What Sentinel finds on Android
The virus list on your phone, in plain words: which dangers it knows, how many, where the list comes from, and what it cannot do.
Known Android malware, kept on the phone
Every scan, and automatically
Checks supported settings, apps, known malware, impersonation warning signs, remote-control powers and network information. Duration depends on the phone.
Check the published version
Accessible folders, SD cards and documents allowed by Android and your permissions. Finds app installers (even hidden ones, and installers packed inside a .zip or .rar), then compares every app and installer with the virus list. The scan sends nothing anywhere: no file, no app list, no fingerprint. The phone only downloads what is new in the virus list.
Check the published version
No tapping: a new app, a new download in Downloads, Telegram or WhatsApp, and a re-check of installed apps every 6 hours. An APK that lands in a download, WhatsApp or Telegram folder raises a warning even when no signature matches. Background limits and manufacturer settings can delay checks. Battery use still needs measurements on real phones.
Check the published version
Checks that need no list
Warnings compare a small reviewed list of familiar app names and official packages. A mismatch is a reason to check, not proof of fraud or proof that an unmatched app is genuine.
An app with no icon that can still read SMS or the screen, draw over other apps, read notifications or install apps.
Reading SMS together with screen control or overlays, the combination banking trojans use.
Files named like a traffic fine, KYC, reward or subsidy, and a PDF or photo that is really an app.
These can raise a flag on a new virus that is in no list yet, but they are signs, not proof. Sentinel says “look at this” and you decide.
What it cannot do
- “No virus found” means nothing known was found, not a promise that a file is safe.
- Sentinel does not run apps to watch what they do, and it does not read the code inside them (planned).
Where the list comes from
Signatures by the ClamAV project (Cisco Talos), published under the GNU General Public License v2. Sentinel uses only the Android file-fingerprint part of the database, as short digests; the ClamAV engine itself is not part of the app.
Start with your phone. See more in the portal.
Phone checks, family sharing and organisation security have different permissions and limits.
Personal
Your connected phones, family sharing choices, alerts, reports and product keys.
Organisation
Your organisation’s devices, server health, monitoring, members, roles and audit records.
Enterprise XDR
Incidents, event timelines, threat hunting and supported server response. Results depend on the telemetry agents actually report.