Sense · Mobile protection
Phones that refuse what your intelligence already knows.
Two modules. Mobile Endpoint Protection puts a lightweight agent on managed Android devices: it reports the few things that matter on a phone (sideloaded apps, privileged roles, rogue certificates, integrity) and enforces your blocklist on the device. Mobile Notifications puts the decisions that wait for you on your phone, without making it a second console.
Mobile Endpoint Protection · Android
A closed list of what “unusual” means on a phone.
The agent lives in the work profile through Android Enterprise and speaks the same protocol as osquery on your servers, so phones sit in the same endpoint list under the same rules. It reads what an unprivileged app can honestly read, nothing more.
apps
App inventory
Every installed app with its install source (store, MDM, system or sideload) and its APK and signing-certificate hashes.
roles
Privileged roles
Which app holds accessibility, device admin, notification access, screen overlay, default SMS and dialler, keyboard, VPN.
trust anchors
CA certificates
User-installed certificate authorities, the precondition for intercepting the device’s TLS.
posture
Integrity
Root heuristics, bootloader lock, ADB and developer options, security patch level, OS version, Private DNS and VPN state.
Seven mobile rules
Baselined at enrolment, so a new phone is quiet.
Everything already on the phone when it enrols is inventory. Detections are about what changes after, and indicator matches, which are never minted from the phone; an analyst confirms.
Sideloaded app
An app installed from outside a store or your MDM after enrolment. High when its signing certificate is unknown to every other app on the fleet.
Privileged role
An app newly holding accessibility, device admin, default SMS, input method and other roles that let it read or act on the screen. High for accessibility, device admin, default SMS and keyboard.
User-installed CA certificate
A new trust anchor: the first step of intercepting the phone’s traffic.
Integrity
Bootloader unlocked or root detected (High); developer options or ADB switched on (Medium).
Enforcement off
Policy says the phone should be filtering and it is not. Resolves itself when filtering comes back.
Known-bad domain
A lookup on the phone matched a domain indicator; the app that made it is named.
Known-bad APK
An installed app’s APK or signing-certificate hash matched a hash indicator. High at least.
Blocking
Two tiers. The first needs no agent at all.
One tenant-wide policy chooses the mode: monitor (report, block nothing; the default), DNS, or on-device filtering.
tier A · Private DNS
Domains, fleet-wide, no code on the phone.
Your MDM points Android’s Private DNS at a resolver kit loaded with the platform’s DNS RPZ feed, over DNS-over-TLS. A domain confirmed on the platform is refused on every phone within one reload. It blocks domains only, cannot say which app asked, and an app with its own DNS-over-HTTPS can step around it, which is why there is a tier B.
tier B · on-device filter
Domains and addresses, named by app.
The agent runs as the device’s always-on VPN in lockdown and filters locally: a matched lookup gets NXDOMAIN, a connection to a matched address is reset so the app fails fast. The blocklist is refreshed within about 60 seconds. It never intercepts TLS and never inspects URLs; everything that does not match is forwarded untouched.
How a fake banking app is caught
Installed, escalated, matched, refused, confirmed.
01
Installed
A staff member installs a “banking” app from a link in a text message. The agent’s inventory reports it: sideloaded, with its APK and signing-certificate hashes.
02
Escalates
The app asks for the accessibility role, which lets it read the screen and tap for the user. That is a High detection on its own.
03
Matched
Its signing certificate is unknown to every other app on your fleet: High. If its hash is already an indicator, from your own analysis or a sharing group, that matches too.
04
Refused
When it calls home, a domain already on your blocklist is refused: by Private DNS, or on the device by the agent’s filter, which also blocks by address and names the app.
05
Confirmed
An analyst confirms, and the indicator joins the blocklist every phone, firewall and resolver already consume. Phones pick it up within about a minute.
Privacy
Matched, not everything.
A managed phone is still someone’s phone. The agent reports only what matched your intelligence or was blocked; the full browsing and connection history never leaves the device, in any mode, and there is no setting to change that. No location, no contacts, no message or notification content. The work profile is the default, so the operating system itself limits the inventory to work apps. The persistent VPN notification is the disclosure, and it links to a screen listing exactly what is collected.
- rule
- sideloaded app · signer unknown to fleet
- app
- com.bank.secure.update
- also
- privileged role · accessibility
- blocked
- 3 lookups to a domain on the blocklist
- not sent
- other apps’ traffic, location, contacts, messages
Illustrative.
Mobile Notifications
Act, don’t author.
An installable web app of the platform with Web Push implemented in-house: no Apple or Google developer account, no app store. It runs on Android and on iOS 16.4 and later once added to the home screen. A push carries a pointer, never content: the phone wakes up, then reads the decision through the platform like any other client.
- Nothing is proposed from the phone. No response actions, rules, queries, configuration or indicator edits. The phone is for the second human.
- Step-up for the big ones. The six highest-consequence approvals ask for a fresh sign-in if the last one is more than 15 minutes old, on any device.
- A lost phone goes quiet. Signing out, deactivating the user or resetting their MFA deletes their push subscriptions.
- Air-gapped still works. Push needs outbound HTTPS to the browser push services; without it, the app installs and works by polling.
Approve or reject a response action
Four-eyes still applies: the phone never shows you an action you proposed.
Approve or reject a gated playbook run
The playbook’s author and the run’s requester cannot approve it.
Set a phishing verdict
With the reason the reporter will see. Close a report or promote it to a case.
Mark a novelty finding
Noise, known or novel: the review queue from the Deception Fabric.
Move a case
Status, assignee, incident phase with a reason.
Straight answer
What mobile protection does not do.
No iOS agent
Mobile Endpoint Protection is Android. iPhones get Mobile Notifications, not the agent.
No wipe, lock or response on a phone
A phone takes desired-state policy and a blocklist, never a command. Wiping and locking stay with your MDM.
No URL or content inspection
TLS is never intercepted. Blocking is by domain and address.
Not a pager
Web Push cannot break Do Not Disturb. PagerDuty and Opsgenie remain the pager; this is for decisions waiting for you.
Not a store app
The agent is distributed through Android Enterprise and your MDM, not a public store listing. It needs Android 10 or later.
Not process-level EDR
Android does not let one app read another’s processes, files or memory, and the agent does not pretend otherwise.
Enrol a test phone.
Point one managed device at the resolver kit, or install the agent in its work profile, and watch what your intelligence refuses. Both mobile modules are in the Complete package or licensed individually; the number of Android devices is agreed per quote.