Live threat detection was one of the standouts when Android 15 was trailed earlier this year. Using on-device AI, the idea is that users will be warned in real time if an app is exhibiting potentially malicious behavior, before it’s flagged across the board by Play Protect.

This active monitoring lets Google Play Protect identify potentially harmful apps that may attempt to conceal malicious behavior or remain inactive for a period before engaging in suspicious activity. The real-time alerts tell users immediately if a harmful app or scam call is detected and let them take action to protect their data and devices.

Google is bringing real-time alerts to Pixel devices that will notify you whenever a dangerous app is detected on your device.

Google can’t really have it both ways—either Play Protect is critical or it isn’t. It’s the default response from Google when new malware strikes, telling users to make sure it’s enabled. That protection falls away if it’s seen as the norm to disable it when an app can’t get through. How then does a user know what is dangerous and what isn’t.