Live threat detection was one of the standouts when Android 15 was trailed earlier this year. Using on-device AI, the idea is that users will be warned in real time if an app is exhibiting potentially malicious behavior, before it’s flagged across the board by Play Protect.

Nearly four months later, I don't think I'm being hyperbolic in calling these goals a failure. The Play Store was, in the eyes of many, already racing towards a fundamentally poor place to find and download worthwhile apps and games,

Reports of issues with Google Play have been spiking since late morning. Some users describe problems with updates, while others can’t download apps in the first place. Not everyone appears to be experiencing these errors.

Google can’t really have it both ways—either Play Protect is critical or it isn’t. It’s the default response from Google when new malware strikes, telling users to make sure it’s enabled. That protection falls away if it’s seen as the norm to disable it when an app can’t get through. How then does a user know what is dangerous and what isn’t.

In the world of Android apps, APKs (Android Package Kits) and Google Play Store apps are the two main options for app installation. While the Google Play Store is the default and most convenient way to get apps,

Android Authority reports that code within the Google Play Store APK hints at the possibility of resuming cancelled downloads.

Google will allow users to resume cancelled app downloads after pausing them in case their internet connection is faulty.

Live threat detection analyzes app behavior in real time, examining how apps use sensitive permissions and interact with other apps and services on the device. This active monitoring lets Google Play Protect identify potentially harmful apps that may attempt to conceal malicious behavior or remain inactive for a period before engaging in suspicious activity.

Google is bringing real-time alerts to Pixel devices that will notify you whenever a dangerous app is detected on your device.