NowSecure’s mobile PQC survey reveals an inventory gap

What was counted

NowSecure says 96.9% of 136,711 iOS and Android applications it examined contained no detectable post-quantum cryptography code. Its October 20 release describes a ninety-day survey ending October 5, with an app distributed on both stores counted once per platform.^[1]

The analysis detected PQC-related code or libraries in 4,241 app binaries. Those findings measure code presence. The vendor’s own methods section says that presence does not establish runtime use, while absence does not exclude protection supplied by an operating system, network stack or server.^[1]

Why the distinction changes the headline

The useful takeaway is a map of the blind spots. An inventory can begin with the shipped app, then follow the data flow through its libraries, platform services and remote endpoints. Each layer can answer a different security question. For readers, the distinction is between an observation of software contents and a test of what protected a particular session.

A library can be present without protecting the connection under examination. Conversely, a connection can rely on cryptographic functions outside the scanned package. Treating either observation as a complete verdict would erase the boundary that makes the survey interpretable.^[1]

From a percentage to evidence

For an organisation investigating its own exposure, the reporting question is concrete: which app build and device configuration were inspected, what was negotiated in a real session and where did authentication and key establishment occur? An aggregate percentage cannot supply those answers.

This is a vendor-issued survey, rather than an independent audit of every application’s security. It also provides no experimental date for a cryptographically relevant quantum computer. The strongest follow-up would connect binary findings to reproducible runtime checks for specified data flows.^[1]