# QCT Studio services Every engagement is scoped to a clear outcome and led by the people you meet in the first conversation. Pricing is set in scoping. ## Practices ### Post-quantum Traffic and archives captured today can be decrypted once a cryptographically relevant quantum computer exists, and the deadlines are now on paper: US federal systems by 2030, NIST's finish line in 2035. We start with a two-week readiness sprint, then a full assessment of where vulnerable cryptography lives and which data outlives it, and move the systems that matter to hybrid post-quantum designs, with a rollback path at every step. Scope: PQC migration, Crypto-agility, Key management, Quantum-safe networks. Page: https://qctcapital.com/studio/services/post-quantum ### AI & privacy In a regulated firm, most AI risk is a data question: what reaches a model, who can see what it returns, and whether you can prove both to a regulator. We design the data controls, model protection and privacy-preserving techniques, from confidential computing to MPC and homomorphic encryption where they are practical, that let teams use AI on sensitive data and still pass review. Scope: Data governance, Model protection, Confidential computing, Privacy engineering. Page: https://qctcapital.com/studio/services/ai-privacy ### AI agent security Agents are moving into production faster than the controls around them, and an agent that can call tools can move money, change records or leak data when it is tricked. We give each agent its own identity and the narrowest permissions that work, defend the paths prompt injection uses, and red-team the deployment against the OWASP agentic risks before it ships, so it passes security and regulatory review instead of stalling in it. Scope: Agent identity, Least-privilege tools, Prompt-injection defence, Red-teaming. Page: https://qctcapital.com/studio/services/ai-agent-security ### Cybersecurity For finance and critical systems the question is not whether something will go wrong but how fast you detect it and how cleanly you recover. We review and design security architecture, test resilience against the scenarios DORA and NIS2 supervisors now ask about, and get incident playbooks ready before they are needed, on a retainer for teams that need senior judgement more often than they can hire it. Scope: Security architecture, Resilience, Incident readiness, Detection & response. Page: https://qctcapital.com/studio/services/cybersecurity ### Technology Deep tech is where claims run furthest ahead of evidence: quantum advantage, homomorphic encryption at scale, a new security chip, an AI platform that will not fall over under load. We bring operators with patents in cryptography and machine learning, who have built and run systems in regulated environments, to separate what works today from what is still research. Then we help design, prototype and build what is real, from a diligence memo to a venture with clean IP. Scope: Deep-tech diligence, Quantum & cryptography, AI infrastructure, Venture build. Page: https://qctcapital.com/studio/services/technology ## Why now - **2035, Standards deadline.** NIST finalised its first post-quantum standards in 2024 and targets removal of quantum-vulnerable algorithms by 2035, with earlier action for high-risk systems. (Source: NIST.) - **89%, Enterprise AI adoption.** The share of enterprises now using AI, up from 55% in 2023. (Source: McKinsey, The state of AI in 2026.) - **$4.99M, Average breach cost.** A record, up 12% year on year. AI-enabled breaches average about $6M. (Source: IBM, Cost of a Data Breach 2026.) ## Engagements ### Quantum-readiness and crypto-agility assessment Where quantum-vulnerable cryptography lives across your estate, which data outlives it, and the order in which to move it, with a plan your board and regulator will accept. - Type: Assessment - Shape: 6–10 weeks, fixed scope - For: Banks, insurers, payments, government and critical infrastructure ### Post-quantum migration roadmap Turn exposure into a phased programme: which systems move first and which wait on a dependency, where hybrid operation keeps trust unbroken, who decides, funds and accepts residual risk, and the measures that show it is moving rather than merely planned. - Type: Roadmap - Shape: Scoped in proposal - For: Security, technology and transformation leaders with a post-quantum mandate ### Crypto-agility strategy Post-quantum will not be the last cryptographic change. We find where algorithms, certificates and trust anchors are hard-coded, then design the architecture, governance and operating model that let you swap them without rebuilding the estate. - Type: Strategy - Shape: Scoped in proposal - For: Security architecture and platform teams ### Secure AI and agent deployment pilot Put an agent into production with identity, least-privilege tools, data controls and red-teaming designed in from the first sprint, on a weekly delivery cadence. - Type: Pilot - Shape: 10–16 weeks - For: Regulated enterprises and their AI teams ### AI and cybersecurity technical diligence An operator's read on the security, cryptography and AI claims behind a transaction, a vendor selection or a partnership, before you commit. - Type: Diligence - Shape: Scoped in proposal - For: Investors, family offices and corporates ### Security architecture and resilience advisory Senior judgement on security architecture, resilience and incident readiness, on a monthly retainer, for teams that need it more often than they can hire it. - Type: Advisory - Shape: Monthly retainer - For: Security and risk leaders in finance, infrastructure and the public sector ### Talent network and placement Senior security, cryptography and AI hires for your team, from people who have shipped in regulated environments. - Type: Placement - Shape: Scoped in proposal - For: Banks, AI startups and security vendors ### Venture build and research Turn a validated deep-tech problem into a company, with clean IP ownership and a paying design partner from the start. - Type: Venture build - Shape: Cash plus negotiated equity - For: Corporate sponsors, founders or a validated concept ## Method: four pillars, one evidence base 1. **Assess:** Know your exposure, by data class. Six-dimension readiness scan; Mosca analysis (X + Y vs Z) for every data class; Gap analysis against DORA, NIST and EU guidance. Output: Mosca analysis, Regulatory gap analysis. 2. **Discover:** Find every algorithm, key and certificate. Automated discovery across code, TLS, PKI and cloud; CycloneDX cryptographic bill of materials (CBOM); Priority scoring for harvest-now, decrypt-later exposure. Output: CycloneDX CBOM, Priority scoring. 3. **Migrate:** Move to hybrid post-quantum designs, safely. Hybrid ML-KEM and ML-DSA reference designs; PKI, HSM and KMS re-architecture; Production pilots with rollback paths. Output: Reference designs, Production pilots. 4. **Assure:** Prove it, continuously, to boards and regulators. CBOM drift monitoring; Stage 0–5 maturity, scored on shipped evidence; Board and regulator reporting. Output: CBOM drift watch, Board reporting. ## How to engage 1. **Readiness sprint.** A fixed-fee, two-week sprint: an exposure heatmap, a Mosca analysis and your top ten priorities. 2. **Pilot.** A scoped discovery or secure-AI pilot with named senior leads and a weekly delivery cadence. 3. **Partner.** An ongoing advisory and migration programme, led by the same senior people who ran the sprint. ## Mosca's test If X + Y is greater than Z, that data is already exposed. An interactive calculator is on the page. ## Delivery partner QDefence: Year-one post-quantum delivery partner for readiness sprints, crypto discovery, migration architecture and assurance. - **Readiness & discovery.** Readiness sprints, QGuard crypto discovery, CBOM and harvest-now, decrypt-later exposure scoring. - **Migration architecture.** Hybrid post-quantum designs for transport, PKI and firmware; HSM and KMS redesign. - **Assurance & advisory.** CBOM drift monitoring, stage 0–5 reporting, and board and regulator briefings. Disclosure: QDefence was co-founded by our CTO and a NIST PQC contributor. It works with QCT at arm's length, and client contracts sit with QCT Studio. --- Canonical page: https://qctcapital.com/studio/services Contact: contact@qctcapital.com Site summary for agents: https://qctcapital.com/llms.txt