97% of Mobile Apps Show No Quantum-Safe Encryption, NowSecure Analysis of More Than 136,000 Apps Finds
Data stolen today could be decrypted by future quantum computers, and many apps already use outdated algorithms that
Press Release Disclaimer: This is a press release distributed through the XPR Media network. It has not been independently verified by our newsroom.
CHICAGO, Oct. 20, 2026 (GLOBE NEWSWIRE) — NowSecure today released an analysis, conducted with NowSecure Platform, of 136,711 iOS and Android apps. It found that 97% contain no detectable post-quantum cryptography (PQC), the new generation of encryption standards designed to withstand attacks from quantum computers. Even among the most popular U.S. apps, fewer than 1 in 10 showed quantum-safe code. Security teams often leave mobile apps out of their cryptographic inventories, and organizations cannot migrate what they have not inventoried.
The risk does not wait for quantum computers. Using runtime testing, NowSecure flagged weak encryption algorithms in more than 3,100 Android and iOS apps during the same study. These checks detect legacy algorithms such as DES and RC4. The findings highlight the need to address existing encryption weaknesses while identifying and migrating public-key cryptography vulnerable to future quantum attacks.
Q-Day Is Close, and Migration Takes Years
According to Gartner®, Q-Day is “the moment that state actors obtain a cryptographically relevant quantum computer (CRQC),” and “Q-Day arrives as soon as 2029, but most progress on PQC migration so far is inadequate.”¹ Gartner warns that such capabilities “threaten widely used public-key cryptography” and says the business risks include “harvest now, decrypt later”.¹
Harvest now, decrypt later is the most discussed of these risks, and it is a problem of time. Encrypted traffic intercepted today cannot be read now, but it can be stored and decrypted once a CRQC exists, which puts any data with a long shelf life, such as health records, financial history and credentials, at risk already. The less discussed risk is a problem of trust. The same public-key algorithms also perform key exchange, authentication and code signing for systems that are live right now, so when a CRQC arrives, those protections fail at once rather than retroactively. Q-Day is therefore not only a historical data problem. It is an immediate exposure for every application still running classical cryptography on that day.
Mobile applications sit squarely in both categories. They transmit sensitive data over diverse public cellular and roaming networks outside enterprise control, which heightens their exposure to “harvest now, decrypt later” tactics, a risk explicitly highlighted in joint migration advisories from CISA, NSA and NIST. They also depend on the same key exchange, authentication and code signing that a CRQC would break. NowSecure urges organizations to adopt a minimum two-year PQC migration plan for their mobile apps. The first phase should focus on inventorying and assessing mobile cryptography, followed by a cycle of remediation and retesting. The size and overhead of the new PQC algorithms will affect performance and architecture in first-party apps, while third-party components and apps will require substantial coordination, remediation and testing. Against that timeline, a plan that starts later leaves little margin.
Gartner also warns that CISOs “must start postquantum cryptography (PQC) transition now or face doubling costs every year it’s delayed.”¹ Gartner’s 2026 survey of CISOs found that “45% of CISOs say their organization hasn’t begun any PQC-related activities, and another 39% are only in the planning and early testing stages.”¹
“Mobile apps are the most exposed and least inventoried part of an organization’s encryption,” said Alan Snyder, CEO of NowSecure. “Security teams can tell you what their servers use but often lack visibility into apps that handle intellectual property, personal data and financial transactions. NowSecure makes finding vulnerable cryptography easy, but coordinating fixes across developers and vendors takes time, so the work has to start now.”
Sensitive Data and Federal Deadlines Raise the Stakes
The timeline matters most where data must stay confidential for decades. “Whether a quantum computer exists today or not, the critical issue is how long the data we encrypt today needs to stay private. In defense, everything from ship and aircraft specifications to technical data outlasts the algorithms protecting it, and so do court records, health records and ownership deeds,” said Colin Gounden, CEO of VIA. “Given VIA’s work protecting mission-critical data across defense and law enforcement, we sought out NowSecure to independently assess the post-quantum readiness of our mobile solutions. Organizations can make that decision today.”
Federal deadlines reinforce the timeline for agencies and the contractors that serve them. Executive Order 14412 directs agencies to transition high-value and high-impact systems to quantum-safe key establishment by Dec. 31, 2030, and calls for a proposed rule extending requirements to covered contractors. Yet a U.S. Government Accountability Office report made public Oct. 6 found that none of 24 major federal agencies had fully addressed key PQC preparation practices, citing gaps in cryptography expertise and inventory processes.
Three Steps to Mobile Quantum Readiness
Developers often ship cryptography they did not write and cannot see in source code, because it arrives inside third-party libraries. The only reliable way to inventory it is to examine the finished app that users actually download. NowSecure recommends three steps covering both the apps organizations build and the apps they depend on:
- Inventory and prioritize all cryptography in first- and third-party mobile apps, including the third-party SDKs and libraries inside them, starting with what protects PII, IP, financial transactions and other sensitive data.
- Remediate first-party apps. For third-party apps, build a plan with the vendor or move to a PQC-ready alternative.
- Retest the remediated PQC algorithms, components and apps.
Find and Address Mobile Cryptographic Risk
NowSecure Platform analyzes finished Android and iOS apps to identify quantum-safe code, surface weak or outdated cryptography and flag third-party components for investigation, giving security teams a concrete starting point for a mobile cryptographic inventory. Teams can prioritize apps that handle sensitive data, route findings into development workflows, and retest builds on real devices. For third-party apps, NowSecure vendor risk assessments support all three steps, while real-device testing and expert-led penetration testing verify cryptographic behavior at runtime.
This capability is available to NowSecure Platform customers today, and the findings in this release were produced with it. NowSecure will discuss the findings and what they mean for mobile inventories on Oct. 21 at 1 p.m. ET in The Mobile Gap in Your PQC Plan, a 45-minute webinar on why mobile apps are harder to inventory and which PQC myths to avoid.
About the Analysis
In the 90 days ending Oct. 5, 2026, NowSecure assessed a combined 136,711 unique iOS and Android apps by bundle ID or package name. NowSecure counts an app available on both stores once per platform. Of all apps assessed, 96.9% (rounded to 97%) showed no detectable PQC-related code, and 4,241 (3.1%) showed PQC-related code or libraries. The analysis used static inspection of app binaries to identify PQC-related algorithms, code, or libraries, as well as weak encryption. Detection confirms presence in the binary and does not by itself confirm use at runtime. Absence of detectable PQC code in the binary does not rule out PQC protection provided by the operating system, network stack or server.
About NowSecure
NowSecure helps organizations manage AI risk inside mobile apps, analyzing app binaries and runtime behavior on real devices to give security and compliance teams visibility into hidden AI, sensitive data flows and third-party exposure. As a leader in mobile application risk management, NowSecure brings more than 15 years of mobile security expertise, with 12,000+ penetration tests, 5M+ automated assessments and 8M+ vulnerabilities identified. Leading telecom, banking, healthcare and government organizations, including the DOJ, DOD and DOS, trust NowSecure. The company also supports open-source projects including Frida, Radare2 and the OWASP MASVS standard.
Gartner Attribution and Disclaimer
1 Gartner, “CISO Agenda Priority: Transition to Postquantum Cryptography Before It’s Too Late (And Too Expensive),” Mark Horvath, Sarah Almond, Thomas Lintemuth, 17 September 2026.
GARTNER is a registered trademark and service mark of Gartner, Inc. and/or its affiliates in the U.S. and internationally and is used herein with permission. All rights reserved.
Media Contact
Michelle Schafer
Merritt Group
schafer@merrittgrp.com
703-403-6377
Media gallery
