QIZ Security

**Product and problem.** QIZ Security addresses one of the most widely deployed yet least managed security controls in the modern enterprise: cryptography itself. The company's own framing is that "cryptography is everywhere, but in most organizations it is not centrally governed," and that most security teams cannot answer basic questions about where encryption lives, which algorithms protect which systems, whether certificates and cipher suites are current, or how exposed they are to future decryption. QIZ's platform — marketed under the tagline "From Cryptography Chaos to Quantum Resilience" — is a cryptographic posture management (CPM) system that continuously inventories cryptographic assets across cloud, on-premises, hybrid, and data-in-motion/at-rest environments, then correlates raw findings with business context so teams can distinguish a handful of critical exposures from thousands of low-priority ones. The concrete problem it solves is the looming, forced migration from today's public-key cryptography (RSA, ECC) to the post-quantum algorithms standardized by NIST, a transition that is impossible to execute safely without first knowing what cryptography an organization actually runs.

**Core technology and how it works.** QIZ organizes its product around four functions — Discover, Prioritize, Remediate, and Govern. Discovery maps cryptographic assets against policy to surface weak, obsolete, or non-compliant usage (deprecated protocols, inadequate cipher suites, expiring certificates, hard-coded keys); prioritization ranks exposures by context, business impact, and remediation effort; remediation supplies step-by-step mitigation and migration plans; and governance sustains cryptographic resilience across the organization over time. Technically, the platform is described as API-first, using integrations rather than agents or probes, and it applies knowledge-graph technology to model organizational context — relationships among applications, business systems, keys, and the encryption that ties them together — so that an isolated finding can be understood as part of a larger risk chain. Compliance enforcement is mapped to frameworks such as NIST's post-quantum standards and the NSA's CNSA 2.0 suite. This architecture is meant to replace one-time protocol scans with continuous visibility and action across "every layer where encryption is used," which is the practical prerequisite for crypto-agility — the ability to swap algorithms as standards evolve.

**Market, customers, and go-to-market.** QIZ is selling into a market that regulators and standards bodies have effectively created a deadline for. NIST finalized its first post-quantum encryption standards in August 2024; U.S. federal guidance deprecates classical public-key cryptography by 2030 and disallows it by 2035; and Executive Order 14412 (June 2026) requires federal agencies to migrate high-value systems to post-quantum cryptography by the end of 2030. Parallel obligations in Europe and finance — DORA, NIS2, and the Cyber Resilience Act — push large enterprises in the same direction. QIZ targets enterprises with large cryptographic estates, federal agencies and their contractors, and heavily regulated sectors including financial services, telecommunications, healthcare, and critical infrastructure. Its go-to-market leans on partnerships and marketplaces: the company has announced a crypto-agility collaboration with Google Cloud (with availability on Google Cloud Marketplace) and a partnership with SafeLogic for end-to-end PQC discovery and remediation, and it lists strategic relationships spanning major cloud, security, and advisory ecosystems. The company reports it is already working with some of the world's largest brands, though it has not publicly named individual customers.

**Traction, funding, and third-party validation.** QIZ emerged publicly in July 2026 with a $17 million seed round co-led by Bessemer Venture Partners and Merlin Ventures, with participation from Evolution Equity Partners, Qbeat Ventures, Singtel Innov8, and Qino Cyber Capital. The syndicate is a meaningful validation signal: Bessemer is backing founder Ben Volkow for the fourth time, Evolution and Merlin are specialist cybersecurity investors, and Singtel Innov8 brings a strategic telecom lens to a market where carriers face acute cryptographic migration burdens. Public company-profile data indicates a team in the 11-50 employee range. Beyond capital, the third-party validation comes from the timing thesis multiple sophisticated investors share — that cryptography is the "next unmanaged security surface," analogous to how cloud posture (CSPM) and application security posture management became categories once the underlying estate grew too complex to track manually.

**Founders and team background.** QIZ's founding team is unusually credentialed for a seed-stage company. CEO Ben Volkow is a serial founder whose prior companies include Otonomo, a connected-car data platform that went public in 2021, and Traffix Systems, acquired by F5 Networks — both Bessemer-backed. Co-founder and CTO Lenny Ridel previously co-founded Traffix with Volkow, giving the pair a long, proven working history in networking and enterprise infrastructure. The third co-founder, Dr. Itan Barmes, serving as chief strategy/security officer, built and led Deloitte's global quantum cyber readiness practice for roughly six years, advising many of the world's largest organizations on quantum-safe strategy — domain depth that is genuinely scarce in the post-quantum field. This combination of repeat enterprise-software operating experience plus deep subject-matter authority in quantum-safe migration is the team's central asset and the primary reason a crowded category entrant can command a large seed.

**Competitive dynamics.** Cryptographic posture and post-quantum readiness is an increasingly contested category. QIZ competes with (1) SandboxAQ, a well-funded Alphabet spinout with a cryptography-management and PQC product; (2) PQShield, which focuses on post-quantum cryptographic IP, libraries, and hardware; (3) QuSecure, which offers a post-quantum overlay and orchestration layer; (4) InfoSec Global (AgileSec) and Keyfactor, which come from cryptographic discovery and PKI/certificate lifecycle management respectively; and (5) incumbents such as IBM, Cisco, and DigiCert extending crypto-discovery into their platforms. QIZ's differentiation rests on: (i) a posture-management framing (Discover/Prioritize/Remediate/Govern) that mirrors the CSPM playbook enterprises already understand; (ii) a knowledge-graph, business-context prioritization engine intended to cut alert noise; (iii) an agentless, API-first deployment model; and (iv) founder credibility that accelerates enterprise trust and channel partnerships. The risk is that larger platform vendors bundle "good enough" crypto discovery, compressing standalone demand.

**Defense, security, and resilience dual-use relevance.** Post-quantum cryptographic migration sits squarely at the intersection of commercial cybersecurity and national-security resilience, which gives QIZ genuine — though adjacency-based rather than weapons-specific — dual-use relevance. The "harvest now, decrypt later" threat, in which adversaries capture encrypted traffic today to decrypt once cryptographically relevant quantum computers exist, is precisely why defense ministries, intelligence agencies, and critical-infrastructure operators are among the earliest movers on PQC. QIZ's mapping to CNSA 2.0 (the NSA's commercial national security algorithm suite) and to federal migration mandates positions its tooling for government and defense-contractor use, and its target verticals — telecom, energy, finance, healthcare — are exactly the critical-infrastructure sectors allied governments prioritize for cryptographic hardening. The calibrated caveat is that QIZ sells enterprise governance software, not a fielded defense capability; its strategic value is enabling resilient migration of the encryption underpinning both civilian and defense systems, not delivering a battlefield or offensive function.

**Growth stage, trajectory, and diligence risks.** QIZ is an early-stage company: seed funded, publicly launched in 2026, with a small team and an emerging category. Its trajectory depends on converting regulatory tailwinds and partnerships into named enterprise logos and recurring revenue before larger competitors and platform incumbents crowd the space. Key diligence risks include: (1) **category compression** — cloud and security platforms may absorb crypto discovery as a feature; (2) **long enterprise sales cycles** — PQC migration is board-level but budget timing is uneven and deadlines (2030/2035) are distant enough to permit procrastination; (3) **competition from better-capitalized rivals** such as SandboxAQ; (4) **execution/scaling risk** typical of seed-stage teams building a technical platform across heterogeneous environments; (5) **dependence on partnerships** (Google Cloud, SafeLogic) whose priorities may shift; and (6) **unverified traction** — customer claims are not yet publicly substantiated. Offsetting these is a rare combination of proven founders, specialist quantum-readiness expertise, a top-tier investor syndicate, and a market whose demand is being manufactured by regulation rather than left to discretionary adoption.