Nearly all mobile applications lack the encryption needed to withstand future quantum computer attacks, according to a new analysis of over 136,711 iOS and Android apps by NowSecure. The firm’s research revealed that 97% of apps contain no detectable post-quantum cryptography, leaving sensitive data vulnerable to decryption long after it is transmitted. “Mobile apps are the most exposed and least inventoried part of an organization’s encryption,” said Alan Snyder, CEO of NowSecure, highlighting a critical gap in security practices as the timeline for “Q-Day”, when quantum computers could break current encryption, shrinks.

Widespread Lack of Post-Quantum Cryptography in Mobile Apps

More than 3,100 Android and iOS applications currently use weak, legacy encryption algorithms like DES and RC4, exposing users to immediate security risks beyond the threat of future quantum computers, according to a recent analysis by NowSecure. The firm’s assessment of over 136,711 mobile apps revealed a widespread lack of preparation for cryptography, with 97% exhibiting no detectable implementation of these newer, quantum-resistant standards.

This deficiency is particularly concerning given the long lifespan of sensitive data, such as health records and financial histories, which can remain confidential for decades and thus fall within the timeframe where a cryptographically relevant quantum computer could decrypt them. The potential for “harvest now, decrypt later” attacks is a significant driver of the need for proactive migration to cryptography, as encrypted traffic intercepted could be stored and decrypted once a sufficiently powerful quantum computer becomes available.

However, the risks extend beyond historical data; the same public-key algorithms used for encryption also underpin key exchange, authentication and code signing processes currently in operation, meaning a quantum computer could immediately compromise these protections upon arrival. Gartner’s research indicates that “Q-Day,” defined as “the moment that state actors obtain a cryptographically relevant quantum computer (CRQC),” could arrive as early as 2029, yet progress on post-quantum cryptography migration remains inadequate.

Gartner also warns that CISOs “must start postquantum cryptography (PQC) transition now or face doubling costs every year it’s delayed.” A recent survey by Gartner found that 45% of Chief Information Security Officers (CISOs) report their organizations have not begun any cryptography-related activities, while another 39% are only in the planning or early testing stages.

“Security teams can tell you what their servers use but often lack visibility into apps that handle intellectual property, personal data and financial transactions,” said a NowSecure representative, adding that coordinating fixes across developers and vendors takes time, so the work has to start now. This lack of visibility is compounded by the fact that developers frequently incorporate cryptography from third-party libraries without fully understanding or being able to audit the underlying code.

The timeline for adopting post-quantum cryptography is particularly critical for organizations handling data with long-term confidentiality requirements. “Whether a quantum computer exists today or not, the critical issue is how long the data we encrypt today needs to stay private,” explained Colin Gounden, CEO of VIA.

“In defense, everything from ship and aircraft specifications to technical data outlasts the algorithms protecting it, and so do court records, health records and ownership deeds.” VIA, which protects mission-critical data for defense and law enforcement, partnered with NowSecure to independently assess the readiness of its mobile solutions, demonstrating a proactive approach to mitigating the emerging threat, the company says.

The U.S. Government Accountability Office recently found that none of 24 major federal agencies had fully addressed key PQC preparation practices, citing gaps in cryptography expertise and inventory processes, further highlighting the scale of the challenge.

NowSecure recommends a three-step approach to mobile quantum readiness: inventorying and prioritizing cryptography in both first- and third-party apps, remediating first-party apps and establishing a plan with vendors or transitioning to PQC-ready alternatives for third-party apps. The firm’s NowSecure Platform analyzes finished Android and iOS applications to identify quantum-safe code, surface weak cryptography and flag third-party components for investigation, providing security teams with a concrete starting point for building a cryptographic inventory, according to the company.

The company will further discuss these findings and the challenges of mobile PQC migration in a webinar on October 21, focusing on why mobile apps are particularly difficult to inventory and debunking common myths surrounding cryptography.