Automated mobile application security testing specialist NowSecure has published benchmark threat intelligence assessing the post-quantum readiness of the global mobile software ecosystem. Evaluating 136,711 unique iOS and Android applications over a 90-day window ending October 5, 2026, the study revealed that 96.9% (rounded to 97%) of assessed apps show no detectable Post-Quantum Cryptography (PQC) code or libraries in their binary builds.
The findings spotlight a critical blind spot in enterprise cryptographic migration: while security operations teams increasingly catalog server certificates and core web backbones, mobile endpoints handling logins, payments, and encrypted communications are routinely excluded from cryptographic inventories. Because mobile traffic frequently traverses untrusted public cellular and Wi-Fi networks, mobile apps are acutely vulnerable to “Harvest Now, Decrypt Later” (HNDL) data-collection campaigns targeting sensitive communications for retroactive decryption once a Cryptographically Relevant Quantum Computer (CRQC) emerges.
| [ NowSecure Mobile PQC Assessment: Key Findings & Industry Metrics ] | ||
|---|---|---|
| Assessment Metric | Report Findings & Sample Size | Operational Impact & Security Significance |
| • Sample Size & Methodology | • 136,711 unique mobile apps (iOS & Android) | • Evaluated via static binary inspection and runtime testing on the NowSecure Platform across the 90 days ending Oct. 5, 2026. |
| • PQC Adoption Rate | • 3.1% (4,241 apps detected) • 96.9% non-detectable | • Fewer than 1 in 10 top U.S. mobile apps contain quantum-resilient code; binary presence does not guarantee runtime execution. |
| • Legacy Cryptographic Flaws | • 3,100+ applications flagged | • Apps still actively execute broken classical encryption algorithms (including DES and RC4) vulnerable to immediate classical exploits. |
| • Primary Inventory Barrier | • Third-Party SDK & Library Obfuscation | • Cryptographic implementations are embedded in compiled vendor dependencies that source-code scans and dependency manifests fail to detect. |
The “Mobile Gap”: Why Source Scans Miss Asymmetric Vulnerabilities
Most commercial mobile applications secure user authentication, transaction signing, and TLS sessions using classical public-key cryptography—primarily RSA and Elliptic Curve Cryptography (ECC)—which are vulnerable to Shor’s algorithm running on future quantum hardware. While NIST standardized its core quantum-resistant algorithms in August 2024 (FIPS 203 ML-KEM, FIPS 204 ML-DSA, and FIPS 205 SLH-DSA), practical implementation across mobile ecosystems has stalled.
A central driver of this lag is software architecture. A significant proportion of mobile encryption is governed by third-party Software Development Kits (SDKs) and compiled libraries—such as analytics, payment gateways, and ad trackers—which developers do not author directly. Traditional static Application Security Testing (SAST) and Software Bill of Materials (SBOM) dependency scans inspect source repositories but frequently overlook the compiled cryptography shipped in final store-ready binaries.
Compounding this exposure, runtime testing revealed that more than 3,100 mobile apps still utilize obsolete ciphers like DES and RC4, highlighting that many organizations must resolve basic cryptographic hygiene while simultaneously planning for quantum-safe crypto-agility.
Regulatory Alignment and the Two-Year Migration Runway
The research emphasizes that organizations face fixed compliance horizons. Under U.S. Executive Order 14412, federal agencies are mandated to transition high-value systems to quantum-safe key establishment by December 31, 2030, followed by digital signatures by December 31, 2031. Concurrently, Google has established 2029 as its internal PQC migration objective, and Gartner warns that CISOs who delay PQC planning risk compounding remediation expenses as Q-Day nears.
Federal audit data released by the Government Accountability Office (GAO) in October 2026 (GAO-27-108740) reported that none of 24 major federal agencies have fully implemented essential PQC preparation practices, citing resource and inventory bottlenecks. NowSecure recommends that enterprise AppSec leads establish a structured two-year migration cycle: cataloging compiled binaries (both first-party and vendor-supplied), auditing third-party SDK roadmaps, and retesting cryptographic runtime behaviors on physical devices ahead of 2028 deployment milestones.
Review the comprehensive research report on the NowSecure Intelligence Blog here, examine mobile cryptographic assessment solutions via the NowSecure PQC Portal here, and access the cited federal readiness audit on the GAO Report Portal here.
In GQI Portal
The players behind the news
The team that writes QCR tracks every company, deal and technology in the GQI Factory, GQI's verified database of the quantum industry. Next up: every story linked to its players, coming to QCR's paid plans.
- Players Companies and institutions across the quantum industry, by segment.
- Scorecards How the players compare on hardware, software, funding and more.
Newsletter
QCR Alerts in your inbox
The latest reporting and analysis from Quantum Computing Report. Free, unsubscribe any time.