QuantumGate–NEC: planning a UAE post-quantum migration

QuantumGate's new collaboration with NEC GCC gives UAE infrastructure operators another route into post-quantum cryptography. The useful part of the announcement is the proposed delivery chain: discover the cryptography already in use, plan the migration, then integrate replacements into operating systems.

QuantumGate's 5 October announcement says NEC GCC will lead deployment and integration for a collaboration targeting UAE critical infrastructure and telecommunications. It describes phased, multi-year migration programmes. It does not report a completed customer migration, measured performance or a delivery deadline.

For a CTO considering an assessment, that distinction should shape the purchase. Commission a map of dependencies and a bounded interoperability test before committing to an estate-wide replacement programme.

Cover: original SultanByte artwork showing cryptographic discovery, a controlled pilot and staged deployment.

What the agreement adds

QuantumGate is an Abu Dhabi company under VentureOne, the Advanced Technology Research Council's venture builder. Its announcement combines post-quantum work with passwordless authentication, secure access and enterprise mobility. Those are related security activities, but buying the bundle should not make their acceptance criteria interchangeable.

A successful authentication demonstration does not establish that firmware signatures, application connections and recovery systems have all migrated. Ask which component changes, which cryptographic function it performs and which dependencies remain outside the contract.

Intelligent Tech Channels' report carries the same scope and partner statements. It provides another record of the announcement, not independent evidence of customer outcomes.

The geographic scope also needs precision. NEC's GCC name does not turn this UAE announcement into a GCC-wide deployment. A Saudi or Qatari operator evaluating the suppliers should establish its own service scope and approval requirements rather than importing a UAE project description.

Separate key establishment from signatures

Post-quantum cryptography is software and mathematics intended to withstand attacks by sufficiently capable quantum computers. The procurement task is to replace vulnerable cryptographic dependencies without breaking the services that use them.

NIST's August 2024 standards announcement identifies different functions: ML-KEM in FIPS 203 is a key-encapsulation mechanism; ML-DSA in FIPS 204 and SLH-DSA in FIPS 205 are digital-signature algorithms. These names are not interchangeable product certifications.

A proposal should therefore identify the algorithm and protocol configuration for each use case. Establishing a connection's shared secret and verifying a software update are different jobs. Evidence for one cannot stand in for the other.

Ask the supplier to describe the exact implementation and supported versions, not simply claim that the product uses a NIST algorithm. Have the security team review what the claimed assurance covers and what remains dependent on configuration or other components.

Buy an inventory that explains dependencies

The joint CISA, NSA and NIST migration guidance calls for a quantum-readiness roadmap, a cryptographic inventory and engagement with technology suppliers. That guidance predates the final standards, but its preparation work remains a useful starting point.

For the proposed UAE assessment, require more than a spreadsheet of certificates. A practical deliverable would connect each service to its cryptographic dependencies, responsible owner, software or device version, data-protection lifetime and available upgrade path. Record unknowns explicitly.

Start with a service that people can trace: for example, a hypothetical remote-maintenance connection into an industrial site. Map the administrator's device, identity checks, access gateway and destination. Then inspect the separate path used to verify updates. A network scan alone should not be accepted as proof that every embedded dependency has been found.

The resulting inventory should answer operational questions. Which component cannot be upgraded? Which supplier has no supported replacement? Which change needs both ends of a connection to move together? Tie payment for discovery to coverage evidence and a reviewed exception list rather than the number of assets a tool happens to return.

Original infographic: SultanByte. Proposed buyer framework informed by NIST's migration project, NCSC guidance and CISA's October 2024 OT report; announcement context: QuantumGate, 5 October 2026. The gates are recommendations, not measured results.

Industrial systems need their own migration plan

CISA's October 2024 operational-technology report describes a different problem from updating ordinary office software. OT may depend on public-key cryptography for remote access, device authentication, software verification and sensitive communications. Long replacement cycles and safety testing can restrict changes.

The report also warns that cryptographic processing overhead can exceed some hardware's capacity, while protocol and application changes can affect interoperability. It recommends planning, segmentation and crypto-agility alongside appropriate algorithm updates.

For a UAE utility or telecom operator, the implication is to commission an OT-specific dependency review. Do not assume that upgrading an access gateway changes the trust mechanism inside every device behind it. Identify what the gateway protects, what remains vulnerable and who accepts any temporary exception.

Treat the maintenance window and safety sign-off as part of the migration design. Security improvements should not arrive through an unreviewed change to a live operational process.

Make the pilot prove compatibility

NIST's National Cybersecurity Center of Excellence migration project separates cryptographic discovery from interoperability testing. Its testing work seeks to identify and resolve compatibility problems in a controlled, non-production environment.

Use that separation in the statement of work. Discovery produces the candidate scope; a pilot then exercises the exact supported versions and configurations intended for deployment.

For a proposed secure-access pilot, require recorded results for normal connections, unsupported clients, expired credentials and interrupted upgrades. Measure connection establishment and resource use under an agreed workload. Inspect the negotiated protection rather than relying on a green status indicator.

Define fallback deliberately. A service that silently drops to an unapproved configuration may remain available while failing the security objective. Conversely, a strict policy can strand an operational team if recovery access was never rehearsed. Document both behaviours, the permitted recovery route and the person authorised to stop the rollout.

These are suggested acceptance tests, not reported results from the QuantumGate–NEC collaboration.

Use foreign timelines as planning references

The UK's NCSC migration guidance sets targets for discovery and initial planning by 2028, highest-priority migration work by 2031, and completion by 2035. Its intended context is UK industry, government and regulators. Those dates are not UAE statutory deadlines.

They illustrate the length of the planning problem without predicting when a cryptographically relevant quantum computer will arrive. A regional operator should set its schedule from its own exposure, replacement cycles and applicable requirements.

The immediate buying decision can be narrower. Ask QuantumGate and NEC GCC for a defined assessment scope, named integration responsibilities and a pilot whose failures are observable. Require the findings to remain usable by the operator, including unresolved dependencies and supplier-specific constraints.

Approve broader deployment only when that pilot establishes compatibility, acceptable operating behaviour and a workable recovery procedure for the chosen service. The collaboration offers a delivery route; the operator still needs evidence for each system it changes.