Xerox’s move into PQC-enabled A4 devices may help it differentiate in a segment where purchasing decisions have traditionally centred on cost, usability and serviceability. It also gives Xerox a way to connect device refresh with a broader security planning cycle.
Xerox’s first A4 colour printers and MFPs launched under its unified brand following the Lexmark integration mark more than a portfolio update. The Xerox C240/C245, C255a and C300/C303a/C305ae portfolio signal how the company may be seeking to strengthen its position in the small workgroup market by combining a broader channel reach with embedded security capabilities that are increasingly relevant to hybrid and distributed workplaces.
The launch addresses familiar small workgroup priorities: compact design, simplified deployment, intuitive user experience and support for device management and print/scan apps. However, the more strategically significant development is the inclusion of post-quantum cryptography (PQC) support as part of the devices’ built-in security proposition.
While quantum risk is not an immediate operational crisis for most organisations, it is becoming a board-level security consideration and there is growing regulatory focus on ensuring a robust transition to the quantum era. Print devices, which routinely handle sensitive documents, user credentials and network communications, must be included in longer-term post-quantum cryptographic planning.
What post-quantum cryptography means for print
Post-quantum cryptography refers to cryptographic algorithms designed to remain secure against future quantum computers that could break many of today’s widely used public-key methods, such as RSA and elliptic-curve cryptography. It does not require a quantum computer to operate; it runs on conventional systems and is intended to protect digital trust mechanisms before quantum-enabled attacks become practical.
For print environments, the issue is practical rather than theoretical. Printers and MFPs authenticate users and services, connect to cloud platforms, process scan and print jobs, establish secure network sessions and receive firmware updates. These activities rely on cryptography to protect device identity, data in transit and software integrity.
The most immediate concern is the “harvest now, decrypt later” scenario, where encrypted traffic is captured today and decrypted in the future when quantum capability is available. This is most relevant where information has a long sensitivity life, such as legal records, healthcare data, financial information, intellectual property or government documents.
PQC is therefore best understood as a migration and crypto-agility issue, not a single product feature that eliminates quantum risk. As NIST explains, crypto-agility is about changing cryptographic algorithms without interrupting the flow of a running system, which is exactly why it is foundational to long-term resilience in the PQC era.
It helps organisations transition vulnerable public-key mechanisms to quantum-resistant alternatives while maintaining compatibility with existing infrastructure. The significance for print OEMs is that it positions quantum-safe protections as part of the mainstream device conversation, rather than as a specialised capability reserved for high-end or highly regulated environments.
PQC is most relevant to the public-key operations that establish trust: secure communications, certificate-based authentication, firmware signing and verification, and software update integrity. These controls are central to preventing device compromise and maintaining trust in connected print infrastructure.
Why quantum readiness matters now
In Quocirca’s Print Security 2025 study, a significant majority of organisations (66%) stated that the development and adoption of quantum-resistant print devices would be either extremely (32%) or very (34%) relevant to their organisation’s security strategy.
This indicates a broad recognition of the long-term importance of future-proofing print infrastructure against quantum threats, even if the immediate threat is perceived as distant.
The high perceived relevance of quantum-resistant print devices points to a market that is beginning to connect print security with longer-term cyber resilience. This creates an opportunity for OEMs to move beyond reactive security messaging and articulate a clearer roadmap for crypto-agility, firmware assurance and device trust. The market leaders will be those that make quantum readiness understandable, and practical for customers and channel partners.
Although practical quantum attacks against enterprise print infrastructure are not imminent, the long lifecycle of print devices means decisions made today will shape security posture for years. As customers assess refresh cycles, firmware assurance and future compliance requirements, vendors that embed quantum-resistant capabilities into mainstream devices will be better positioned as standards, regulation and customer expectations mature.
Xerox: advancing secure-by-design print
The Xerox launch is significant because it brings PQC capabilities into its A4 small workgroup segment, rather than reserving them for enterprise-class devices. This is a commercially important market as organisations continue to support distributed teams, branch offices and smaller shared workspaces where dedicated IT support may be limited. In these environments, security that is built in and simple to manage becomes a more meaningful differentiator.
The Lexmark integration gives Xerox a stronger platform from which to accelerate secure-by-design print. Lexmark has long emphasised embedded device security, firmware integrity and secure remote management. By bringing these capabilities into the Xerox-branded portfolio, Xerox can potentially shorten its route to market for advanced security features while presenting customers and partners with a broader, more unified proposition.
Strategically, Xerox states that its goal is to provide security in a post-quantum era where traditional public-key cryptosystems such as RSA and ECC become vulnerable. It emphasises the importance of maintaining backward device compatibility and standardising the approach on both hardware and firmware controller-assisted protection, stating that future platforms will provide enhanced PQC.
The new Xerox devices include hardware-enabled NIST-standard PQC for secure boot and general cryptographic operations. These are enabled by default, needing no customer or partner intervention. Existing devices are also benefiting from firmware updates that enable PQC for general cryptographic operations, including support for secure communication protocols like HTTPS, LDAPS, and SMTPS on select devices. Future product hardware enhancements will further strengthen PQC capabilities, ensuring long-term resilience and performance.
Implications for customers and channel partners
For customers, the practical benefit is that PQC support can be introduced as part of normal device refresh cycles. This is particularly important for small and mid-sized organisations that may lack specialist expertise but still need devices that can align with evolving standards over a typical print hardware lifecycle.
For channel partners, the launch creates an opportunity to move security conversations beyond access control, authentication and secure release printing. Quantum readiness, crypto-agility and firmware integrity can become part of broader print security assessments, particularly in regulated sectors and organisations with long-retention data. This could support higher-value advisory-led conversations and help partners position Xerox devices as part of a wider cyber-resilience strategy. Xerox’s entry gives channel partners another portfolio around which to frame quantum-readiness conversations, particularly as customers begin comparing vendor roadmaps and lifecycle commitments.
The competitive context also matters. HP was first to market with quantum-resistant products. In April 2025, HP launched its 5000 and 6000 series A4 Enterprise Transactional, 500-600 series A4 Enterprise Managed, 700 and 800-series Enterprise Managed devices in addition to 8000-series Enterprise Transactional devices. HP also introduced its 8000-series Enterprise devices in March 2025 and followed up with the SMB-focused Pro 4000/4100-series and its A4 500-series and 600-series Enterprise printers/MFPs in March 2026.
Quocirca Opinion
Print vendors must demonstrate a credible roadmap for securing devices against both current and emerging threats. demonstrate strong breadth and depth in multi-layered security features that protect customers at device, user, network and application levels. Quantum resistance will form an increasingly high-profile feature of vendor offerings as regulatory focus grows ahead of the quantum era. Initial customer interest will be strongest at enterprise level in regulated sectors but will cascade to SMBs as the security standards required of smaller third-party suppliers continue to rise.
Xerox’s first unified A4 devices show how post-quantum security can begin to move from specialist discussion to mainstream endpoint protection. The market opportunity for Xerox lies in making this capability visible, repeatable and easy to adopt across the customer base.
To an extent, Xerox’s strategy also addresses the important issue of securing devices already in the field. Existing Lexmark devices (extending back to 2018) can receive firmware upgrades offering limited PQC capabilities.
While quantum-era readiness is beginning to move into the broader workplace print market., to date, few OEMs have publicly set out detailed PQC roadmaps. Customer and regulatory pressure are likely to make crypto-agility and quantum-resistant device trust more prominent in future vendor security strategies. However, to date, HP and Xerox are the only vendors to publicly announce products and strategy.
As print security planning becomes more future-facing, PQC is likely to become a key proof point for vendor credibility and long-term device trust.
