India cannot build its digital economy on ‘borrowed trust’: QNu Labs CEO Sunil Gupta

India “cannot depend on borrowed trust”, especially on foreign cryptographic technologies as it expands its digital economy, according to quantum cybersecurity startup QNu Labs co-founder and CEO Sunil Gupta, who sees the transition to quantum-safe security as an opportunity to build a sovereign digital trust layer.

“Whether it is a Hardware Security Module or technology used in the financial, healthcare and government sectors, most of it comes from outside India,” Gupta told ET AI.

He cited the Centre’s adoption of Indian software service provider Zoho for government email and office productivity tools as an indication that India has started taking digital sovereignty more seriously.


The government has required Zoho to keep primary and disaster-recovery data centres in India and prohibited overseas sharing or replication of government data, according to the Ministry of Electronics and Information Technology.

Also Read: IT Minister Ashwini Vaishnaw switches to Zoho's office suite in Swadeshi move

“Since Independence, India has never taken a call to replace a well-entrenched foreign technology with Indian technology,” he said. “What happened with Zoho is interesting because it is a precursor to what will happen with quantum technology.”

Gupta, however, argued that India should extend the same principle to the technologies that generate, distribute and manage encryption keys.

“India may have become politically independent in 1947, but we remain digitally dependent on, and, I would say, digital slaves to, foreign countries,” he said.

According to him, India now possesses indigenous capabilities across all three areas but needs regulatory mandates and early adopters to take them into mainstream use.

"Every aspect of encryption has to change. Sovereignty is not about selecting a few areas; it is about achieving total independence," he said.

Banks begin mapping their exposure

India’s quantum-security push has started moving from policy discussions to institutional planning. India approved the Rs 6,003.65 crore National Quantum Mission in 2023, covering the period through 2030-31.

Also Read: Centre greenlights Rs 6,000 crore National Quantum Mission

A Department of Science and Technology (DST) task force subsequently recommended that critical information infrastructure establish its quantum-security foundations by 2027, migrate high-priority systems by 2028 and complete post-quantum cryptography adoption by 2029. It specifically identified banking and finance among the sectors that should launch pilots.

The Reserve Bank of India (RBI) followed in May by setting up its Quantum Secure and Adaptive Financial Ecosystem (Q-SAFE) committee to assess the sector’s cryptographic inventory, identify vulnerable systems, evaluate vendor readiness and recommend a quantum-security roadmap.

“At least the top 10 banks in India are engaged at different stages, including assessment, assurance, implementation and pilots,” Gupta said. “They are not prepared yet, but there is certainly action.”

He expects 2026 and the first half of 2027 to focus largely on assessments, followed by phased implementation between the second half of 2027 and 2030. Gupta also expects the RBI, Securities and Exchange Board of India (SEBI) and Insurance Regulatory and Development Authority of India (IRDAI) to introduce mandates.

QNu Labs co-founder Anil Prabhakar, who remains a technical adviser to the company, serves as the convener of the RBI committee. Asked whether a vendor was helping write rules for its own market, Gupta said category leaders had a responsibility to train regulators, develop standards and create testing infrastructure.

“Anil Prabhakar does not participate in any of QNu Labs’ active business operations,” he said.

“We are building an ecosystem; it means that I have to evangelise the technology, train regulators and users, help write specifications, build testing laboratories and test beds, develop the technology, train people and educate university students. Only then will the country move forward,” he added.

Gupta expects that by 2028, about a quarter of Indian banks will have completed roughly half their migration. By 2030, he expects about three-quarters of banks to have reached that halfway point.

‘Know your encryption’

Banks should first identify where they use cryptography across applications, networks, hardware, authentication systems and third-party services, Gupta said.

“The second step is to conduct a risk assessment and plan accordingly. The third step is migration based on that risk assessment,” he added.

Gupta said banks migrate vulnerable software to post-quantum cryptography (PQC), while hardware security modules might need replacement. Quantum key distribution (QKD), he added, could be reserved for highly sensitive links.

Gupta compared the two technologies to successive Covid vaccinations.

“PQC is the first dose. It is software-based, easier to implement, less costly and less complex,” he said. “QKD is the second dose. Institutions should consider it for more sensitive use cases.”

From quantum risk to AI-enabled attacks

Gupta also sees AI-enabled cyberattacks as an additional reason for banks to accelerate the transition. He also argued that AI systems such as Anthropic’s Mythos had shortened the time available to find and fix vulnerabilities.

“A quantum computer would have to break an encryption key, but Mythos could steal the key. It does not necessarily have to break the encryption itself,” he added.

Also Read: Explained | Why Anthropic’s Mythos is spooking bankers and what it means for global finance

Anthropic said Mythos could identify and exploit unknown vulnerabilities in controlled evaluations. However, cybersecurity experts told Reuters that concerns about its immediate impact have been overstated.

Gupta nevertheless wants regulators to mandate migration rather than leave it to individual institutions.

“It is like asking whether you want a Covid vaccine or just a vaccination certificate,” he said. “The transition is serious and it has to be mandated.”

Export controls and the China question

Gupta also placed quantum security within a wider geopolitical contest over strategic technology.

“You will soon see countries imposing restrictions on the import and export of these technologies,” he said.

Governments have already started controlling parts of the wider quantum stack. The US introduced worldwide export controls in 2024 for specified quantum computers, components, materials, software and related technology, while the European Commission added quantum-related items to a similar control list in 2025.

He also said he “would not be surprised if the US or China already had a quantum computer and chose not to disclose it”.

“The Americans (Allied Forces) broke Enigma during the Second World War but did not let the Germans know until the war was over because they would have lost their advantage… A quantum computer is a ‘brahmastra’. It is an enormously powerful capability. Why would a country surrender that advantage by announcing it?” he noted.

NIST, however, says cryptographically relevant quantum computers do not yet exist publicly and that expert estimates for their arrival range from a few years to several decades.

“I would not spend my time or energy trying to guess whether somebody already has a quantum computer or when one will arrive. My job is to prepare for that possibility,” he said.