Android’s new feature lets you see what happened after a break-in

Google is changing how mobile security works with the new Intrusion Detection feature, which helps you see exactly what happened if someone gains access to your device. This feature is now rolling out to some devices, months after it was first announced, and it could make a big difference for anyone concerned about compromised accounts.

Intrusion logging is a new part of Android’s security tools and is now becoming available on actual devices. Earlier this month, we saw the feature in action for the first time. Now, it’s showing up on devices with Android 16, like the OnePlus Pad 3. A Pixel user on Reddit also reported that the feature is live on their phone with Android 16 QPR2.

Intrusion logging does what its name suggests. When you turn it on, Android keeps a detailed record of activity, so you can check it if you think your device has been compromised.

You’ll find intrusion logging in Android’s Advanced Protection settings. When setting up Device Protection, you can choose to turn it on or skip it. If you enable it, Android records certain types of activity, such as device connections, app installs, times your screen is unlocked, parts of your browsing history, and other security-related events.

Google stores these logs securely with end-to-end encryption, so only you or a trusted Google account can access them. The logs are automatically deleted after 12 months, and you can’t delete them earlier.

After you turn on intrusion logging, Android lets you download the logs to your device. If you see unusual activity, unexpected app installs, or signs of unauthorized access, you can review the data yourself or share it with a security expert.

Intrusion logging won’t matter to everyone, but for journalists, activists, developers, or anyone worried about targeted attacks, this is a big deal. If you’re already on Android 16, it’s worth digging into your security settings to see if intrusion logging has landed on your device.