Google wants to lock Android down, but Droynis teaches you how to stay safe instead

Part of the beauty of Android is its openness. It’s one of the many reasons why I would rather snag a Pixel or Galaxy device ahead of an iPhone. I can choose which default apps to employ, where I get them from, how I set up my phone, and even circumvent some restrictions if I’m feeling particularly spicy. A shortcoming of this borderless design is that Android users can often inadvertently set up an environment with potential security issues.

As is so often the case with Android, that particular problem also breeds opportunity, and a new open-source app has jumped in to help Google solve it. It’s called Droynis, and it’s the security auditing tool that should’ve been a part of Android all along.

My new favorite way to scan for Android security issues

It’s worth noting that most Android skins have built-in security checking smarts. Samsung has Alert Center, which provides a rather broad overview of some related items on device. These are normally high-level issues, like account problems and lost device protection, and often disregards subtler vulnerabilities.

This is where Droynis excels. It scans 75 settings and privacy points on its host device, giving each result a score based on how problematic it might be. Once the app is done scanning — notably, it only scans read-only values and only provides a check if a value is provided — it offers an overall security score out of 100 with a list of checks labeled “Passed,” “Needs attention,” “Critical,” or unreadable.

Checks include evaluating the phone’s security patch age, whether the device’s storage is encrypted or not, if root is exposed, if the device is using an open Wi-Fi network, or if it was recently rebooted. These checkpoints are some of the toggles I often forget to review on my own device. More importantly, Droynis explains why these points are important for device security, and it’s this simple, clear communication that Android lacks in its own security breakdowns.

Importantly, Droynis doesn’t give itself authority to change any settings on the device — that’s your job. It only ever highlights the problem. It provides a quote but it’s not the contractor.

When I ran Droynis on my device, it scored a 76/100 — just within the Grade B or “good” score — and highlighted 19 items that I should review. Was I upset that I didn’t score 100? Of course! But a perfect score really isn’t the point. Droynis notes that a flawless report isn’t indicative of a bulletproof device, since it can only scan what Android APIs make available to it.

Scrolling down the app’s dashboard tab, I can easily spot the items that Droynis has categorized and flagged as problematic.

Since I disabled Android’s Advanced Protection, Droynis pointed that out as a potential problem. Tapping the entry provides a detailed explainer about “why it matters” and what I can do to address it. Since I regularly review apps from alternative sources and don’t like my phone questioning how to live my life, I don’t see this as an issue. There’s an option for power users to mute checks like this, too, but for general users, this detailed yet simple explanation of often complex Android security concepts is invaluable.

Droynis did throw up some rather humorous flags, though. For one, it highlighted Gboard as a third-party keyboard app on my device. This isn’t strictly because Droynis sees Gboard itself as a problem but rather that it replaced my Galaxy S24 FE’s built-in keyboard app, Samsung Keyboard. Again, this is an item that many general users probably wouldn’t realize otherwise, and would be infinitely useful if one of their main apps were switched without permission or recognition.

It also helped me quantify just how many apps from beyond the Play Store are installed on my device — 62 out of 250, to be exact. Do I have a problem? I have no idea why you’d even ask this. But again, for those not inherently aware of the potential security pitfalls of installing non-Play Store apps, this would be a valuable wake-up call. Instead of gatekeeping installs from beyond the Play Store like Google so dearly wants to do, Droynis explains why you should think twice about it without restricting users or penalizing developers.

Beyond its scanning abilities, Droynis also provides additional functionality for those troubleshooting or auditing devices. In the Tools tab, you’ll find a built-in network inspector that highlights various connectivity status stubs and readings, a breakdown of which permissions are being used by the apps on the device, and a canvas of security shortcuts that quickly take you to various Android Settings items.

There’s also a useful option to export reports in JSON or Markdown formats. This makes Droynis a great reporting tool for remote troubleshooters, like I so often am for family members around the holidays.

Android security is strengthened through education, not gatekeeping

Droynis might have a creepy app icon and a name that makes me chuckle irrationally when I say it out loud, but it does an incredible job of filling a security education gap that Android leaves wide open.

It’s an auditing tool that regular and power users can employ to suss out any potential issues in their device setup, whether that’s something as trivial as not setting a PIN or password, or more serious flaws like leaving USB debugging running indefinitely. Droynis helps bring these problems to light even if you’re not cognizant of them.

Security is partly about putting up digital fences and backfilling digital gaps, but education around why these actions are important forms a far larger part of this puzzle than many care to realize. Knowing why a particular toggle position is problematic is far more valuable than having a device adjust it for you without any guidance. Droynis’s developer understands this; I wish Google did.