# QCT Capital: Ideas for a more secure tomorrow > QCT Capital LLC is home to QCT Studio, a senior technical studio for post-quantum security, cybersecurity and technology in regulated industries, and QCT Venture, an early-stage investment practice that is currently under development. Mission: Investing in extraordinary people building a safer, more open and resilient world. Source: https://qctcapital.com ## The model: one firm, two engines - **Venture.** We lead and co-lead pre-seed rounds and follow at seed, backing companies with a genuine security, privacy or cryptographic advantage. - **Studio.** Senior pods deliver quantum security, cybersecurity and technology work for banks and regulated enterprises, paid from day one. Every engagement and placement shows us the problems buyers will pay to solve, and the founders solving them, before the market sees them. ## Why now - **2024: The standards are final.** NIST published its first post-quantum standards: FIPS 203 (ML-KEM), FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA). - **2025: Resilience becomes law.** The EU's Digital Operational Resilience Act took effect, putting ICT risk, including cryptography, in front of boards and regulators. - **2030: Deprecation begins.** NIST's transition plan deprecates today's quantum-vulnerable public-key algorithms, with earlier action expected for high-risk systems. - **2035: Quantum-vulnerable algorithms disallowed.** RSA and elliptic-curve cryptography are scheduled to be removed from NIST standards altogether. Mosca's theorem: if X (years data must stay secret) plus Y (years to migrate) exceeds Z (years until a cryptographically relevant quantum computer), that data is already at risk. The Studio services page includes an interactive calculator. ## Thesis and focus areas Source: https://qctcapital.com/thesis ### Quantum security The migration to post-quantum cryptography is the largest forced upgrade the financial system has faced. We back the tooling that makes it tractable. - Cryptographic discovery and migration orchestration - PQC key management and crypto-agility - Quantum-safe identity, payments and custody protocols - QKD and QRNG integration for banks and telecoms Edge: Decades of applied cryptography and key-management work, and a buyer network across custodians and banks. ### Cybersecurity for high-consequence sectors Finance and critical systems cannot tolerate downtime or doubt. We back defence, detection and recovery built for that standard. - AI-enabled defence, detection and recovery - Exposure management - Secure infrastructure for finance and critical systems Edge: Security leadership inside Intel, JPMorgan and State Street, where these products are bought. ### AI security and privacy As agents gain permissions, the attack surface moves into the model. We back the controls that let regulated firms deploy AI with confidence. - Agent identity and permissions - Model and application security, red-teaming and data controls - Confidential computing, MPC and FHE where deployment is practical Edge: Hands-on AI implementation in regulated enterprises, and the judgement to separate real utility from research-only claims. ### What we deliberately don't do - **No broad blockchain thesis.** Exposure is incidental: only where it serves security, cryptography or regulated financial infrastructure. - **No frontier quantum hardware.** Its capital intensity, duration and scientific underwriting do not fit an early-stage security fund. - **No generic AI applications.** Every company we back carries a security, privacy, trust, cryptographic or resilience advantage. - **No services disguised as ventures.** Studio projects must show repeatability, product potential and clean ownership before any spinout. ## QCT Studio Source: https://qctcapital.com/studio QCT Studio is the operating practice of QCT Capital LLC. QCT Venture, the investment practice, is currently under development. ### Practices - **Post-quantum.** Move to post-quantum before it is urgent. PQC migration, crypto-agility, key management and quantum-safe networks: find every algorithm, key and certificate, decide what moves first, and migrate to hybrid ML-KEM and ML-DSA designs without breaking production. Scope: PQC migration, Crypto-agility, Key management, Quantum-safe networks. - **AI & privacy.** Use AI without giving your data away. Model protection, confidential computing and data governance, so sensitive data stays governed when it meets a model, and you can prove it to a regulator. Scope: Data governance, Model protection, Confidential computing, Privacy engineering. - **AI agent security.** Agents in production, on your terms. Agent identity, least-privilege tool access, prompt-injection defence and red-teaming, designed into the pilot from the first sprint rather than bolted on after it. Scope: Agent identity, Least-privilege tools, Prompt-injection defence, Red-teaming. - **Cybersecurity.** Defence that holds when it matters. Security architecture, resilience and incident readiness for finance and critical systems, from senior people on call. Scope: Security architecture, Resilience, Incident readiness, Detection & response. - **Technology.** Deep tech, made dependable. Diligence, architecture and venture builds for deep tech: quantum, advanced cryptography, confidential computing and AI infrastructure, judged by people who have shipped it. Scope: Deep-tech diligence, Quantum & cryptography, AI infrastructure, Venture build. ### Offerings - **Quantum-readiness and crypto-agility assessment** (6–10 weeks, fixed scope). For banks, insurers, payments, government and critical infrastructure. Where quantum-vulnerable cryptography lives across your estate, which data outlives it, and the order in which to move it, with a plan your board and regulator will accept. - **Post-quantum migration roadmap** (Scoped in proposal). For security, technology and transformation leaders with a post-quantum mandate. Turn exposure into a phased programme: which systems move first and which wait on a dependency, where hybrid operation keeps trust unbroken, who decides, funds and accepts residual risk, and the measures that show it is moving rather than merely planned. - **Crypto-agility strategy** (Scoped in proposal). For security architecture and platform teams. Post-quantum will not be the last cryptographic change. We find where algorithms, certificates and trust anchors are hard-coded, then design the architecture, governance and operating model that let you swap them without rebuilding the estate. - **Secure AI and agent deployment pilot** (10–16 weeks). For regulated enterprises and their ai teams. Put an agent into production with identity, least-privilege tools, data controls and red-teaming designed in from the first sprint, on a weekly delivery cadence. - **AI and cybersecurity technical diligence** (Scoped in proposal). For investors, family offices and corporates. An operator's read on the security, cryptography and AI claims behind a transaction, a vendor selection or a partnership, before you commit. - **Security architecture and resilience advisory** (Monthly retainer). For security and risk leaders in finance, infrastructure and the public sector. Senior judgement on security architecture, resilience and incident readiness, on a monthly retainer, for teams that need it more often than they can hire it. - **Talent network and placement** (Scoped in proposal). For banks, ai startups and security vendors. Senior security, cryptography and AI hires for your team, from people who have shipped in regulated environments. - **Venture build and research** (Cash plus negotiated equity). For corporate sponsors, founders or a validated concept. Turn a validated deep-tech problem into a company, with clean IP ownership and a paying design partner from the start. ### Technical method 1. **Assess:** Know your exposure, by data class. Six-dimension readiness scan; Mosca analysis (X + Y vs Z) for every data class; Gap analysis against DORA, NIST and EU guidance. 2. **Discover:** Find every algorithm, key and certificate. Automated discovery across code, TLS, PKI and cloud; CycloneDX cryptographic bill of materials (CBOM); Priority scoring for harvest-now, decrypt-later exposure. 3. **Migrate:** Move to hybrid post-quantum designs, safely. Hybrid ML-KEM and ML-DSA reference designs; PKI, HSM and KMS re-architecture; Production pilots with rollback paths. 4. **Assure:** Prove it, continuously, to boards and regulators. CBOM drift monitoring; Stage 0–5 maturity, scored on shipped evidence; Board and regulator reporting. ### How to engage 1. **Readiness sprint.** A fixed-fee, two-week sprint: an exposure heatmap, a Mosca analysis and your top ten priorities. 2. **Pilot.** A scoped discovery or secure-AI pilot with named senior leads and a weekly delivery cadence. 3. **Partner.** An ongoing advisory and migration programme, led by the same senior people who ran the sprint. ### Delivery partner QDefence: Year-one post-quantum delivery partner for readiness sprints, crypto discovery, migration architecture and assurance. QDefence was co-founded by our CTO and a NIST PQC contributor. It works with QCT at arm's length, and client contracts sit with QCT Studio. ## Approach Source: https://qctcapital.com/approach ### Four handoffs between the lab and the enterprise buyer 1. **Discovery: Lab-to-market gap.** Breakthrough cryptography rarely leaves the lab with a buyer attached. What has to cross: IP, papers and prototypes. 2. **Product: Customer translation gap.** A primitive is not a product until it fits how a bank actually operates. What has to cross: A repeatable use case and workflow. 3. **Trust: Adoption gap.** Regulated buyers need evidence, not promises, before anything reaches production. What has to cross: Security, compliance and reliability. 4. **Scale: Company-building gap.** Winning the second and tenth customer takes people and capital the first did not. What has to cross: Go-to-market, talent and follow-on capital. ### The platform loop 1. **Diagnose.** We win enterprise relationships through PQC readiness, AI security and technical diligence work. 2. **Pilot.** A senior pod deploys for secure AI, cryptographic migration or resilience, with named leads and a weekly cadence. 3. **Validate.** Client work and talent placements surface the recurring pain points, the gaps and the founders closing them. 4. **Invest.** We fund external founders, and incubate only where demand and IP ownership are clear. 5. **Support.** Portfolio companies get technical diligence, design partners, enterprise access, talent and follow-on capital. ### Structure and governance - **The fund.** Invests at pre-seed and seed in quantum security, cybersecurity and AI security. Guardrails: Independent investment committee; Written valuation, allocation and conflicts policies; First look on every opportunity the platform sees. - **QCT Studio.** Paid technical delivery, diligence, pilots, a talent network and incubation for regulated enterprises. Guardrails: Separate contracts, accounts and P&L; No automatic charge to the fund; Portfolio services at disclosed rates, reported to the LP advisory committee. - **Management company.** Employs the team and runs the investment process, finance and compliance. Guardrails: Written related-party policy; Founder ownership subject to vesting and service; Key-person provisions and quarterly capacity review. ## Team Source: https://qctcapital.com/team ### Navjot Gill, Co-founder and Chief Executive Officer Navjot leads client engagements, commercial structuring and QCT's investment arm. Navjot executed more than $18B in announced technology, media and telecom transactions at BTIG and Wells Fargo, including Silver Lake's acquisition of Qualtrics and IBM's acquisition of Apptio, and founded Heritage Advisory. Leads: Client engagements, Commercial structuring, Investment arm. ### Dr. Jacob Mendel, Co-founder and Chief Technology Officer Jacob brings more than twenty years of cybersecurity leadership and applied cryptography: GM of Intel's Cybersecurity Center of Excellence, applied research leadership at JPMorgan, and security leadership at State Street. Jacob is Senior Lecturer and Head of Cybersecurity Studies at Tel Aviv University, holds 23 approved patents, and co-founded SC Square, which was acquired by Broadcom. Leads: Technical diligence, Security architecture, Research thesis. ### Shreejit Sen, Co-founder and Chief Operating Officer Shreejit is an angel investor in early-stage companies, including Morvdesk, and leads Prizenlabs, an AI venture studio behind DeltaMemory and GaiaLabz, with a background in fintech infrastructure and deep tech. Leads: Studio delivery, Startup scouting, Hiring, Business development. Results described are attributable to individuals in their prior roles and are not indicative of the results of any QCT vehicle. ## For founders Source: https://qctcapital.com/founders - Stage: lead or co-lead at pre-seed; follow at seed; selective Series A follow-ons. - Geography: Weighted to Israel, the UK, Switzerland and Europe, with selective US investments. - Beyond capital: enterprise buyers and design partners, technical diligence, a specialist talent network, studio support at disclosed rates, and reserved follow-on capital. - To introduce a company, email contact@qctcapital.com with a short summary, deck, technical one-pager, design partners or customers, and round details. ## For agents Source: https://qctcapital.com/agents (Markdown: https://qctcapital.com/agents.md) You can quote the public site verbatim; please cite page URLs. Nothing on this site is an investment offer. There is no MCP server, public API or A2A Agent Card yet. ## Investors and contact - Investor relations: https://qctcapital.com/investors - Contact: https://qctcapital.com/contact (contact@qctcapital.com) QCT Capital's website is for information only and is not an offer to sell, or a solicitation of an offer to buy, any interest in any fund or investment vehicle. Fund terms are shared only with qualified investors in confidential materials.