com.samsung.android.sm.devicesecurity Copy

Samsung's on-device app scanning component, made by Samsung and signed by its platform key. It has no launcher icon of its own and is reached through Settings. Samsung documents the user-facing feature as "App protection", which "checks apps installed for malicious activity" and is switched on as part of the Maximum restrictions option inside Auto Blocker, at Settings, Security and privacy, Auto Blocker. Samsung's separate Device care support page describes the malware scan on Galaxy devices as being provided in partnership with McAfee; whether that engine ships inside this particular APK is not documented, though the size recorded here, from roughly 21 MB to 42 MB, is unusually large for a settings component and would be consistent with a bundled scanning engine. The permissions this site records are those of a scanner that can act on what it finds: it declares the ability to delete packages, force-stop packages, act as a package verification agent and query all installed packages, alongside Samsung's own scan, threat-notification and Knox attestation permissions. Those are declared capabilities rather than observed behaviour, but they are the part worth knowing in an Android Enterprise, EMM or kiosk deployment: if a management agent, launcher or line-of-business app is flagged, stopped or removed on Galaxy hardware, this component is one place to check before assuming an EMM fault. The cited sources do not say that privately distributed or sideloaded apps are treated differently from any other installed app, so no such claim is made here. Auto Blocker's wider restrictions on installing from unauthorised sources are a separate matter and are covered elsewhere on this site. Disabling it removes that scanning rather than fixing a specific problem, so it is treated as caution rather than as a routine debloat target. Reviewing the Auto Blocker options in Settings is the better first step, and any change is worth testing on a single device. Version note: what this package is called has changed. Devices in the current sample mostly report it as "App protection", while others, and Samsung's own 2021 application list for the Galaxy S21+ on Android 11, report it as "Device security". Samsung's support page attributes Maximum restrictions, which is where App protection now sits, to One UI 6.1.1, so on older builds the same package is best read under the older name and reached from a different place in Settings. Its versions here run from 8.0.09 to 10.0.03 across API 28 to API 37.

• Protect your Galaxy device with the Auto Blocker feature - Samsung UK →
• What is Device Care and how do I use it? - Samsung UK →
• Galaxy S21+ 5G (G996N) Application List - Samsung Knox CC Mode documentation →
• Package provenance for com.samsung.android.sm.devicesecurity - Android System App Database →

• Signed by the device maker's own signing key (Samsung), so it is an OEM preinstall, but 2 different certificates appear across the fleet, so OEMs ship their own builds of it. It also signs the Android framework, so it is a platform-level key on its device(s). Inferred from the certificate appearing only on Samsung devices (508 packages, 10196 observations).
• Its largest observed manifest declares 36 permissions: 1 runtime (user-granted), 13 signature or system-level, 8 install-time and 14 vendor or uncatalogued.
• APK size ranges from 20.2 MB to 40.5 MB across the reporting device profiles, so the build differs substantially between them.
• Reported as an updated system app on 4 of 19 profiles - a newer build is installed over the one in the system image there.