Worried about Y2Q? Meet Ottawa’s quantum-safe innovators leading the race to defend

December 12, 2025

Already an Insider? Log in

Get Instant Access to This Article

Become an Ottawa Business Journal Insider and get immediate access to all of our Insider-only content and much more.

They call it Y2Q. A turning point when quantum computers will be powerful enough to easily crack today’s encryption. Financial records, government documents and military secrets could all be at risk. Sophisticated hackers are already harvesting encrypted data they cannot yet crack, based on the assumption it will soon be crackable. “Everything needs defending.” That was the warning from quantum researcher and entrepreneur Stephanie Simmons to a parliamentary committee on innovation and technology in 2022, noting that a single quantum computer is all that would be needed for “an adversary to have god-like access to all modern and stored communications.” These days, Simmons is co-chair of Canada’s Quantum Advisory Panel. The idea that hackers might hoard secure data isn’t new. Post-Quantum CEO Anderson Cheng coined the phrase “harvest now, decrypt later” to describe the potential threat more than 15 years ago. But what sounded like a nifty science-fiction premise back in 2009 is now an imminent threat to today’s digital security systems. Quantum computing is knocking at the door, our locks aren’t adequate and the thief may already be inside the building. But here in Ottawa, the race to defend is well underway.

Ottawa’s quantum-safe innovators

Crypto4A operates from an unremarkable two-level office suite nestled in a central Ottawa business park near the point where Carling Avenue snakes under the Queensway. From the outside, there are no indications of the quantum challenges that software engineers on the inside are tackling. It seems fitting. Crypto4A is in the business of programming and assembling quantum-secure HSMs, or hardware security modules, seemingly plain metal units foundational to a transition to post-quantum cryptography. Traditional cryptography works like a decoder ring. Both parties share a secret key that allows them to decipher each other’s messages. But if anyone else gets hold of the key, the messages are exposed. Most modern systems get around this risk by using two keys: a public key that lets anyone send a secret message, and a private key that only the receiver can use to decipher it. The public key cannot be used to crack the private key thanks to complex mathematical problems that are easy to solve in one direction but cannot be solved in reverse. Not by conventional computers. Not yet. This is the crux of the quantum threat. Crypto4A CEO and co-founder Bruno Couillard warns that this two-key trick has secured the internet for the past 30 years. He likens the fix required to Boston’s Big Dig, a 15-year, multi-billion-dollar megaproject to replace that city’s raised Central Artery with an underground highway. “This is a physical world equivalent to what we're trying to do in the cryptographic world. We're trying to maintain what exists today functional, lift it, go underneath, change the entire foundation to be post-quantum ready or PQC-enabled. And then put everything back down without stopping the beat of the internet,” he says. This is Couillard’s vision, to underpin the internet’s crypto foundations without interrupting the flow. And he may be uniquely placed to tackle the challenge. Crypto4A’s quantum-ready, tamper-proof and crypto-agile HSMs are the next generation of security concepts pioneered in the Luna HSM, which was created by Bruno Couillard’s earlier company, Chrysalis-IT. The approach has found traction. In 2024, the company was awarded a $3.75-million repayable federal contribution to scale its technology. More recently, Crypto4A announced a strategic partnership with Korean Quantum Computing to commercialize Korea’s first post-quantum-cryptography-based security solution. On the opposite side of the Queensway from Crypto4A, Quantropi occupies an open-concept, sixth-floor suite. Its walls are adorned with striking computer-code-infused murals devised by digital artist Eric Chan, who creates under the moniker eepmon. “Everything we do has a meaning to it,” Quantropi co-founder and CEO James Nguyen explains. “The name Quantropi comes from the two words quantum entropy. We say ‘bring it on’ as our tagline because no matter if it's a supercomputer, a super-AI computer, a quantum computer, a super-quantum computer; no matter what the threat is, bring it on!” This philosophy extends to the decor. As Nguyen explains, the murals on the office’s three structural pillars represent the three guiding principles of the company’s software: establishing trust between parties, leaving attackers uncertain, and harnessing entropy to forge strong keys. Quantropi may sport a different look than Crypto4A, but its goal is similar. “We believe that any solution out there needs to preserve existing infrastructure,” Nguyen says. “Imagine we had to change all the plumbing and the pipes in the city. Do you think that'd be possible?” This is why, he explains, Quantropi’s approach is software-based. It is expandable at a high level, incorporates quantum-ready algorithms and promises the ability to adapt quickly to new threats. “It's realistic and focused on what people actually do, the way they actually use the technology,” he says. NATO has taken an interest. Quantropi was among seven Canadian companies selected for the 2025 cohort of Defence Innovation Accelerator for the North Atlantic (DIANA). So while these two Ottawa-based innovators are leading the way, the test will be whether their quantum-ready solutions can be scaled across every sector.

The race to secure everything

Awareness is growing. According to a 2025 Data Threat Report from Thales, 63 per cent of organizations surveyed point to future encryption compromise as a top quantum-related threat, although few report having plans in place. Those findings are consistent with similar global surveys of IT and security professionals. The race to secure everything began at a leisurely pace, but now is looking more and more like a sprint to the finish. Mathematician Peter Shor launched the race in 1994 by demonstrating how a quantum computer could break traditional cryptography. The pace quickened in 2016, when the U.S. National Institute of Standards and Technology launched a competition for quantum-secure algorithms. But the contest didn’t really heat up until 2022. That’s when the initial results of the competition were announced, the U.S. Congress passed the Quantum Computing Cybersecurity Preparedness Act and other nations began to follow suit. At the time, Simmons likened a practical quantum computer to transformative technologies such as the semiconductor or nuclear fission. “After incubation within academia for decades, there is a shift, a mass proliferation of entrepreneurial activity around many distinct approaches, and then, finally, a dominant design emerges,” she said in her testimony to the committee. That quantum race is now well underway, with the winners yet to be determined. It’s not known how many years there are until Y2Q, but Canada appears to have laid its bet on five to 10 years. A roadmap for Canada’s public service announced in June sets a quantum-ready deadline of 2035 for all departments, while systems susceptible to “harvest now, decrypt later” face a tighter five-year deadline. All departments must have initial migration plans in place by April 2026. That timeline may prove challenging for both government and industry. Canada’s National Quantum Strategy notes that past cryptographic transitions have been slow, that currently out-of-date systems are still in use and that the post-quantum transition will be “broader” and more difficult than previous ones.

Ottawa’s role in building Canada’s quantum shield

Quantum computing is knocking at the door. It poses challenges, but also opportunities. Ottawa is home to Canada’s federal quantum research hub at the NRC, a university with one of the strongest photonics faculties in North America, and a cluster of cybersecurity startups building quantum-safe products. In November, researchers with the NRC and the University of Ottawa published a new quantum key distribution method that holds promise for ultra-secure satellite transmission. It’s an important next step in quantum key distribution, which uses quantum mechanics principles to securely share cryptographic keys via photons. It wasn’t an isolated project. Researcher Benjamin Sussman says this work represents a transition from lab-based quantum experiments to real-world quantum technologies. “This sort of scientific development over recent decades is really turning into technology. And a big part of that is taking technologies out of the lab and into the real-world environment. I think this is a real example of that, where we've done work in the lab, in a controlled room, and now we're taking it outside,” he tells OBJ.