Services
Post-quantum, cyber and AI security for regulated enterprises.
Five practices and a short menu of engagements. Every one is scoped to a clear outcome and led by the people you meet in the first conversation; pricing is set in scoping.
Practices
Five practices, one evidence base.
- 01 · Post-quantumMove to post-quantum before it is urgent.PQC migration, crypto-agility, key management and quantum-safe networks: find every algorithm, key and certificate, decide what moves first, and migrate to hybrid ML-KEM and ML-DSA designs without breaking production.PQC migrationCrypto-agilityKey managementQuantum-safe networks
- 02 · AI & privacyUse AI without giving your data away.Model protection, confidential computing and data governance, so sensitive data stays governed when it meets a model, and you can prove it to a regulator.Data governanceModel protectionConfidential computingPrivacy engineering
- 03 · AI agent securityAgents in production, on your terms.Agent identity, least-privilege tool access, prompt-injection defence and red-teaming, designed into the pilot from the first sprint rather than bolted on after it.Agent identityLeast-privilege toolsPrompt-injection defenceRed-teaming
- 04 · CybersecurityDefence that holds when it matters.Security architecture, resilience and incident readiness for finance and critical systems, from senior people on call.Security architectureResilienceIncident readinessDetection & response
- 05 · TechnologyDeep tech, made dependable.Diligence, architecture and venture builds for deep tech: quantum, advanced cryptography, confidential computing and AI infrastructure, judged by people who have shipped it.Deep-tech diligenceQuantum & cryptographyAI infrastructureVenture build
Why now
Security is moving from retrofit to mandatory spend.
PQC
2035
Standards deadline
NIST finalised its first post-quantum standards in 2024 and targets removal of quantum-vulnerable algorithms by 2035, with earlier action for high-risk systems.
Source: NIST
AI
89%
Enterprise AI adoption
The share of enterprises now using AI, up from 55% in 2023.
Source: McKinsey, The state of AI in 2026
Risk
$4.99M
Average breach cost
A record, up 12% year on year. AI-enabled breaches average about $6M.
Source: IBM, Cost of a Data Breach 2026
Engagements
A short menu of repeatable work.
01Assessment6–10 weeks, fixed scope
Quantum-readiness and crypto-agility assessment
Where quantum-vulnerable cryptography lives across your estate, which data outlives it, and the order in which to move it, with a plan your board and regulator will accept.
For banks, insurers, payments, government and critical infrastructure
Talk to us about this02RoadmapScoped in proposal
Post-quantum migration roadmap
Turn exposure into a phased programme: which systems move first and which wait on a dependency, where hybrid operation keeps trust unbroken, who decides, funds and accepts residual risk, and the measures that show it is moving rather than merely planned.
For security, technology and transformation leaders with a post-quantum mandate
Talk to us about this03StrategyScoped in proposal
Crypto-agility strategy
Post-quantum will not be the last cryptographic change. We find where algorithms, certificates and trust anchors are hard-coded, then design the architecture, governance and operating model that let you swap them without rebuilding the estate.
For security architecture and platform teams
Talk to us about this04Pilot10–16 weeks
Secure AI and agent deployment pilot
Put an agent into production with identity, least-privilege tools, data controls and red-teaming designed in from the first sprint, on a weekly delivery cadence.
For regulated enterprises and their AI teams
Talk to us about this05DiligenceScoped in proposal
AI and cybersecurity technical diligence
An operator's read on the security, cryptography and AI claims behind a transaction, a vendor selection or a partnership, before you commit.
For investors, family offices and corporates
Talk to us about this06AdvisoryMonthly retainer
Security architecture and resilience advisory
Senior judgement on security architecture, resilience and incident readiness, on a monthly retainer, for teams that need it more often than they can hire it.
For security and risk leaders in finance, infrastructure and the public sector
Talk to us about this07PlacementScoped in proposal
Talent network and placement
Senior security, cryptography and AI hires for your team, from people who have shipped in regulated environments.
For banks, AI startups and security vendors
Talk to us about this08Venture buildCash plus negotiated equity
Venture build and research
Turn a validated deep-tech problem into a company, with clean IP ownership and a paying design partner from the start.
For corporate sponsors, founders or a validated concept
Talk to us about this
Method
Four pillars, one evidence base.
Each stage hands the next one artefacts to build on, from the first scan to board reporting.
- 1
Stage 01
Assess
Know your exposure, by data class.
- Six-dimension readiness scan
- Mosca analysis (X + Y vs Z) for every data class
- Gap analysis against DORA, NIST and EU guidance
Output
- Mosca analysis
- Regulatory gap analysis
- 2
Stage 02
Discover
Find every algorithm, key and certificate.
- Automated discovery across code, TLS, PKI and cloud
- CycloneDX cryptographic bill of materials (CBOM)
- Priority scoring for harvest-now, decrypt-later exposure
Output
- CycloneDX CBOM
- Priority scoring
- 3
Stage 03
Migrate
Move to hybrid post-quantum designs, safely.
- Hybrid ML-KEM and ML-DSA reference designs
- PKI, HSM and KMS re-architecture
- Production pilots with rollback paths
Output
- Reference designs
- Production pilots
- 4
Stage 04
Assure
Prove it, continuously, to boards and regulators.
- CBOM drift monitoring
- Stage 0–5 maturity, scored on shipped evidence
- Board and regulator reporting
Output
- CBOM drift watch
- Board reporting
How to engage
Start small. Expand on evidence.
Most clients begin with a two-week readiness sprint and decide what comes next with the results in hand.
- 01
Readiness sprint
A fixed-fee, two-week sprint: an exposure heatmap, a Mosca analysis and your top ten priorities.
About the readiness sprint - 02
Pilot
A scoped discovery or secure-AI pilot with named senior leads and a weekly delivery cadence.
- 03
Partner
An ongoing advisory and migration programme, led by the same senior people who ran the sprint.
Self-assessment
Run Mosca’s test on your own data.
If the years data must stay secret plus the years to migrate exceed the years until a quantum computer can break today's encryption, that data is already at risk.
How long this data must stay confidential.
How long it will take to move the systems protecting it to post-quantum cryptography.
Your assumption for when a cryptographically relevant quantum computer exists. Estimates vary widely.
X + Y > Z/16 vs 12 years
Exposed. Data encrypted before migration ends could be read for up to 4 years while it must still be secret.
A readiness sprint replaces these assumptions with your real data classes and systems.
Start with a readiness sprintIllustrative model based on Mosca's theorem. Not advice.
Delivery partner
QDefence, our PQC delivery partner.
Year-one post-quantum delivery partner for readiness sprints, crypto discovery, migration architecture and assurance.
- Co-founded by our CTO and a NIST PQC contributor
- Arm's-length, year-one partner
- Client contracts sit with QCT Studio
- 01
Readiness & discovery
Readiness sprints, QGuard crypto discovery, CBOM and harvest-now, decrypt-later exposure scoring.
- 02
Migration architecture
Hybrid post-quantum designs for transport, PKI and firmware; HSM and KMS redesign.
- 03
Assurance & advisory
CBOM drift monitoring, stage 0–5 reporting, and board and regulator briefings.
Disclosure. QDefence was co-founded by our CTO and a NIST PQC contributor. It works with QCT at arm's length, and client contracts sit with QCT Studio.
Let's talk
Start with two weeks.
A fixed-fee readiness sprint: an exposure heatmap, a Mosca analysis and your top ten priorities.
Get in touch
contact@qctcapital.com