Insider Brief
- A NowSecure analysis of 136,711 iOS and Android apps found that 96.9% contained no detectable post-quantum cryptography (PQC)-related code or libraries.
- The analysis also identified weak encryption algorithms in more than 3,100 mobile apps, pointing to existing cryptographic weaknesses alongside future quantum-related risks.
- NowSecure recommends that organizations inventory cryptography in first- and third-party mobile apps, remediate vulnerable implementations and retest applications as part of a planned PQC migration.
PRESS RELEASE — NowSecure today released an analysis, conducted with NowSecure Platform, of 136,711 iOS and Android apps. It found that 97% contain no detectable post-quantum cryptography (PQC), the new generation of encryption standards designed to withstand attacks from quantum computers. Even among the most popular U.S. apps, fewer than 1 in 10 showed quantum-safe code. Security teams often leave mobile apps out of their cryptographic inventories, and organizations cannot migrate what they have not inventoried.
The risk does not wait for quantum computers. Using runtime testing, NowSecure flagged weak encryption algorithms in more than 3,100 Android and iOS apps during the same study. These checks detect legacy algorithms such as DES and RC4. The findings highlight the need to address existing encryption weaknesses while identifying and migrating public-key cryptography vulnerable to future quantum attacks.
Q-Day Is Close, and Migration Takes Years
According to Gartner®, Q-Day is “the moment that state actors obtain a cryptographically relevant quantum computer (CRQC),” and “Q-Day arrives as soon as 2029, but most progress on PQC migration so far is inadequate.”¹ Gartner warns that such capabilities “threaten widely used public-key cryptography” and says the business risks include “harvest now, decrypt later”.¹
Because mobile applications transmit sensitive data over diverse public cellular and roaming networks outside enterprise control, they face heightened exposure to ‘harvest now, decrypt later’ tactics, a risk explicitly highlighted in joint migration advisories from CISA, NSA and NIST. NowSecure urges organizations to adopt a minimum two-year PQC migration plan for their mobile apps. The first phase should go to inventorying and assessing mobile cryptography, followed by a cycle of remediation and retesting. The size and overhead of the new PQC algorithms will affect performance and architecture in first-party apps, while third-party components and apps will require substantial coordination, remediation and testing. Against that timeline, a plan that starts later leaves little margin.
Gartner also warns that CISOs “must start postquantum cryptography (PQC) transition now or face doubling costs every year it’s delayed.”¹ Gartner’s 2026 survey of CISOs found that “45% of CISOs say their organization hasn’t begun any PQC-related activities, and another 39% are only in the planning and early testing stages.”¹
“Mobile apps are the most exposed and least inventoried part of an organization’s encryption,” said Alan Snyder, CEO of NowSecure. “Security teams can tell you what their servers use but often lack visibility into apps that handle intellectual property, personal data and financial transactions. NowSecure makes finding vulnerable cryptography easy, but coordinating fixes across developers and vendors takes time, so the work has to start now.”
Sensitive Data and Federal Deadlines Raise the Stakes
The timeline matters most where data must stay confidential for decades. “Whether a quantum computer exists today or not, the critical issue is how long the data we encrypt today needs to stay private. In defense, everything from ship and aircraft specifications to technical data outlasts the algorithms protecting it, and so do court records, health records and ownership deeds,” said Colin Gounden, CEO of VIA. “Given VIA’s work protecting mission-critical data across defense and law enforcement, we sought out NowSecure to independently assess the post-quantum readiness of our mobile solutions. Organizations can make that decision today.”
Federal deadlines reinforce the timeline for agencies and the contractors that serve them. Executive Order 14412 directs agencies to transition high-value and high-impact systems to quantum-safe key establishment by Dec. 31, 2030, and calls for a proposed rule extending requirements to covered contractors. Yet a U.S. Government Accountability Office report made public Oct. 6 found that none of 24 major federal agencies had fully addressed key PQC preparation practices, citing gaps in cryptography expertise and inventory processes.
Three Steps to Mobile Quantum Readiness
Developers often ship cryptography they did not write and cannot see in source code, because it arrives inside third-party libraries. The only reliable way to inventory it is to examine the finished app that users actually download. NowSecure recommends three steps covering both the apps organizations build and the apps they depend on:
- Inventory and prioritize all cryptography in first- and third-party mobile apps, including the third-party SDKs and libraries inside them, starting with what protects PII, IP, financial transactions and other sensitive data.
- Remediate first-party apps. For third-party apps, build a plan with the vendor or move to a PQC-ready alternative.
- Retest the remediated PQC algorithms, components and apps.
Find and Address Mobile Cryptographic Risk
NowSecure Platform analyzes finished Android and iOS apps to identify quantum-safe code, surface weak or outdated cryptography and flag third-party components for investigation, giving security teams a concrete starting point for a mobile cryptographic inventory. Teams can prioritize apps that handle sensitive data, route findings into development workflows, and retest builds on real devices. For third-party apps, NowSecure vendor risk assessments support all three steps, while real-device testing and expert-led penetration testing verify cryptographic behavior at runtime.
This capability is available to NowSecure Platform customers today, and the findings in this release were produced with it. NowSecure will discuss the findings and what they mean for mobile inventories on Oct. 21 at 1 p.m. ET in The Mobile Gap in Your PQC Plan, a 45-minute webinar on why mobile apps are harder to inventory and which PQC myths to avoid.
About the Analysis
In the 90 days ending Oct. 5, 2026, NowSecure assessed a combined 136,711 unique iOS and Android apps by bundle ID or package name. NowSecure counts an app available on both stores once per platform. Of all apps assessed, 96.9% (rounded to 97%) showed no detectable
PQC-related code, and 4,241 (3.1%) showed PQC-related code or libraries. The analysis used static inspection of app binaries to identify PQC-related algorithms, code, or libraries, as well as weak encryption. Detection confirms presence in the binary and does not by itself confirm use at runtime. Absence of detectable PQC code in the binary does not rule out PQC protection provided by the operating system, network stack or server.