Device health and posture
A risk score built from real device signals: root, screen lock, encryption, risky apps.
- Available
- 06
- Limited
- 02
- Not released
- 06
- Coming
- 01
How the attack works
A weakened device makes every other attack easier. A rooted phone lets malware escape the app sandbox; an unlocked or unencrypted phone gives away everything if lost; a sideloaded app with accessibility or SMS access can read your screen and your one-time codes. On servers, an unknown process or a miner can run for weeks unnoticed.
- STAGE 01
Weakening
Root, developer mode, no screen lock, an outdated OS, or apps installed from outside the store.
- STAGE 02
Foothold
An app with overlay, accessibility or SMS permissions, or a process on a server running from a temp folder.
- STAGE 03
Abuse
Screen reading, OTP capture, fake overlays on banking apps, or CPU stolen for mining.
- STAGE 04
Persistence
Device-admin rights, new accounts or scheduled tasks to survive reboots and removal attempts.
- Phones with apps sideloaded from links or third-party stores
- Children's and older relatives' phones without a screen lock
- Servers nobody has logged into for months
A common pattern: an APK is shared over a messaging app as a "bank update" or "delivery tracking" app. Once installed it asks for accessibility access, then shows overlays on top of banking apps and forwards incoming OTPs.
A phone that is rooted, unlocked or running an unknown-source app is easier to attack. A server with an unexpected process or a full disk is a problem waiting.
Sensor, rule, evidence, action
Each step carries its own state. A step that is not built is shown as coming, not skipped.
Real device signals
Root (11 known paths or test-keys), screen lock, encryption, developer mode, OS level, remote-access apps; on servers CPU, memory, disk, network, processes every few seconds.
AvailableAndroid 4.1, server agentWeighted posture score
Root 45, remote access active 50, no lock 20, unknown sources 20, no encryption 15, SDK below policy 12, developer mode 8 … Levels at 20, 45 and 70.
AvailableHub, productionEvery reason shown
The score lists each finding. Signals we cannot collect — Play Integrity today — are shown as unknown, not as passed.
AvailableWarn, lock, locate, alarm
Remote lock, locate and alarm from the portal; tamper attempts on device admin are reported and can trigger a lock.
AvailableAndroid 4.50
The phone posture score adds weighted points for each finding (root 45, remote-access app active 50, no screen lock 20 …) and shows every reason.
Server health is measured, not estimated: CPU, memory, disk and network every few seconds, with statistical anomaly flags.
Signals we cannot collect are shown as unknown, not as passed. Play Integrity, for example, is not implemented and always reports unknown.
What works today, and what is coming
What works today
08In production or in the current download.
- Phone posture score with reasonsAvailable
Root, unknown sources, screen lock, encryption, developer mode, OS level, remote-access apps.
Android app 4.50
- Anti-theft: lock, locate and alarmAvailable
From the web portal to an enrolled phone; tamper attempts are reported. The phone cannot be unlocked remotely, and SIM-change alerts and lost-device mode are partial.
Android app 4.50
- Family safetyAvailable
Map, member status, safe places, SOS and I-am-safe, family chat and notifications, on the phone and the web. Location is shared only with a member's consent, and an SOS carries the last known position only when pressed.
Android app 4.50, web portal
- Live tracking for 10, 30 or 60 minutesLimited
The watched phone shows who is watching and can stop it. Not yet tested between two real phones.
Android app 4.50
- App risk, unknown-source install watch and permission reviewAvailable
Which apps ask for risky powers and where each app came from; a notice when an app is installed from outside a store.
Android app 4.50
- Server metrics and anomaly flagsAvailable
CPU, memory, disk, network, processes, services, containers.
Server agent (Linux, macOS, Windows)
- Crypto-miner checksLimited
Known miner process names and pool ports on servers, on demand; on the phone a mining-risk reading from app behaviour.
Server agent (Linux), Android app 4.50
- Battery, storage and health historyAvailable
Device health screens and trends on the phone. CPU and memory readings are partial.
Android app 4.50
Built, not yet released
06The code exists and is tested in the repository; it has not shipped to users.
- Local App LockNot released
Chosen apps use the phone’s authentication. Needs Usage access, draw-over-apps permission and running protection. Delays and manufacturer restrictions can limit it; Settings stays accessible.
- New and updated app checksNot released
Adds risky permission combinations and reviewed signer checks to install/update scanning. Warnings do not block installation. Benign install/update fixtures and battery measurements still need real phones.
- Consented family phone toolsNot released
A paired phone can share daily screen-time totals, new-app counts and risk reasons, and revoke sharing. Bedtime notices are reminders. App blocking, real time limits and YouTube supervision need platform tools such as Family Link.
- Privacy AdvisorNot released
Sensitive permissions, available control powers and last-opened information, with an optional weekly summary. Android does not expose every permission’s last use; permission alone is not proof of misuse.
- One phone risk profileNot released
Combines supported findings into one score and clear reasons on Home and consented family summaries. Unavailable checks stay unknown; a low score is not a safety guarantee.
- Selected-file overwrite and deleteNot released
Works only on a document you choose and can report refusal or partial results. Flash storage, provider copies, cloud storage and backups prevent a guaranteed permanent erase.
Coming
01Not built yet. Nothing on this list runs today.
- Play Integrity attestationComing
Hardware-backed integrity verdict.
Android
8 attack families map to this capability
Copied row by row from our engineering register. A family counts as detected only when a rule, a sensor that feeds it and a test that makes it fire all exist.
Feature states above and register statuses measure different things: a feature can be built while the family it addresses stays unobserved, because the register counts sensors and rules, not screens.
| # | Attack family | Status | What the register says |
|---|---|---|---|
| 051 | Keylogging / Clipboard / Screen Capture | Partial | On Android 4.2, apps with accessibility or overlay permission are marked risky on the Scan screen. Permission-based, phone only, not sent to the hub.Repository only |
| 079 | Defense Impairment | Partial | Android Device Admin disable attempts are reported and can trigger an automatic lock. The server-side config-tampering rule exists but nothing feeds it.Production + repository |
| 081 | Cryptojacking | Partial | Known miner process names and pool ports are checked on request on servers; Android 4.2 has a miner/dropper permission pattern. Untested; nothing reaches correlation.Production + repository |
| 082 | Mobile Banking Trojan | Partial | Android 4.2 marks apps with SMS, overlay, accessibility and install-packages permissions as risky. Scan screen only; no runtime overlay detection.Repository only |
| 083 | Malicious APK / Sideloading | Partial | Android 4.2 hashes APK files in storage for a lookup, and the posture score counts the unknown-sources setting. The lookup needs a reputation key; no test.Production + repository |
| 087 | Linux Server Compromise | Partial | The server collector and two fed rules (brute force, lateral movement) cover part of a server compromise. Only the hub agent is verified to send this telemetry.Runs in production |
| 088 | Kernel / Driver Exploit | Partial | rkhunter and chkrootkit can be run on request on Linux servers. No kernel-module or driver telemetry.Runs in production |
| 084 | Mobile Spyware / Stalkerware | Observable | Android 4.2 records microphone, camera, location and contacts permissions per app, but no stalkerware rule uses them.Repository only |
What runs where, and what never leaves
Classification happens on the device before anything is queued. Cloud reporting is off by default on consumer devices and turning it off also stops events already queued.
Runs on the device
- The installed-app list and per-app permission tags
- Battery and storage details
May reach the cloud
- Posture findings and score from an enrolled phone
- Tamper reports (device-admin disable attempts)
- Server metrics, process and service lists, to your console
- Location, only when you trigger locate
Never leaves
- Your files, messages or photos
- Keystrokes, clipboard or screen contents
Editions that include it
Android protection you can install today.
> Android phone owners
One summary for the whole household, without reading anyone's phone.
> Households with supported paired phones
Monitoring and protection for Linux servers, with signed agent updates.
> Anyone running servers
One console for your servers, Android devices and alerts.
> Organisations with 5–250 devices
Each feature above names the platform or edition it runs on. An edition's own page lists the full state of that edition.
What to do if…
Practical steps that work whether or not you use our products.
The posture score shows "root detected"
- 1.If you did not root the phone yourself, back up your data and reset it to factory settings.
- 2.Do not use banking apps on a rooted phone you do not control.
An app you do not recognise has accessibility access
- 1.Settings → Accessibility: turn its access off.
- 2.Uninstall it. If uninstall is blocked, remove its device-admin right first.
- 3.Change your banking passwords from another device.
A server's CPU is pegged and nobody knows why
- 1.Check the top processes and where their binaries live; /tmp and /dev/shm are red flags.
- 2.Run the on-demand crypto-miner check from the console.
- 3.Look for new cron entries and SSH keys before killing anything, so you remove the persistence too.
Limits and known gaps
- GAP-01Play Integrity is not implemented and always reports unknown. There is no on-device malware-app producer, and Play Protect state is not collected, so three scored signals cannot fire from a real phone.
- GAP-02The unknown-sources setting is deprecated from Android 8, so that flag is effectively always off on modern phones.
- GAP-03Risky-app permission tags are on the phone's Scan screen (4.2) only; they are not sent to the hub, and there is no runtime overlay detection.
- GAP-04No automated test covers the posture scoring or the automatic lock/wipe rules.
- GAP-05Miner checks on servers run on request, have no test and do not reach correlation. A known defect makes the security console's ELF check report seven binaries as tampered.
Frequently asked
Why does my score say "unknown" for integrity?
Can the portal wipe my phone?
Do you scan the files on my phone?
Capabilities that work alongside it
Checks a message, payment request or caller against known scam patterns, on the device.
Known-malware scans, automatic protection and fake-app checks on the phone; ransomware warnings on servers.
Wi-Fi and connection awareness on phones; port-scan visibility and firewall control on servers.