Bezos has an Elon problem

The quantum threat to critical infrastructure is not theoretical. It is sitting on port 44818 right now, waiting.

A Shodan scan run by Forescout’s Vedere Labs on August 3, 2026 identified 4,407 internet-facing Rockwell Automation and Allen-Bradley programmable logic controllers worldwide, with 2,844 located in the United States. Twenty-two of the exposed controllers sit in cities already confirmed as victims of the water-sector attacks that began in late July 2026, and 19 of those 22 devices appear vulnerable to a 2017 remote code execution flaw in certain MicroLogix 1400 units that Rockwell addressed with updated firmware in 2017. That is the baseline: the devices guarding drinking water are running decade-old code. A quantum-capable adversary does not need a zero-day. It just needs time.

The July 2026 campaign affected more than 30 Minnesota community water systems, together with related incidents in other U.S. states and Canada, exposing internet-facing PLCs, HMIs, cellular modems, and remote-access services as critical points of weakness. The attackers were nation-state actors using classical means. The post-quantum version of this attack is more corrosive because it starts silently, years earlier, harvesting encrypted firmware traffic to decrypt after Q-Day arrives.

“Harvest now, decrypt later” tactics are already actively scraping encrypted OT and IT data for future decryption. Industrial controllers are the prize. Operational technologies in these environments were built with a focus on reliability and uptime, not cybersecurity. As a consequence, many SCADA and ICS networks continue to use legacy encryption schemes, limited segmentation, and outdated firmware.

Two small companies are building directly into that gap. PQShield, privately held with $27 million raised, showcased an ultra-small-footprint update to its PQMicroLib-Core library at Embedded World in March 2026. The upgraded version targets post-quantum cryptography for embedded devices in as little as 5 KB of RAM. That constraint matters enormously in OT. PQShield is pitching the update as a way for device makers to adopt post-quantum cryptography without redesigning hardware in sectors such as industrial control systems and networking equipment, arguing that device makers often must choose between removing features, compromising performance, or reworking hardware designs to add memory. The library is marketed as CAVP-certified, but the company does not tie that claim to a specific certification date in its product materials.

SEALSQ (Nasdaq: LAES), with a market cap well below $1 billion, took the silicon route. SEALSQ unveiled VaultIC409, a next-generation secure element built on the QS7001 platform, targeting markets including smart energy, industrial automation, and connected infrastructure, giving existing VaultIC408 customers a path to post-quantum security without redesigning their hardware security foundation. Engineering samples are planned for Q2 2027. The company says the QS7001 platform is in the Common Criteria EAL5+ evaluation process, with certification work still ongoing.

The business angle is the firmware upgrade cycle. Industrial IoT device lifecycles commonly extend to ten or even twenty years. Secure boot is a particularly sensitive area: if firmware authenticity and integrity are checked using classical algorithms, a future quantum attack could undermine the foundational trust of the device, making quantum-resistant secure-boot mechanisms one of the most urgent PQC challenges. Every water pump controller and substation relay that cannot be field-updated is a captive customer for a hardware replacement cycle running into the billions of dollars globally.

PQShield and SEALSQ are not the only names in this space, but they are the ones moving fastest at the constrained-device layer where the real vulnerability lives. The firms building quantum-safe software for enterprise data centers will capture headlines. The firms rewriting foundational device code for a $150 Rockwell PLC at a Minnesota pump station will capture the contracts that actually matter for grid and water security over the next decade.