NowSecure Finds No Detectable PQC Code in 97% of Mobile Apps

Introduction

A recent NowSecure study of 136,711 iOS and Android applications reveals a stark reality: 96.9% of apps contain no detectable post‑quantum cryptography (PQC) code. At the same time, more than 3,100 apps were found using legacy encryption algorithms such as DES and RC4. The findings underscore two intertwined challenges—existing cryptographic weaknesses and the looming risk of quantum‑enabled attacks. For security teams, the message is clear: mobile apps must be inventoried, assessed, and migrated to quantum‑safe solutions before “Q‑Day,” the point at which quantum computers can break today’s public‑key cryptography.

Why Mobile Apps Are the Weakest Link

Mobile applications operate outside the traditional corporate perimeter, transmitting sensitive data over public cellular networks and often relying on third‑party SDKs that embed cryptography developers cannot see in source code. This lack of visibility makes it difficult to maintain an accurate cryptographic inventory, a prerequisite for any migration plan. Gartner predicts Q‑Day could arrive as early as 2029, and a 2026 survey found 45% of CISOs have not begun any PQC work, while another 39% are only in early planning stages. The combination of high exposure and low inventory makes mobile apps the most vulnerable component of an organization’s encryption landscape.

A Pragmatic Three‑Step Roadmap

NowSecure recommends a concise, two‑year migration plan focused on three actionable steps:

1. Inventory & Prioritize – Use runtime testing tools to scan finished app binaries (including bundled SDKs) for any cryptographic code, whether PQC‑related or legacy. Prioritize apps that handle personally identifiable information, intellectual property, or financial transactions.
2. Remediate – For first‑party apps, replace weak algorithms with modern, quantum‑safe alternatives. For third‑party apps, engage vendors to obtain PQC‑ready versions or replace the component with a vetted alternative.
3. Retest & Validate – After remediation, re‑run static and dynamic analyses on real devices to confirm that only approved cryptography remains and that performance impacts are acceptable.

This loop—inventory, remediate, retest—creates a repeatable process that can be scaled across an organization’s entire mobile portfolio.

Leveraging NowSecure Platform for Quantum Readiness

NowSecure’s Platform offers a turnkey solution for the first two steps of the roadmap. By analyzing finished binaries, the platform can:

• Detect PQC‑related libraries and flag their presence (or absence) in the app bundle.
• Identify weak or deprecated algorithms such as DES, RC4, and MD5.
• Surface third‑party components that require vendor coordination.

Findings can be exported into ticketing systems or integrated with CI/CD pipelines, enabling developers to address issues early in the build process. For third‑party risk, the platform provides vendor‑assessment reports that help security teams negotiate remediation timelines or select alternative solutions.

The Business Case for Early Action

Delaying PQC migration carries tangible costs. Gartner warns that postponing migration can double expenses each year due to the need for rushed implementations, extensive testing, and potential performance penalties. Moreover, federal mandates—such as Executive Order 14412, which requires high‑impact systems to adopt quantum‑safe key establishment by the end of 2030—create regulatory pressure for agencies and their contractors.

By starting now, organizations can spread effort over a manageable timeline, avoid rushed, error‑prone rollouts, and maintain compliance with emerging government requirements.

Conclusion

NowSecure’s analysis paints a clear picture: the vast majority of mobile apps are not yet prepared for the quantum future, and many still rely on outdated encryption. Security teams must treat mobile cryptography as a priority, beginning with a comprehensive inventory, followed by systematic remediation and rigorous retesting. Leveraging automated analysis tools like NowSecure Platform can accelerate this process, ensuring that both first‑party and third‑party apps become quantum‑ready well before Q‑Day arrives.

Take the first step today—inventory your mobile cryptography and embed PQC readiness into your development lifecycle.