NowSecure Benchmark Finds 97% of Mobile Applications Lack Post-Quantum Cryptography Ahead of Mandated Timelines

Introduction

A new benchmark from automated mobile security firm NowSecure reveals a stark reality: out of 136,711 iOS and Android apps examined over a 90‑day period, 96.9% show no detectable post‑quantum cryptography (PQC) in their binaries. As governments and industry leaders set hard deadlines for quantum‑safe migration, the mobile ecosystem is lagging far behind, leaving billions of users vulnerable to future "harvest‑now‑decrypt‑later" attacks.

The Mobile PQC Gap

Massive non‑adoption rates

• Only 3.1% of the sampled apps contained any PQC code or libraries.
• Even among the top U.S. consumer apps, fewer than one in ten incorporated quantum‑resilient algorithms.

Legacy crypto still in use

• More than 3,100 applications were found running obsolete ciphers such as DES and RC4, exposing them to classic attacks in addition to the looming quantum threat.

Why source‑code scans miss it

Mobile apps rely heavily on third‑party SDKs and compiled libraries for analytics, payments, and ad services. Traditional static analysis and SBOM tools often examine source repositories but overlook the compiled cryptography shipped in final binaries. This obscures both classical and quantum‑vulnerable implementations from security inventories.

Regulatory Pressure and Timelines

• U.S. Executive Order 14412 mandates federal high‑value systems to adopt quantum‑safe key establishment by Dec 31 2030 and quantum‑resistant digital signatures by Dec 31 2031.
• Google has set an internal PQC migration target for 2029.
• Gartner warns that CISOs delaying PQC planning will face escalating remediation costs as "Q‑Day" approaches.
• A recent GAO audit (Oct 2026) found zero of 24 major federal agencies had fully implemented essential PQC preparation practices, citing inventory bottlenecks and resource constraints.

A Pragmatic Two‑Year Migration Path

NowSecure recommends that enterprise AppSec leaders adopt a structured, two‑year cycle to close the mobile gap:

1. Catalog compiled binaries – Include both first‑party code and vendor‑supplied SDKs in a comprehensive inventory.
2. Audit third‑party roadmaps – Engage SDK providers to understand their PQC migration timelines and request updates where needed.
3. Run runtime cryptographic tests – Deploy physical‑device testing to verify that binaries actually execute quantum‑resistant algorithms and have retired legacy ciphers.
4. Retest before 2028 milestones – Align mobile readiness checks with broader organizational PQC rollout plans to ensure consistent protection across web, cloud, and endpoint layers.

Practical Takeaways

• Prioritize inventory: Treat compiled mobile binaries as a critical asset class, not an afterthought.
• Demand transparency: Require SDK vendors to disclose cryptographic implementations and migration schedules.
• Integrate PQC testing: Extend existing mobile AppSec pipelines with static binary inspection and on‑device runtime validation for quantum‑safe algorithms.
• Plan for dual remediation: Address immediate classical weaknesses (e.g., DES/RC4) while building a roadmap for PQC adoption.

Closing Thoughts

The NowSecure benchmark underscores a pressing security blind spot: while enterprises are busy hardening servers and cloud services, the mobile front—where users conduct logins, payments, and data exchanges—remains largely unprepared for the quantum era. By treating compiled binaries as first‑class security assets, demanding PQC transparency from third‑party SDKs, and embedding quantum‑resilient testing into existing AppSec workflows, organizations can bridge the gap before regulatory deadlines make remediation unavoidable.

Preparedness today will determine whether tomorrow’s quantum computers become a strategic advantage or a catastrophic vulnerability for mobile ecosystems.