Skip to content
Get in touch
Quantum-safe encryption for data in transit at unmatched speed

NQX network encryptor complements firewalls and VPNs 

Firewalls control policies. VPNs provide connectivity. Neither was designed to keep a high-bandwidth site-to-site link confidential against an adversary who records it today and decrypts it after quantum computers arrive. NQX network encryptor is.
Schedule a demo
SSH_Leonardo_strategic_partnership

Let your firewall and VPN do what they do best

Select a layer to see what it owns and where it stops.
Where NQX fits alongside firewalls and VPNs Two sites connected across an untrusted wide area network. Firewalls sit at each perimeter, a VPN gateway serves remote users, a site-to-site IPsec tunnel is the traditional way to link the two sites, and NQX encryptors protect the site-to-site link at wire speed with quantum-safe keys. Perimeter control at each site Remote access: users and small branches reach the network Site-to-site IPsec tunnel between the two gateways Quantum-safe encrypted link, Layer 2 or Layer 3 Site A Data center Firewall + VPN gateway NQX Encryptor Untrusted WAN Carrier fibre, internet NQX Encryptor Firewall + VPN gateway Site B Branch / OT site Why tunnels struggle at scale • Hard to configure: IKE policies, SAs and routing for every site pair • CPU-bound: slows down as links reach 10–100 Gbps • Classical key exchange unless PQC is enabled Built for the link • Set up from one console with wizards and predefined node configurations • Wire speed up to 100 Gbps in hardware • Hybrid quantum-safe key exchange built in IPsec tunnel over the internet Remote user VPN client over any internet connection

Firewall, VPN and NQX side by side

The same network, different jobs. Both VPN options run on the firewall; NQX is a separate layer that takes the link off its hands, so each can concentrate on what it does best.

Swipe the table sideways to compare all four.

  Firewall VPN gateway (on Firewall) VPN tunnel (on Firewall) NQX
Primary role Access and policy control Remote access and secure connection as an additional feature Site-to-site connectivity Confidentiality of the link
Question it answers Who may talk to whom, and what may they send? How do remote users and small branches reach the network? How do two sites connect over a network neither controls? Can anyone read what crosses the link, today or in ten years?
Where it sits At each site perimeter On the perimeter firewall, with clients on endpoints On the firewall at each site, one tunnel per site pair Between the site network and the untrusted WAN
Network layer Layer 3 to Layer 7 policy and inspection Layer 3 (IP) tunnels Layer 3 (IP) tunnels Layer 2 (Ethernet) and Layer 3 (IP)
Encrypts traffic in transit NoNot its job; some designs terminate TLS in order to inspect YesIPsec or TLS, in software on the firewall's CPUs YesIPsec on the firewall's CPUs, sharing capacity with inspection YesAES-256 in dedicated encryptor hardware
Key exchange Not applicable IKEv2 with RSA, DH or ECDHPost-quantum options are emerging but must be deployed deliberately IKEv2 with RSA, DH or ECDHPost-quantum options are emerging but must be deployed deliberately Hybrid: a classical algorithm combined with ML-KEM or FrodoKEM
Survives harvest now, decrypt later No Not by default Not by default Yes
Throughput Varies; deep inspection is the usual bottleneck CPU-bound; sized for many modest user connections CPU-boundEncryption competes with inspection on the same box, plus encapsulation overhead and MTU or fragmentation issues Up to 100 Gbps on the NQX 5200; over 15 Gbps on the NQX 1170 for branches
Configuration at scale Rule sets maintained per site User profiles, authentication and client rollout ComplexIKE policies, security associations and routing for every site pair, growing with each site added SimpleCentral console, deployment wizards and predefined node configurations; keys generated and rotated automatically
Covers non-IP and Layer 2 traffic No No NoTraffic that never enters an IP tunnel is not protected Yes
Crypto-agile Not applicable Typically externalized and provided via pre-shared keys or requiring Quantum Key Distribution integration Depends on vendor and standards support YesAlgorithms updated in software as standards move; keys stay in your own hands
Exposed attack surface LargeInternet-facing management and portals, plus complex Layer 3 to Layer 7 parsers handling untrusted traffic LargeInternet-facing login portal, end-user authentication and client software on every endpoint LargeInternet-facing IKE and IPsec services on the same box as the firewall's management and policy SmallOne job: encrypt the link. No end-user logins, no remote-access portal, no inspection of the traffic it carries
Best fit Perimeter defence, segmentation, keeping IT and OT apart Roaming users and small branches A few lower-bandwidth site links where one box is simpler than two Data centre interconnect, high-bandwidth site-to-site links, rugged OT and mobile sites

Each layer does what it does best

NQX does not take over policy, inspection or segmentation, and it does not replace the remote-access client on a laptop. It offloads a CPU-intensive secondary feature (network encryption) to a purpose-built device.

 

Firewall

Free to focus on policy and inspection

No longer carrying bulk encryption on high-bandwidth links it was never sized for, so inspection capacity goes where it matters: segmentation, threat prevention and keeping IT and OT apart.

 

VPN gateway

Free to focus on people and small sites

Serving roaming users and modest branches, instead of being stretched to run data centre interconnects through CPU-bound IPsec tunnels.

NQX

Owns confidentiality of the link

Everything crossing the untrusted network stays unreadable at wire speed, including traffic no application encrypts and the recording an adversary makes today hoping to break it later.

Network encryptor is a smaller target, now that AI is hunting for flaws

Firewalls and VPN gateways face the internet, authenticate strangers and parse untrusted traffic in large, feature-rich code. That makes them the first thing attackers probe, and AI is making the probing faster.

Edge devices have become the favourite way in. Verizon's 2025 Data Breach Investigations Report found that edge devices and VPNs were the target in 22% of vulnerability exploitation, up from 3% a year earlier, and that only about half of those flaws were fully fixed within the year.

AI is widening the gap between disclosure and exploitation. Google Threat Intelligence Group counted more exploited vulnerabilities in the first eight months of 2026 than in all of 2025, and says attackers appear to be using AI to analyse patches and build exploits. Earlier this year AWS described an AI-assisted actor who got into more than 600 FortiGate firewalls in 55 countries in five weeks, through exposed management interfaces and weak credentials rather than any new zero-day.

Every feature a device exposes is code that an AI model can probe. NQX is deliberately narrow: it encrypts the link and does nothing else. There is no user login portal to brute-force, no client software to exploit and no deep-inspection engine parsing hostile input. Adding NQX does not add another feature-rich box to the perimeter. It moves the most sensitive job, keeping the link confidential, off the devices attackers target most, and keeps the keys that protect the WAN off them too.

22%of vulnerability exploitation targeted edge devices and VPNs, up from 3%Verizon DBIR 2025
141vulnerabilities exploited in Jan to Aug 2026, more than the 127 in all of 2025Google Threat Intelligence Group
600+FortiGate firewalls accessed in five weeks by an AI-assisted actorAWS Security, 2026

Sources: Verizon DBIR via SecurityWeek · GTIG via Help Net Security · AWS report via Hadrian

Learn more about NQX™ encryption
Securing terrestrial satellite data

Securing terrestrial satellite data

Read the case study
NQX Datasheet

NQX Datasheet

Get the datasheet
Quantum-Safe Journey: How to Migrate to Post- Quantum Cryptography (PQC)

Quantum-Safe Journey: How to Migrate to Post- Quantum Cryptography (PQC)

Get the guide
Verne Secures High-Bandwidth Data Center Connections for Managed Customers with Post-Quantum Cryptography (PQC)

Verne Secures High-Bandwidth Data Center Connections for Managed Customers with Post-Quantum Cryptography (PQC)

Read the case study
Explore NQX resources

Make your data in transit quantum-safe today.
Talk to a security expert