What happened
- NowSecure, a mobile security company, published on October 20, 2026 an analysis of 136,711 unique iOS and Android apps, reviewed over the 90 days before October 5.
- In 96.9% of them, about 132,470, it found no post-quantum cryptography (PQC) code or libraries, the kind that resists quantum computers able to break today’s encryption. Only 4,241 apps, 3.1%, had them.
- More than 3,100 apps used legacy algorithms such as DES and RC4. Among the most popular US apps, fewer than one in ten showed code resistant to quantum attacks.
- According to the company, the method was static inspection of the apps’ binaries. An app available in both stores counts once per platform.
Why it matters
- A bank, a digital wallet or a delivery app in Chile holds data today that an attacker can copy and decrypt later, once the quantum computer exists. This threat is called harvest now, decrypt later, and does not require the machine to exist today.
- The finding is less grim than the headline suggests. NowSecure warns that detecting code does not prove it is used, and that its absence does not rule out protection in the operating system, the network or the server.
- The consequence the release leaves out: an SME that commissions a custom app rarely knows which cryptographic library it carries. The inventory NowSecure recommends doing first is a question you can put to the developer this week.
The number
3.1%. Share of the 136,711 analyzed apps with detectable post-quantum cryptography code or libraries.
Context
The pressure comes from regulators and analysts. NowSecure cites Gartner, which puts Q-Day (the day a quantum computer breaks current encryption) as soon as 2029, and says 45% of security officers have not started. It also cites a GAO report from October 6: none of 24 US federal bodies met key preparation practices. In August, OpenAI, Anthropic, Google and Microsoft signed a call to coordinate defenses against cyberattacks; quantum is the same coordination problem. Executive Order 14412 sets December 31, 2030 for high-value systems.
What’s next
- October 21, 2026, 1:00 p.m. US Eastern time: NowSecure webinar, “The Mobile Gap in Your PQC Plan”.
- December 31, 2030: Order 14412 deadline for critical US government systems.
- The company recommends a migration plan of at least two years, in three steps: inventory and prioritize, fix, and retest.
Bottom line
An UpGuard study from September 25 found readable personal data in more than half of the exposed databases it reviewed. Post-quantum cryptography is the problem of the next decade; open databases remain the problem of this one.
Sources
Edited by Rodrigo Cornejo. How we select and verify: who writes these notes.
