NowSecure Finds 97% of Mobile Apps Lack PQC Code
NowSecure reports that a scan of 136,711 iOS and Android applications found no detectable post-quantum cryptography (PQC) code or libraries in 96.9% of them, a figure the firm rounds to 97%. The mobile security testing company conducted this analysis using its NowSecure Platform and published the results on October 20, 2026. This finding emerges as binding government migration deadlines are to begin in 2030, indicating a rapidly diminishing timeframe for the mobile ecosystem to transition to PQC.
NowSecure’s Findings
NowSecure’s 97% figure is based on its own measurements from a 90-day period ending October 5, 2026. The company counts apps available on both platforms once per platform. Its methodology involved static inspection of app binaries to identify PQC algorithms, code, or libraries.
NowSecure clarifies that, though detection confirms presence in the binary, it doesn’t inherently confirm runtime usage. This finding pertains to app-level code and doesn’t include PQC protection potentially provided by an operating system, network stack, or server.
Specific findings include:
- Apps assessed: 136,711 unique iOS and Android apps, identified by bundle ID or package name.
- No detectable PQC code: 96.9%, rounded to 97%.
- Apps with detectable PQC code or libraries: 4,241, or 3.1%.
- Weak encryption flagged separately: Over 3,100 apps, including those using legacy algorithms such as DES and RC4.
- Popular U.S. apps with quantum-safe code: Fewer than 1 in 10.
Alan Snyder, CEO of NowSecure, stated that mobile apps represent the most vulnerable and least inventoried aspect of an organization’s encryption, and emphasized that remediation across various developers and vendors is a time-consuming process.
The Urgency of Deadlines
NIST finalized its post-quantum standards in 2024, which include ML-KEM key encapsulation under FIPS 203, and the ML-DSA and SLH-DSA signature schemes under FIPS 204 and 205. These algorithms are specifically designed to withstand attacks from cryptographically relevant quantum computers. Security teams frequently highlight the “harvest now, decrypt later” threat, where adversaries store encrypted communications today with the intention of decrypting them once quantum hardware becomes capable.
Government deadlines are already established. U.S. Executive Order 14412 mandates that agencies migrate high-value systems to quantum-safe key establishment by December 31, 2030. Germany’s BSI, through its TR-02102-1 guidance, sets 2030 for high-protection systems and later dates for signatures, with a country-by-country overview tracked by Encryption Consulting.
NowSecure advises a two-year migration plan that begins with inventorying existing encryption. For additional information on PQC readiness, continue to follow QNews coverage regarding the mobile and enterprise migration.