com.samsung.android.knox.zt.framework Copy

Labelled "KnoxZT Framework" on the device, this is a Samsung Knox component of around 20 MB, signed by a Samsung OEM key that also signs the Android framework, and it has no launcher icon. The name matches Samsung's Knox Zero Trust Framework, the enterprise feature set Samsung documents under its Knox mobile security whitepaper; Samsung's documentation does not name this package, so that mapping is inferred here from the package name and label rather than taken from a Samsung statement. Samsung describes the Knox Zero Trust Framework as requiring an EMM or UEM and as building on Android 14 to provide advanced security capabilities. Its documented parts include the Knox Security Log, an on-device database held in an isolated Linux domain outside the main operating system and reachable only through the Knox framework, which gathers security signals for threat detection with privacy filters applied to redact sensitive user data, and Knox Suspicious URL Detection, which uses on-device machine learning to spot phishing links. Samsung documents the Knox Security Log as available only for fully managed company-owned devices enrolled in Knox Asset Intelligence, and documents Knox Suspicious URL Detection as enabled and configured for devices using Knox Asset Intelligence as part of Knox Security Logs, so those capabilities are realised through that service rather than on a standalone device. For Android Enterprise, EMM and kiosk deployments this is enterprise security telemetry rather than bloatware. If you use Knox Asset Intelligence or a UEM that consumes Knox security signals, disabling this component risks silently removing the detection you are paying for, so treat it as caution. On a device with no EMM and no Knox Asset Intelligence subscription there should be less for it to do, but Samsung does not document what it does in that state, so do not assume it is inert. Version note: Samsung ties the framework to Android 14 and states that the Knox Security Log is supported on devices running Android 15 or later, so what this component contributes depends on the Android version of the device. Samsung's page does not name the Knox or One UI release that introduced the framework, and on this site the package is recorded only with target SDKs 34 to 36 (Android 14 to 16), which is consistent with a recent addition but is not a substitute for a documented introduction date.

• Knox Zero Trust Framework - Samsung Knox mobile security whitepaper, Samsung Knox Documentation →
• Zero Trust - Samsung Knox mobile security whitepaper, Samsung Knox Documentation →
• Package provenance for com.samsung.android.knox.zt.framework - Android System App Database →

• Signed by the device maker's own signing key (Samsung), so it is an OEM preinstall, and that single certificate is consistent across all 18 device profiles. It also signs the Android framework, so it is a platform-level key on its device(s). Inferred from the certificate appearing only on Samsung devices (508 packages, 10196 observations).
• Its largest observed manifest declares 16 permissions: 2 runtime (user-granted), 6 signature or system-level, 1 install-time and 7 vendor or uncatalogued.
• Never reported as user-facing, so it runs as a background or system component rather than an app the user opens.