WISeKey and OISTE.ORG Expand Post-Quantum Root of Trust to Secure the Quantum and AI Era

WISeKey and OISTE.ORG Expand Post-Quantum Root of Trust to Secure the Quantum and AI Era

Quantum-safe Root of Trust designed to provide verifiable identities for AI models, agents, devices and humans, creating a cryptographic foundation for trusted AI

Geneva, Switzerland, September 25, 2026 -- WISeKey International Holding Ltd (“WISeKey”) (SIX: WIHN, NASDAQ: WKEY), a leading global cybersecurity, blockchain, and IoT company, in collaboration with the OISTE.ORG Foundation, announced the expansion of its Quantum Root Key initiative into a Post-Quantum Cryptography (“PQC”) Root of Trust architecture for AI systems, autonomous agents, connected devices and human operators.

The Quantum Root Key was originally generated to address one of the most significant cybersecurity challenges of the coming decade: the potential ability of sufficiently powerful quantum computers to compromise widely deployed public-key cryptographic systems.

However, the rapid development of increasingly autonomous AI systems introduces another fundamental challenge:

How do humans, machines and other AI systems know that an AI model or AI agent is authentic, authorized and operating with trusted software, data and instructions?

WISeKey and OISTE believe that the answer begins with a cryptographically verifiable Root of Trust.

From Root of Trust to Trusted AI

The same Public Key Infrastructure principles that have authenticated websites, devices and digital identities for decades can be extended to support machine-verifiable trust for AI.

Under this architecture, the OISTE/WISeKey Root of Trust can act as the cryptographic trust anchor from which identities and credentials may be issued to AI models, AI agents, devices, organizations and authorized human operators.

Rather than simply trusting an AI because it claims to be a particular model or agent, systems could cryptographically verify its identity and provenance.

This creates a potential chain of trust: Post-Quantum Root of Trust → Organization → AI Model → AI Agent → Device → Transaction

Each element can carry a cryptographically verifiable identity derived from the trusted root.

Securing AI Through Cryptographic Identity

The Root of Trust architecture can support several critical functions required for trusted AI.

• AI Model Identity. AI models can receive cryptographic identities allowing systems to verify which model they are communicating with and whether that identity was issued by an authorized organization.
• Model Integrity and Provenance. Cryptographic signatures and hashes can help verify that model binaries, weights, software components and approved configurations have not been modified since their authorized release.
• AI Agent Authentication. Autonomous agents can authenticate themselves before accessing systems, APIs, financial services, IoT infrastructure or other AI agents.
• Human-to-AI Authorization. Human operators can use trusted digital identities and certificates to establish who is authorized to instruct, modify, deploy or terminate an AI agent.
• AI-to-AI Trust. As autonomous agents increasingly transact with each other, cryptographic credentials can allow one agent to verify the identity and authorization of another before exchanging information or executing transactions.
• Signed AI Actions. High-impact AI actions could be digitally signed, creating evidence of which agent initiated an action, under which identity and authorization.
• Trusted Audit Trails. Signed events can be recorded in tamper-evident or immutable audit systems, creating traceability across the AI lifecycle.
  

This introduces an important principle for the AI economy: Every AI should have an identity. Every AI action should be attributable. Every critical AI interaction should be verifiable.

Post-Quantum Security at the Foundation

The Root of Trust uses Post-Quantum Cryptography designed to remain secure against both conventional and future quantum attacks.

The architecture incorporates NIST-standardized PQC algorithms including ML-DSA and ML-KEM, together with additional quantum-resistant cryptographic technologies as appropriate to each deployment.

These technologies can be integrated into WISeKey's trusted infrastructure and Post-Quantum PKI platform, anchoring cryptographic operations within tamper-resistant environments including Hardware Security Modules (HSMs), Trusted Platform Modules (TPMs) and secure semiconductor elements.

The objective is to ensure that the identity infrastructure securing tomorrow's AI systems does not depend on cryptography that could subsequently become vulnerable to quantum computing.

Hardware Root of Trust: From Cloud AI to the Edge

A critical component of the architecture is connecting digital trust to hardware. Through its subsidiary, SEALSQ Corp (NASDAQ: LAES) ("SEALSQ"), which focuses on developing and selling Semiconductors, PKI, and Post-Quantum technology hardware and software products, WISeKey's semiconductor technology ecosystem can extend the Root of Trust into secure elements, TPMs and post-quantum semiconductor architectures.

This enables an AI workload running on a server, robot, vehicle, industrial controller, satellite or IoT device to establish a cryptographically verifiable relationship between: hardware → firmware → operating environment → AI model → AI agent → authorized user

Such hardware-backed attestation can make it significantly harder for attackers to impersonate legitimate AI agents or silently replace authorized software and models.

A Trust Architecture for AI Supervising AI

The Root of Trust can also become an important component of WISeKey and OISTE's emerging HUMAN-AI-T framework.

As AI models become more powerful, one potential safety architecture is to use specialized AI systems to supervise the actions of other AI systems while preserving ultimate human governance.

Within this model, a supervisory AI would not merely monitor another model. Both systems would possess independently verifiable cryptographic identities.

The architecture could operate as: OISTE Post-Quantum Root of Trust →Trusted Human Governance → Authenticated AI Supervisor → Authenticated AI Models and Agents → Cryptographically Authorized Actions → Tamper-Evident Audit Trail → Human Escalation / Intervention

The Root of Trust therefore does not attempt to determine whether an AI is "good" or "bad." Instead, it provides something more fundamental: verifiable identity, integrity, authorization and accountability.

These mechanisms can complement model-level AI safety controls by providing a security layer underneath them.

From “Trust Me” AI to “Verify Me” AI

Today's AI ecosystem largely depends on organizational and platform trust. Users often cannot independently determine which model generated an output, whether the model was modified, what agent initiated an action, or whether an instruction came from an authorized source.

WISeKey and OISTE's approach is designed to move toward a “Verify Me” architecture.

An AI system could potentially present a cryptographically verifiable credential demonstrating:

• Who created me.
• Which organization authorized me.
• Which model and version I am running.
• Whether my software environment has been altered.
• What permissions I possess.
• Who authorized the action I am requesting.
• And whether my credentials remain valid.
  

This cryptographic trust layer could become increasingly important as billions of autonomous AI agents begin communicating, negotiating and transacting across digital networks.

Protecting Critical Infrastructure

The combined PQC and AI Root of Trust architecture is particularly relevant for sectors where autonomous AI decisions could have physical, financial or national-security consequences, including financial services, healthcare, telecommunications, defense, energy, industrial systems, satellites, smart cities, connected vehicles and IoT infrastructure.

Post-Quantum certificates issued through the platform maintain concepts familiar to conventional PKI, including Root and Intermediate Certificate Authorities, defined Key Usages, Certificate Revocation Lists and certificate status mechanisms, while incorporating quantum-resistant cryptographic algorithms.

Building the Trust Layer for the Intelligent Internet

Carlos Moreira, Founder and CEO of WISeKey, stated: “AI is rapidly moving from generating information to taking autonomous actions. In that environment, identity becomes fundamental. Before an AI agent can access infrastructure, communicate with another AI or execute a transaction, we need to know cryptographically who that agent is, who authorized it and whether it has been modified. Our Post-Quantum Root of Trust creates the foundation for this new trust architecture. The objective is simple: AI should not have to be blindly trusted. AI should be cryptographically verifiable. By combining OISTE's global Root of Trust, WISeKey's PKI infrastructure and SEALSQ's secure semiconductor technologies, we believe we can extend digital trust from humans and connected devices to AI models and autonomous agents.”

The convergence of Artificial Intelligence and Quantum Computing represents both an extraordinary technological opportunity and a fundamental cybersecurity challenge.

WISeKey and OISTE believe that the infrastructure protecting this new digital environment must therefore evolve from simply securing communications to establishing identity, provenance, authorization and accountability across humans, machines and AI.

The objective is to create a global trust layer capable of supporting the next generation of the Internet:

• Humans trusting AI.
• AI trusting humans.
• AI trusting AI.
• All anchored in a Post-Quantum Root of Trust.

About WISeKey

WISeKey International Holding Ltd (“WISeKey”, SIX: WIHN; Nasdaq: WKEY) is a global leader in cybersecurity, digital identity, and IoT solutions platform. It operates as a Swiss-based holding company through several operational subsidiaries, each dedicated to specific aspects of its technology portfolio. The subsidiaries include (i) SEALSQ Corp (Nasdaq: LAES), which focuses on semiconductors, PKI, and post-quantum technology products, (ii) WISeKey SA, which specializes in RoT and PKI solutions for secure authentication and identification in IoT, blockchain, and AI, (iii) WISeSat AG which focuses on space technology for secure satellite communication, specifically for IoT applications, (iv) WISe.ART Corp which focuses on trusted blockchain NFTs and operates the WISe.ART marketplace for secure NFT transactions, and (v) SEALCOIN AG which focuses on decentralized physical internet with DePIN technology and houses the development of the SEALCOIN platform.

Each subsidiary contributes to WISeKey’s mission of securing the internet while focusing on their respective areas of research and expertise. Their technologies seamlessly integrate into the comprehensive WISeKey platform. WISeKey secures digital identity ecosystems for individuals and objects using blockchain, AI, and IoT technologies. With over 1.6 billion microchips deployed across various IoT sectors, WISeKey plays a vital role in securing the Internet of Everything. Trusted by the OISTE/WISeKey cryptographic Root of Trust, WISeKey provides secure authentication and identification for IoT, blockchain, and AI applications. The WISeKey Root of Trust ensures the integrity of online transactions between objects and people. For more information on WISeKey’s strategic direction and its subsidiary companies, please visit www.wisekey.com.

Forward-Looking Statements

This communication contains forward-looking statements concerning WISeKey International Holding Ltd and/or its subsidiaries (collectively, “WISeKey,” “our” or “us”) and its businesses. Forward-looking statements can be identified by terms such as “anticipate,” “believe,” “estimate,” “expect,” “intend,” “may,” “plan,” “project,” “will,” and similar expressions. These statements involve known and unknown risks, uncertainties and other factors that could cause WISeKey’s actual results, financial condition, performance or achievements to differ materially from any future results, performance or achievements expressed or implied by such forward-looking statements. These factors include: our ability to convert our pipeline into actual sales; the ability to realize WISeKey’s anticipated growth strategies and profitability; the development of post-quantum cryptography products and the potential market for such products; WISeKey’s plans for global customer base expansion; the expansion of the WISeSat project and the QSOC initiative; the timing and expected revenues from the commercial deployment of the QS7001 quantum-resistant semiconductor; the sufficiency of cash to meet liquidity needs; WISeKey’s ability to attract and retain customers; changes in economic conditions; market demand and semiconductor industry conditions; and the risks discussed in WISeKey’s filings with the SEC. WISeKey is providing this communication as of this date and does not undertake to update any forward-looking statements as a result of new information, future events or otherwise.

Statements regarding our business pipeline are based on management's current estimates of potential revenue opportunities and do not represent backlog or contracted revenue. Pipeline conversion is subject to numerous factors including customer validation, technical integration requirements, certification timelines, and market conditions. There can be no assurance that pipeline opportunities will convert to actual sales or that such conversion will occur within anticipated timeframes.

This press release does not constitute an offer to sell, or a solicitation of an offer to buy, any securities, and it does not constitute an offering prospectus within the meaning of the Swiss Financial Services Act (“FinSA”), the FinSA’s predecessor legislation or advertising within the meaning of the FinSA. Investors must rely on their own evaluation of WISeKey and its securities, including the merits and risks involved. Nothing contained herein is, or shall be relied on as, a promise or representation as to the future performance of WISeKey. Given the risks and uncertainties described herein, you should not place undue reliance on forward-looking statements as a prediction of actual results.

Press and Investor Contacts

WISeKey International Holding Ltd Company Contact: Carlos Moreira Chairman & CEO Tel: +41 22 594 3000 info@wisekey.com

WISeKey Investor Relations (US)  The Equity Group Inc. Lena Cati Tel: +1 212 836-9611 lena.cati@theequitygroup.com