NowSecure Benchmark Finds 97% of Mobile Applications Lack Post-Quantum Cryptography Ahead of Mandated Timelines
AI-summarised brief · reviewed before publication
NowSecure’s latest benchmark examined 136,711 distinct iOS and Android apps over a 90‑day period ending 5 October 2026 and found that 96.9 % of them contain no detectable post‑quantum cryptography (PQC) code or libraries. The study highlights a “mobile gap” in enterprise cryptographic inventories, as most security teams focus on servers while mobile endpoints—used for logins, payments and encrypted traffic—remain reliant on classical RSA and ECC algorithms vulnerable to future quantum attacks. The report also uncovered more than 3,100 apps still employing obsolete ciphers such as DES and RC4. With U.S. Executive Order 14412 requiring federal systems to adopt quantum‑safe key establishment by the end of 2030 and Google targeting 2029 for its own migration, NowSecure urges AppSec leaders to begin a two‑year migration cycle that inventories compiled binaries, audits third‑party SDKs, and conducts runtime cryptographic testing ahead of 2028 milestones.
💡 Why It Matters
- · Mobile apps are the most exposed attack surface for “harvest‑now, decrypt‑later” campaigns, and their lag in PQC adoption leaves billions of user communications vulnerable once quantum computers become operational.
