelines remain uncertain. What they do suggest is that the cost and risk of assuming there is still plenty of time to address these concerns is increasing.

Google: Breaking ECC May Require Less Quantum Hardware Than Previously Thought

One of the more important developments came from Google Quantum AI in March. Google published updated resource estimates for breaking the 256-bit elliptic-curve discrete logarithm problem, a foundation of the cryptography used across digital assets and other systems. Its researchers estimated that, under stated hardware assumptions, the attack could be performed with fewer than 500,000 physical qubits, roughly a 20-fold reduction from prior resource estimates. Google explicitly urged cryptocurrency developers to transition toward post-quantum cryptography and referenced its own 2029 migration timeline.

The distinction is important. Google did not announce a quantum computer capable of breaking Bitcoin or Ethereum today. Rather, advances in algorithms and compilation reduced the amount of future quantum hardware that may be required.

For investors, that illustrates why the Q-Day timeline is difficult to treat as static. Progress can occur on both sides of the equation: hardware becomes more capable, while researchers simultaneously find more efficient ways to use that hardware.

That has particular relevance for digital assets, where Google noted that many blockchain technologies rely on the same elliptic-curve problem addressed in its research.

AI is Now Helping Build Better Quantum Computers and Expose More Vulnerabilities

As previously discussed in The Quantum-AI Convergence, perhaps the most interesting development continues to be the growing convergence between AI and quantum computing.

In April, NVIDIA introduced Ising, a family of open-source AI models designed specifically to address two major engineering challenges in quantum computing: processor calibration and quantum error correction. According to NVIDIA, Ising Calibration can reduce certain quantum-processor calibration processes from days to hours, while Ising Decoding delivered up to 2.5x faster performance and 3x greater accuracy than the open-source benchmark used in its comparison. The technology is already being adopted or evaluated across organizations including Harvard, Fermilab, Lawrence Berkeley National Laboratory, IonQ, IQM, and the U.K.’s National Physical Laboratory. More recently, on September 14, NVIDIA expanded CUDA-Q with a new logical orchestration layer for fault-tolerant quantum computing. Fermilab said the platform reduced development of one fault-tolerant architecture from five months to three weeks.

This should not be interpreted as NVIDIA having solved fault-tolerant quantum computing. Significant technical challenges remain. But it does highlight something investors should pay attention to: AI is increasingly being used to accelerate the development of quantum computing itself.

In addition, AI is expanding the amount of sensitive information moving across infrastructure that may ultimately require quantum-safe protection. LLMs and increasingly autonomous AI agents routinely communicate with users, cloud platforms, APIs, databases and other enterprise systems, with much of that traffic protected by today’s public-key cryptography. An adversary could potentially capture encrypted AI-related traffic today and retain it for future decryption if the underlying cryptography becomes vulnerable to quantum computers.

The same issue can extend to sensitive data stored around AI systems, including proprietary datasets, prompts, model weights and intellectual property, where long-term confidentiality matters. As AI becomes more deeply embedded in financial services, healthcare, government and defence, it therefore creates not only new productivity opportunities but also a much larger volume of high-value information that may need to be protected against HNDL attacks. We examine this risk, and the emerging need for secure AI execution, later in this report.

Until recently, AI and quantum were often treated as separate technology themes. They are increasingly becoming interconnected, with both benefits and risks. AI is helping optimize materials, calibrate processors, interpret errors and improve the classical control systems surrounding quantum hardware, potentially accelerating progress toward more useful quantum systems. At the same time, broader AI adoption is creating additional data flows, interfaces and repositories that will need to remain secure in a post-quantum environment. In other words, AI could both accelerate quantum development and expand the amount of sensitive information exposed to future quantum threats.

Microsoft and IBM are Both Pointing Toward 2029 for Q-Day

The 2029 timeframe has also become increasingly visible in corporate roadmaps. In June, Microsoft unveiled Majorana 2, its next-generation topological quantum processor. Microsoft said its new qubits are approximately 1,000x more reliable than its prior generation, with mean lifetimes of roughly 20 seconds, and that AI assisted in the processor’s development. Based on that progress, Microsoft cut its timeline in half and now targets a scalable quantum computer by 2029.

That same month, IBM announced plans to invest more than US$10 billion over five years across quantum R&D, manufacturing, acquisitions, and ecosystem development. IBM continues to target 2029 for Quantum Starling, which it describes as its first large-scale fault-tolerant quantum computer.

Again, roadmaps are not guarantees. But when companies with the resources of Microsoft, IBM, NVIDIA, and Google are committing capital and engineering resources around increasingly specific timelines, enterprises responsible for protecting long-lived sensitive data have to consider the downside of waiting.

For a bank, government agency, defence contractor, or healthcare organization, the relevant question is not simply ‘when will Q-Day occur?’ It is: ‘How long will our migration take, and how much time can we afford to waste?’

Enterprise Spending is Starting to Follow

The shift is also beginning to show up in corporate budgets. According to Boston Consulting Group data reported by The Wall Street Journal, enterprise users spent approximately US$300 million on quantum technology in 2025, marking the first-year corporate spending exceeded the combined spending of research laboratories and governments. BCG surveyed 275 of the world’s largest companies across 11 industries and found that 62% were spending at least US$1 million annually on quantum and had established a dedicated program.

Source: Boston Consulting Group / Wall Street Journal

That is an important signal. Quantum is still an emerging technology, but increasingly large companies are no longer waiting for commercial-scale quantum computers before allocating capital. They are hiring talent, testing use cases, building infrastructure and, in some cases, preparing their existing systems for the cybersecurity implications.

Part of that urgency appears to reflect a lesson learned from AI. Many enterprises were caught flat-footed when generative AI adoption accelerated and found themselves without the talent, data infrastructure or internal expertise required to move quickly. BCG’s findings suggest companies are increasingly unwilling to make the same mistake with quantum. For the post-quantum cybersecurity market, that distinction matters. Enterprise awareness is beginning to translate into enterprise spending.

Washington is Adding Capital to Words

Washington has now moved decisively from policy discussion to both capital deployment and hard migration deadlines. In May 2026, the U.S. Department of Commerce announced approximately US$2.0 billion of proposed CHIPS and Science Act incentives across nine quantum companies, with funding aimed at accelerating progress toward utility-scale, fault-tolerant quantum computing and strengthening domestic manufacturing. On September 8, the Department of Commerce finalized an award of up to US$100 million to PsiQuantum, a quantum-computing company building utility-scale, fault-tolerant systems using silicon photonics, showing portions of that program moving from proposal to execution.

On June 22, the White House issued two Executive Orders addressing both sides of the quantum equation. Executive Order 14413, Ushering in the Next Frontier of Quantum Innovation, is designed to accelerate commercialization, deployment, and domestic capacity across quantum computing, sensing, networking, and supply chains.

At the same time, Executive Order 14412, Securing the Nation Against Advanced Cryptographic Attacks, addresses the security consequences of that progress by recognizing the harvest-now-decrypt-later threat and setting concrete PQC migration requirements for high-value federal systems. These include key establishment by December 31, 2030, and digital signatures by December 31, 2031, while also directing NIST to complete a migration pilot by the end of 2027.

The Order further extends the commercial implications beyond government by calling for federal contractors to align with applicable NIST PQC standards and for CISA and NIST to develop guidance around Cryptographic Bills of Materials (“CBOMs”) so organizations can identify vulnerable cryptographic assets across software and hardware.

The implementation layer has become more visible since then. On August 24, the U.S. Treasury launched a public-private Quantum-Readiness Task Force to accelerate the financial sector’s transition to quantum-safe technology, with workstreams covering sector alignment, third-party and vendor readiness, and digital-asset risk.

That same day, GSA said it had begun incorporating quantum-resistant algorithms into testing for federal physical-access systems and had convened a PQC interagency working group with 40 participants from 17 agencies. GSA is also hosting a federal PQC summit focused on implementation and case studies.

Taken together, the message is clear: the U.S. Federal government is simultaneously funding the technologies that could accelerate quantum computing, while setting deadlines to protect critical systems from the risks those advances create.

The market is therefore moving beyond simply acknowledging quantum risk and toward a more practical cycle of inventorying what exists, identifying what is vulnerable, building migration plans, and executing against a deadline. All of which are activities that increasingly look like the early stages of a commercial infrastructure transition.

The Migration is Global

Canada is moving in the same direction. Federal departments were required to develop high-level PQC migration plans by April 1, 2026, while the National Research Council’s Quantum Safe Technologies Initiative is supporting development and testing across defence, finance, telecommunications, healthcare and transportation.

Canada is also investing heavily in the underlying quantum ecosystem. On August 28, the Government of Canada announced $195 million for Xanadu Quantum Technologies as part of an $893 million project to expand R&D and establish advanced quantum manufacturing capacity in Canada.

For the Canadian PQC ecosystem, this matters. The country is also building both sides of the market: the infrastructure to advance quantum technology and the standards, testing and migration capability needed to secure systems against risks that these advancements also create.

The push is broader than North America. The U.K.’s National Cyber Security Centre has set a three-stage timetable: complete discovery and an initial migration plan by 2028, migrate the highest-priority systems by 2031, and complete migration by 2035. In Europe, EU Member States have adopted a coordinated PQC implementation roadmap calling for all Member States to begin transitioning by the end of 2026 and for high-risk use cases to be protected no later than the end of 2030. Feedback published in September 2026 highlighted the value stakeholders place on clear milestones, a risk-based approach and crypto-agility. The message is increasingly consistent across major markets: discovery and planning need to begin well before full migration deadlines arrive.

AI Adoption also Creates Security Problems That Do Not Require Q-Day

The other side of the story is AI. Even if quantum computing stopped advancing tomorrow, enterprises would still face a growing problem around how sensitive information is used inside AI systems.

AI models are increasingly being asked to process financial information, proprietary corporate data, medical records, government information, source code, engineering designs, and intellectual property. In many of these applications, the same data that offers the greatest potential benefit from AI is also the data an organization is least willing to expose. That creates a basic tension.

Enterprises want the productivity gains from AI, but they also need to maintain control over the information entering the model and, in many cases, protect the proprietary model itself. For R&D-driven companies, this becomes particularly interesting. Engineers, scientists, lawyers, pharmaceutical researchers, and product-development teams may want AI assistance with proprietary information or potentially patentable inventions. Concerns around how third-party AI environments store, retain, or process that information could limit adoption in precisely the workflows where AI may provide the most value.

This is less about making sweeping claims that using AI automatically destroys patent protection (it does not) and more about an increasingly practical enterprise question: Can we use AI on our most valuable information without exposing that information?

AI is Becoming Both an Attack Tool and an Attack Surface

The security discussion is also changing quickly on the AI side. Until recently, much of the enterprise AI debate centered on productivity, hallucinations, copyright, and data governance. Cybersecurity is increasingly moving to the front of that conversation as frontier models become more capable at finding vulnerabilities, writing exploits, acting autonomously, and interacting directly with enterprise systems.

This is no longer entirely theoretical. Anthropic disclosed in late 2025 what it described as the first reported AI-orchestrated cyber espionage campaign, where an AI system performed much of the attack workflow with limited human involvement. The company has since said its newer cyber-focused models have identified thousands of previously unknown high-severity vulnerabilities across major operating systems, browsers, and open-source software.

The threat has continued to evolve in 2026. Google Threat Intelligence says adversaries are moving from relatively basic AI assistance toward the industrial-scale use of generative AI across cyber operations, including vulnerability exploitation and initial access. Microsoft, meanwhile, has introduced AI-specific security controls addressing risks such as prompt injection and credential leakage from generative-AI systems.

Recent events have made the issue harder to dismiss. In July, an autonomous AI agent being tested by OpenAI breached Hugging Face’s infrastructure after escaping its test environment, an incident that demonstrated how capable agents can combine reasoning, coding, and exploitation without requiring step-by-step human direction. Anthropic’s July disclosure (that several Claude models gained unauthorized access to real organizations’ systems during cybersecurity evaluations) shortly after the similar OpenAI incident discussed above underscores how advanced AI is becoming both a more capable attack tool and a new source of enterprise security risk.

And in August, Taiwan confirmed that its government agencies had been targeted by an AI-assisted cyber campaign. According to Taiwan’s Ministry of Digital Affairs, the attack combined human operators with autonomous AI tooling, illustrating how AI can increase the speed and scale at which sophisticated campaigns are conducted against government infrastructure.

In its September 2026 Threat Intelligence Report, Anthropic said it had disrupted operations involving suspected state-sponsored groups, criminals and politically motivated actors using AI across reconnaissance, exploitation and data exfiltration. The company said AI is narrowing the skills and tooling gap that once separated sophisticated state operations from less capable attackers.

Anthropic also said the use of AI in cyber operations is becoming more autonomous, with multi-agent frameworks increasingly executing portions of the attack chain rather than merely assisting a human operator.

The defensive response is growing as well. On September 3, OpenAI committed US$1 billion in subsidized cybersecurity tools, training and technical support, explicitly responding to increasingly capable AI-enabled cyberattacks against critical infrastructure and services.

The implication for enterprises is that AI creates risk from two directions. Attackers can use AI to find and exploit vulnerabilities faster. At the same time, enterprises are increasingly connecting AI models to internal applications, databases, email, cloud infrastructure, code repositories, and other sensitive systems. The more access those models receive, the more valuable they become. However, the consequences of compromise also increase. As a result, securing data, which may even be considered secure by current encryption standards, becomes even more relevant.

Enterprise Buyers Are Starting to Draw a Line

The tone from governments and technology executives has become noticeably more urgent. In June, the cybersecurity agencies of the Five Eyes nations (Canada, the U.S., U.K., Australia and New Zealand) issued a rare joint warning that frontier AI is changing cyber risk faster than many organizations are prepared for. Their message was particularly direct: the relevant timeline is now measured in months, not years, and organizations should begin strengthening their cyber resilience before more capable models arrive.

Anthropic has taken similar precautions with its own technology. When launching its Fable 5 and Mythos 5 models, the company acknowledged that their cybersecurity capabilities could cause serious harm if misused and restricted access to the most capable cyber functionality. Anthropic CEO Dario Amodei has argued more broadly that advanced AI models have become tools of national and global strategic significance, particularly because of their emerging cyber capabilities.

Microsoft is making the same point from the enterprise-security side. In July, Hayete Gallot, Executive Vice President of Microsoft Security, described the underlying “physics of cyber” as changing as AI increases the speed and scale of both attack and defence.

Anthropic has also brought together AWS, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, Microsoft, NVIDIA, Palo Alto Networks and others through Project Glasswing, an initiative designed to protect critical software as frontier AI becomes increasingly capable of discovering and exploiting vulnerabilities. Anthropic says frontier models are already becoming competitive with highly skilled humans in this area.

On September 14, Reuters reported that Palantir, NVIDIA and Booz Allen Hamilton were restricting or reconsidering the use of advanced third-party AI models over concerns about data retention, proprietary information and model-provider access.

Palantir also reportedly sought irrevocable zero-data-retention commitments, NVIDIA limited use of Anthropic models for more sensitive work, and Booz Allen restricted commercial AI from proprietary cybersecurity applications. These are exactly the kinds of use cases where AI is valuable but the underlying data cannot be treated casually.

This means that as models become more capable and more connected, data privacy, model security and secure inference move from optional features toward core enterprise-security requirements.

QAW Targets Both Sides of the Problem

This does not mean Sophic Capital Client 01 Quantum’s [TSXV: ONE, OTCQB: OONEF] Quantum AI Wrapper (“QAW”) is a universal solution to AI-enabled cyberattacks. Firewalls, identity controls, endpoint security, monitoring, vulnerability management and other traditional cybersecurity tools remain essential.

Rather, QAW addresses one of the specific vulnerabilities becoming more important as enterprises increase their use of AI: the need to perform AI inference without unnecessarily exposing the underlying data or the model itself. QAW is designed to encrypt both sides of the interaction. Using Fully Homomorphic Encryption (“FHE”) alongside IronCAP™ post-quantum cryptography, sensitive user data and model information can remain protected while the AI performs the computation.

At a high level, 01 Quantum sits at the intersection of PQC, FHE and AI: IronCAP™ provides post-quantum protection; FHE enables computation on encrypted information; QAW combines those capabilities for secure/private AI inference; and the Company’s secure AI marketplace architecture could provide a future distribution and commercialization layer for protected AI models.

That is particularly relevant for the types of organizations now expressing the greatest concern around AI security: banks, governments, defence organizations, healthcare systems and companies developing valuable intellectual property. If an enterprise wants to use AI to analyze customer records, fraud data, defence intelligence, proprietary engineering information or an unpatented technology, the security question becomes straightforward: Can the organization obtain the benefit of AI without exposing the information that makes the application valuable in the first place? That is the problem QAW is intended to solve.

More recently, 01 Quantum, Carleton University, and the National Centre for Critical Infrastructure Protection, Security and Resilience announced a research collaboration focused on privacy and data leakage in AI. The first phase is designed to quantify leakage in a standard unencrypted environment, with a later phase evaluating an encryption-compatible model component using FHE. The test environment is intended to replicate financial-services use cases such as fraud detection and customer-risk assessment.

Quantum-safe AI may therefore be more than a long-term Q-Day opportunity. Secure and privacy-preserving AI is becoming a cybersecurity requirement today, and QAW gives 01 Quantum a product aimed directly at that emerging problem. We think that is an important evolution of the story. QAW should not be viewed simply as protection against a future quantum computer. The more immediate opportunity may be allowing sensitive AI workloads to operate without exposing the underlying data or model IP in plaintext. That creates a potential commercial catalyst today, independent of Q-Day.

The Window of Opportunity is Fast Approaching, But the Migration Will Take Years

There is a temptation in quantum investing to look for one headline that proves the threat has arrived. We do not think that is the right way to frame it. NVIDIA’s Ising does not mean Q-Day is tomorrow or on a certain date. Microsoft’s 2029 target is not guaranteed. IBM’s roadmap could change. Google’s resource estimates depend on assumptions about future hardware. But taken together with increasingly specific government deadlines, the direction of travel has become harder to ignore.

The quantum threat to current cybersecurity systems is advancing from multiple directions at once:

Hardware is improving.
Algorithms are becoming more efficient.
AI is helping solve quantum engineering problems.
Governments are imposing migration timelines.
Enterprises are being pushed toward cryptographic inventory and remediation.
AI privacy is creating an entirely separate reason to adopt secure computation.

The precise timing remains uncertain. The need to prepare does not.

Coming Up…

If The (01) Quantum Window Is Fast Approaching establishes why the migration window appears to be narrowing, the next question is how 01 Quantum plans to capture the opportunity.

In Sophic Capital’s next report, From Product to Pipeline, we move from urgency to execution and examine the Company’s growing partner ecosystem, its channel-led strategy, and why the next stage of the investment story is increasingly about converting technology and relationships into pipeline, customer deployments, and recurring revenue.

For More Research

Access more 01 Quantum research HERE

Sign up for Sophic Capital’s reports HERE

Disclosures

01 Quantum Inc. [TSXV: ONE, OTCQB: OONEF] has contracted Sophic Capital for capital markets advisory and investor relations services.

Disclaimers

The information and recommendations made available through our emails, newsletters, website and press releases (collectively referred to as the “Material”) by Sophic Capital Inc. (“Sophic” or “Company”) is for informational purposes only and shall not be used or construed as an offer to sell or be used as a solicitation of an offer to buy any services or securities. In accessing or consuming the Materials, you hereby acknowledge that any reliance upon any Materials shall be at your sole risk. None of the information provided in our monthly newsletter and emails or any other Material should be viewed as an invite, and/or induce or encourage any person to make any kind of investment decision. The recommendations and information provided in our Material are not tailored to the needs of particular persons and may not be appropriate for you depending on your financial position or investment goals or needs. You should apply your own judgment in making any use of the information provided in the Company’s Material, especially as the basis for any investment decisions. Securities or other investments referred to in the Materials may not be suitable for you and you should not make any kind of investment decision in relation to them without first obtaining independent investment advice from a qualified and registered investment advisor. You further agree that neither Sophic, its, directors, officers, shareholders, employees, affiliates consultants, and/or clients will be liable for any losses or liabilities that may be occasioned as a result of the information provided in any of the Material. By accessing Sophic’s website and signing up to receive the Company’s monthly newsletter or any other Material, you accept and agree to be bound by and comply with the terms and conditions set out herein. If you do not accept and agree to the terms, you should not use the Company’s website or accept the terms and conditions associated to the newsletter signup. Sophic is not registered as an adviser or dealer under the securities legislation of any jurisdiction of Canada or elsewhere and provides Material on behalf of its clients pursuant to an exemption from the registration requirements that is available in respect of generic advice. In no event will Sophic be responsible or liable to you or any other party for any damages of any kind arising out of or relating to the use of, misuse of and/or inability to use the Company’s website or Material. The information is directed only at persons resident in Canada. The Company’s Material or the information provided in the Material shall not in any form constitute as an offer or solicitation to anyone in the United States of America or any jurisdiction where such offer or solicitation is not authorized or to any person to whom it is unlawful to make such a solicitation. If you choose to access Sophic’s website and/or have signed up to receive the Company’s monthly newsletter or any other Material, you acknowledge that the information in the Material is intended for use by persons resident in Canada only. Sophic is not an investment advisor, nor does it maintain any registrations as such, and Material provided by Sophic shall not be used to make investment decisions. Information provided in the Company’s Material is often opinionated and should be considered for information purposes only. No stock exchange or securities regulatory authority anywhere has approved or disapproved of the information contained herein. There is no express or implied solicitation to buy or sell securities. Sophic and/or its principals and employees may have positions in the stocks mentioned in the Company’s Material and may trade in the stocks mentioned in the Material. Do not consider buying or selling any stock without conducting your own due diligence and/or without obtaining independent investment advice from a qualified and registered investment advisor. The Company has not independently verified any of the data from third party sources referred to in the Material, including information provided by Sophic clients that are the subject of the report, or ascertained the underlying assumptions relied upon by such sources. The Company does not assume any responsibility for the accuracy or completeness of this information or for any failure by any such other persons to disclose events which may have occurred or may affect the significance or accuracy of any such information.

The Material may contain forward looking information. Forward-looking statements are frequently, but not always, identified by words such as “expects,” “anticipates,” “believes,” “intends,” “estimates,” “potential,” “possible,” “projects,” “plans,” and similar expressions, or statements that events, conditions or results “will,” “may,” “could,” or “should” occur or be achieved or their negatives or other comparable words and include, without limitation, statements regarding, projected revenue, income or earnings or other results of operations, strategy, plans, objectives, goals and targets, plans to increase market share or with respect to anticipated performance compared to competitors, product development and adoption by potential customers. These statements relate to future events and future performance. Forward-looking statements are based on opinions and assumptions as of the date made and are subject to a variety of risks and other factors that could cause actual events/results to differ materially from these forward-looking statements. There can be no assurance that such expectations will prove to be correct; these statements are no guarantee of future performance and involve known and unknown risks, uncertainties and other factors. Sophic provides no assurance as to future results, performance, or achievements and no representations are made that actual results achieved will be as indicated in the forward-looking information. Nothing herein can be assumed or predicted, and you are strongly encouraged to learn more and seek independent advice before relying on any information presented.