Index
Are the quantum companies quantum-safe?
The companies below are building the machines that will one day break today’s encryption. So we scanned every public server they run for the defence against exactly that: post-quantum key exchange. The result is its own kind of answer. Of 259 servers at 14 companies, 167 have it. 1 of 14 companies protect every server.
| Grade | Company | Post-quantum servers | Fix first | |
|---|---|---|---|---|
| A | ionq.com | 38/38 | 0 | Follow |
| B | xanadu.ai 1 server without post-quantum key exchange
| 16/17 | 0 | Follow |
| B | atom-computing.com 1 server without post-quantum key exchange
| 7/8 | 0 | Follow |
| B | quantinuum.com 7 servers without post-quantum key exchange
| 20/27 | 1 | Follow |
| B | quera.com 4 servers without post-quantum key exchange
| 10/14 | 0 | Follow |
| B | alice-bob.com 4 servers without post-quantum key exchange
| 6/10 | 0 | Follow |
| B | infleqtion.com 4 servers without post-quantum key exchange
| 6/10 | 1 | Follow |
| B | oxfordquantumcircuits.com 2 servers without post-quantum key exchange
| 3/5 | 0 | Follow |
| B | psiquantum.com 11 servers without post-quantum key exchange
| 17/28 | 0 | Follow |
| B | dwavesys.com 12 servers without post-quantum key exchange
| 15/27 | 0 | Follow |
| B | quantumcomputinginc.com 6 servers without post-quantum key exchange
| 6/12 | 0 | Follow |
| C | pasqal.com 13 servers without post-quantum key exchange
| 10/23 | 2 | Follow |
| C | meetiqm.com 5 servers without post-quantum key exchange
| 3/8 | 0 | Follow |
| C | rigetti.com 22 servers without post-quantum key exchange
| 10/32 | 7 | Follow |
What was checked. Every hostname each company has a public certificate for, taken from Certificate Transparency logs, plus common service names under the domain and under every wildcard certificate, kept only where the name resolves to a public address, then tested with post-quantum-only TLS 1.3 handshakes. A server that completes one supports hybrid ML-KEM key exchange, the protection against harvest now, decrypt later. Highlighted names are production login, API, VPN, payment and developer hosts: the ones to fix first. A hostname shows what a server is called, not what traffic it carries, and this is the outside view only.
Scanned between November 10, 2026 and November 10, 2026. Every company is re-scanned weekly on the same schedule as Fleet Watch customers. Method: how grades are produced. Press Follow on any row to be emailed when its grade changes.
Often the classical servers are not the quantum hardware or the cloud API. They are the careers site, the marketing host or a partner portal, which is exactly the kind of gap an outside scan surfaces and an inside inventory misses.
Want the same read on your own domain, or on your suppliers? Fleet Watch runs this scan privately every week, with an alert when anything gets worse and a report your auditor can verify. The first scan is free.
Scan your own domain