Why the 97% of mobile apps with no post-quantum code aren't all exposed

136,711 iOS and Android apps examined, and 96.9% of them with no trace of post-quantum cryptography. The figure, published on October 20 by mobile security vendor NowSecure, is enough to worry IT managers. But it deserves a close reading, because it doesn't necessarily measure what you might think.

Post-quantum cryptography refers to algorithms designed to withstand a future quantum computer capable of breaking RSA and elliptic curves. The most immediate risk is called “harvest now, decrypt later”: an attacker records encrypted traffic today to read it in a few years.

What NowSecure actually measured

According to the press release picked up by The Quantum Insider, the vendor analyzed apps seen over 90 days up to October 5, 2026, inspecting their binary files for post-quantum algorithms or libraries. Result: only 4,241 apps (3.1%) contain any. Among the most popular U.S. apps, fewer than one in ten ship it.

NowSecure itself acknowledges the limitation: the absence of this code in the app doesn't mean the absence of protection, which can come from the operating system, the network stack or the server. And the presence of code doesn't prove it is used. The study has not been independently reviewed, and its press release refers at times to static analysis and at times to runtime testing.

On iPhone, the system already encrypts in the app's place

Apple illustrates this limitation well. According to its platform security guide, on iOS 26 and iPadOS 26, TLS 1.3 with a quantum-resistant hybrid key exchange (X25519MLKEM768, which combines a classical elliptic curve with the ML-KEM algorithm standardized by NIST) is enabled by default for the URLSession and Network networking interfaces. An app that uses these interfaces benefits from it without containing a single line of post-quantum code, provided the server on the other end accepts this key exchange.

On Android, and for apps that ship their own encryption library, the situation depends on the stack used: this is where an inventory is most valuable.

What should you check in your apps?

For companies that publish or deploy mobile apps, the NowSecure figure is above all a starting point:

• Identify which network stack each app uses: system interfaces, or an embedded library (OpenSSL, BoringSSL, third-party HTTP client) that you will have to update yourself.
• Check that your servers and gateways accept the hybrid X25519MLKEM768 exchange: without them, protection on the phone side is useless.
• Deal first with what the study flags elsewhere: more than 3,100 apps still contain obsolete algorithms such as DES or RC4, a very current risk.
• Don't forget the slower project of signatures and certificates, as the MITRE assessment showed.

To structure your approach, our six-step migration guide starts precisely with the inventory. One question remains open: how many API servers used by mobile apps actually accept the hybrid exchange today?