The Signal
NowSecure Finds 97% of 136,711 Mobile Apps Lack Detectable PQC
NowSecure’s analysis of 136,711 iOS and Android apps found that 96.9% had no detectable post-quantum cryptography code or libraries. The company also flagged more than 3,100 apps using weak encryption, while cautioning that its binary scan
Quantum.world Team · Written with AI · fact-checked ·
Only 4,241 of the 136,711 iOS and Android apps NowSecure examined contained detectable post-quantum cryptography code or libraries. The company’s analysis, released October 20, found that 96.9% showed no such code in their app binaries—a gap that could complicate efforts to protect mobile data against future quantum attacks.
What the 97% figure measures
NowSecure assessed apps over the 90 days ending October 5, 2026, using static inspection of app binaries. It counted an app available on both iOS and Android once for each platform, and reported 96.9% without detectable PQC-related code, rounded to 97%. The finding is about what the scan detected in the app binary, not a direct measure of every protection an app may receive.
The company states that finding PQC code does not establish that it is used at runtime. The reverse is also possible: an app with no detectable PQC in its binary may still benefit from protection provided by its operating system, network stack or server. That distinction makes the result a measure of visible code in the sampled apps, not a definitive verdict on each app’s end-to-end security.
Legacy encryption showed up in more than 3,100 apps
The analysis also used runtime testing to flag weak encryption algorithms in more than 3,100 Android and iOS apps. NowSecure named DES and RC4 as examples of legacy algorithms detected in those checks. The company presents those findings as a separate, present-day cryptographic concern alongside the longer-term work of preparing public-key systems for quantum-resistant algorithms.
That split matters for security teams: replacing quantum-vulnerable public-key cryptography is not the same task as addressing outdated encryption already in use. NowSecure argues that teams need to inventory both first-party apps and third-party software components, including libraries and software development kits embedded in finished applications. It recommends prioritizing apps that handle personal information, intellectual property and financial transactions.
“The most exposed and least inventoried”
“Mobile apps are the most exposed and least inventoried part of an organization’s encryption,” said Alan Snyder, CEO of NowSecure. Snyder said organizations may have a clearer view of server cryptography than of apps handling sensitive data, and warned that coordinating fixes across developers and vendors takes time.
NowSecure recommends a minimum two-year migration plan for mobile apps, starting with an inventory and assessment, then moving through remediation and retesting. Its guidance separates apps an organization can change itself from third-party apps that require vendor coordination or replacement. The company says the size and overhead of PQC algorithms may affect performance and architecture in first-party apps, while third-party components add testing and coordination work.
Standards are ready; inventories are not
NIST says three finalized post-quantum cryptography standards are ready for implementation and urges organizations to begin migration. Moving from that guidance to working mobile protections requires identifying where vulnerable cryptography appears across software, services and devices—a task made harder when code arrives inside compiled third-party components.
NowSecure’s results point to a visibility problem as much as an adoption gap: a binary scan can reveal code that an inventory misses, but it cannot by itself prove how that code behaves during use. The next questions for organizations are which apps protect long-lived sensitive data, which vendors can update their components, and how teams will verify that changes work on real devices.