Qtonic Quantum has launched QShield as part of its SAFE/29 runtime for Linux hosts, using standardized post-quantum algorithms to secure active connections. In a reported 259,219-second AWS endurance test, the system completed 4,107 successful checks with zero failed checks and zero ping loss.
Qtonic Quantum Corp says its new QShield runtime protected active Linux-to-Linux network connections without dedicated appliances or pre-shared key infrastructure. The software creates encrypted overlay tunnels at the host layer and is designed to address data that attackers could capture today and decrypt later with a sufficiently capable quantum computer, a risk commonly described as harvest-now-decrypt-later.
QShield is delivered through paid, scoped, operator-led engagements as part of Qtonic Quantum's SAFE/29 runtime. The company says enterprise and government buyers can request demonstrations and proposals directly. Its architecture keeps private keys exclusively on the endpoints rather than relying on a separate hardware security appliance or a pre-distributed key system.
The cryptographic stack combines ML-KEM-1024 for key establishment and ML-DSA-87 for endpoint authentication. Both are standardized by the National Institute of Standards and Technology under FIPS 203 and FIPS 204, respectively; the standards describe lattice-based mechanisms intended to remain secure against known classical and quantum attacks. The specifications are summarized in NIST's ML-KEM standard. AES-256-GCM then encrypts network payloads and provides authenticated encryption, allowing recipients to detect tampering as well as recover the data.
ML-KEM-1024 and ML-DSA-87 are associated with the highest NIST security category offered within their respective standard families. That designation concerns the algorithms' security parameters, not the security of an entire deployment. As research communities at MIT and CERN have emphasized in broader quantum-information work, a cryptographic protocol still depends on implementation quality, key handling and the security of the surrounding computing environment.
This is post-quantum cryptography rather than quantum cryptography. The system runs as software on conventional Linux hosts and does not claim to distribute quantum states or keys. Its practical value therefore depends on deployment quality, endpoint security and the ability to integrate the runtime into existing network operations. The distinction is important because post-quantum cryptography is intended to migrate onto ordinary networks, whereas quantum key distribution requires specialized physical and communications infrastructure.
Qtonic Quantum published a cryptographically verified evidence bundle from a continuous three-day endurance test between two Linux hosts in separate AWS Oregon availability zones. Independent trade coverage placed the exercise between September 13 and September 16. Qtonic's proof-center record reports 259,219 seconds of operation, 4,107 successful checks, zero failed checks and zero ping loss. The run used periodic validations and 64 KiB transfers at roughly 63-second intervals, while the company also reported zero daemon restarts.
Those figures provide a specific stability result for one controlled runtime evaluation. They do not establish protection against every implementation failure, endpoint compromise or operational condition, and the available material does not identify an independent laboratory that repeated the test. The evidence is consequently strongest as a reliability claim about the reported AWS exercise rather than as a broad security certification. As in peer-reviewed Nature studies of security systems, reproducibility, independent testing and clearly defined failure conditions would be needed to generalize beyond this single sample.
Qtonic Quantum is headquartered in Miami and is led in Government Affairs by Col. Reginald M. Harris (U.S. Army Ret.). The company is targeting data-center interconnects, high-value financial data channels and research transfers while organizations continue broader post-quantum migration. Its launch follows the same market direction as earlier quantum-safe work focused on protecting communications infrastructure without requiring dedicated dark fiber.
The selected parameter sets correspond to the highest security levels specified under NIST guidelines, according to the company's announcement. Qtonic Quantum also positions QShield against upcoming federal requirements, including CNSA 2.0 provisions for national security system acquisitions beginning January 1, 2027, and Executive Order 14412 directives for high-value federal assets through 2030.
That policy alignment may make software-only migration attractive where replacing network hardware would slow deployment. It does not remove the engineering work. Organizations still need to install and maintain the runtime on compatible Linux hosts, protect endpoint private keys, validate authentication behavior and assess how fail-closed operation affects availability during faults. A fail-closed design can prevent unprotected traffic from proceeding, but it can also turn a cryptographic or service failure into a network-availability event that requires operational planning.
Qtonic says QShield is not represented as FIPS 140-3 validated and does not claim government authorization. That limitation is material for procurement teams and compliance officers: use of FIPS-named algorithms does not mean that the product itself has completed a FIPS 140-3 module validation or received an agency authorization.
The distinction matters because a strong algorithm cannot compensate for an exposed endpoint or a badly managed deployment. QShield's launch is therefore a concrete attempt to move post-quantum protection into active network traffic, but the available evidence supports a tested software runtime rather than a universal security guarantee. The product's endpoint-controlled keys and fail-closed behavior address specific operational concerns, yet they should be assessed through threat modeling, configuration review and independent security testing.
Post-quantum cryptography is designed for the period before large fault-tolerant quantum computers exist: it replaces vulnerable public-key mechanisms with algorithms intended to resist quantum attacks while continuing to run on ordinary computing infrastructure. AES-256-GCM is a symmetric cipher used here for the data itself, whereas ML-KEM-1024 establishes shared secret material and ML-DSA-87 authenticates endpoints. That division explains both the immediate appeal of QShield and its limit: the cryptographic design can reduce future decryption risk, but secure results still depend on correct software operation and endpoint protection. On the evidence provided, QShield is a deployment-focused response to harvest-now-decrypt-later exposure and a useful reminder that post-quantum migration is an engineering program rather than a single product purchase.
