As Canada reconsiders its reliance on a longtime ally, an Ottawa cybersecurity company says it has quietly built one of the country's few sovereign advantages in a domain that will define the next generation of defence: the ones and zeros.

Crypto4A Technologies announced August 20 that its QASM cryptographic module had achieved FIPS 140-3 Level 3 validation, the first hardware security module in the world to earn that rating while supporting the full suite of post-quantum cryptography algorithms approved by the U.S. National Institute of Standards and Technology. 

For a company built to defend digital infrastructure against quantum computers, the certification is the equivalent of a new aircraft clearing flight testing and being declared combat-ready.

DigiCert, the digital trust company, has already moved to build on that validation, integrating the certified module into its DigiCert ONE platform to secure digital signing, certificate issuance and automated public key infrastructure against harvest-now, decrypt-later threats. DigiCert CEO Amit Sinha said the certification gives organizations confidence that their trust anchors are built on rigor, resilience, and verifiable security.

For Bruno Couillard, Crypto4A's CEO and co-founder, the timing of the milestone is not incidental.

"We're being smacked hard by a nation that we've been friends with forever, and now that nation is saying we're shifting gears, we're going somewhere else," Couillard said in an interview. "It puts Canada into a zone of, okay, we now have to start becoming less dependent on that friendly nation we've depended on for ages."

Couillard argues that reckoning exposes a gap in what Canada can build itself. The country cannot produce its own fighter jets or submarines, he said, and has to partner internationally to field them. But in cryptography, the discipline of protecting digital information, he believes Canada already leads.

"When you think of cyberspace, it is as important to a nation's sovereignty as any of its land and its seas and its airspace," he said. "You don't put tanks to guard ones and zeros, but you put cryptography, and you'd better know how to do it." 

He compared Crypto4A's technology to an F-35 for the digital domain: a capability few nations can build from scratch, and one Canada happens to already have in its own backyard.

Crypto4A builds hardware security modules, physical devices that generate and guard the cryptographic keys used to lock digital information. Couillard likens the role to a bank vault: the vault itself matters less to customers than the guarantee that whatever is placed inside will stay secure.

A sufficiently powerful quantum computer, he said, is the equivalent of a new weapon capable of instantly cracking that vault open, a scenario known in the industry as "harvest now, decrypt later," where adversaries collect encrypted data today in the expectation they will be able to unlock it once quantum computing matures.

Roughly half the global economy now runs on digital infrastructure, Couillard said, which is why replacing the cryptographic foundations underneath it, rather than trying to protect data "one by one," has become urgent regardless of exactly when a cryptographically relevant quantum computer arrives.

On that timeline, Couillard declines to guess. He pointed to the Second World War codebreaking effort against the German Enigma machine: Allied cryptographers broke the code in 1941, he said, but the achievement wasn't publicly acknowledged until 1974, decades after it had stopped mattering militarily. His point is that a capability powerful enough to matter is also one its owner has every incentive to hide.

"If history is at all a predictor, we might already be past that point and not know it," he said.

The company's roots trace to Chrysalis-ITS, an Ottawa cryptography firm Couillard co-founded and led as chief technology officer in the 1990s. 

Its technology was eventually sold and now underpins a product sold by Thales, the French defence and aerospace giant, putting Crypto4A in the position of competing with a design Couillard helped create three decades ago. 

He argues the newer architecture, built without the constraints of 1990s-era internet infrastructure, gives Crypto4A an edge over competitors still working from that older generation of technology.

Crypto4A has grown to nearly 50 employees, most of them engineers, with customers in the United States, Japan, South Korea and the Canadian government, and deployments expected in the United Kingdom and Europe within weeks. 

Couillard said future hiring will shift toward sales and delivery as the company moves from proving its technology works to fielding it at scale, a transition he compares to a pharmaceutical company moving from clinical trials into mass production.

Whether Canada leans further into that kind of homegrown capability, as the country reassesses its dependence on traditional allies, is a question Couillard is happy to let the geopolitics answer for him.

"I think Canada has, in its own backyard in Ottawa, one seed to be a champion not just for Canada but for all middle power nations," he said.