Sophos Intercept X for Mobile Review: Android Strength, iPhone Limits

Two platform verdicts, not one mobile-antivirus score

The Android score rewards current independent detection evidence, practical extra layers and honest zero-dollar value. It is not a claim that the app closes every Android attack path. Browser coverage, Accessibility reliability, app-lock bypasses and Wi-Fi limits remain real, and the app does not protect an account after a user willingly gives away a password or one-time code.

The iPhone score judges the unmanaged personal app, not Apple's platform security and not Sophos Mobile for business. The tools work, but they are optional helpers rather than an antivirus engine. Calling this edition “bad antivirus” would be as confused as calling a password manager a bad firewall; the correct question is whether you need its exact toolbox.

What Sophos Intercept X for Mobile is—and is not

Intercept X for Mobile is a separate free application published by Sophos Limited for Android and iOS. It is not the phone version of Sophos Home and has no paid consumer tier hidden behind the first scan. The Sophos Home customer guide says Premium customers receive support eligibility, not extra phone features.

On Android, “mobile security” is fair because the app can examine installed applications and APK packages. Apple does not allow a normal iOS app to crawl through other apps, so Sophos provides device checks, Wi-Fi diagnostics, a secure QR reader, an authenticator and a KeePass-compatible safe instead.

This page covers only the unmanaged consumer application. Mobile-device management, Intune integration, Central policies and supervised devices belong to business licensing and would distort a free-app review.

Sophos Home, unmanaged mobile and business Mobile are separate

Sophos Home protects Windows and Mac computers and is controlled through a household web dashboard. Its seats count computers, not the free phone app. The main Sophos Home review covers that product, while our dashboard and license guide explains why a phone never appears in the Home device list.

Intercept X for Mobile unmanaged is the locally configured app reviewed here. A parent cannot silently push its settings from the Home console, and deleting a Home computer has no effect on the phone. Backup, export and migration of authenticator or password data also remain the phone owner's responsibility.

Sophos Mobile or Central managed mode is for organizations. It can apply policies, use supervised iOS capabilities and connect to business management systems. If a work phone says it is managed, do not follow consumer advice to remove permissions or profiles; ask the administrator who owns the policy.

Current store facts show two different release stories

The Google Play listing checked on August 5, 2026 showed 4.0 stars from about 47.6K reviews, more than 1M downloads and an update date of May 21, 2026. Those figures are a dated store snapshot, not a stable quality score. The page labels the app free, suitable for Everyone and without advertising.

The UK App Store listing showed version 9.7.13, updated May 21, 2025, requiring iOS or iPadOS 15.0 or later and occupying 117.5 MB. Its 4.4 rating came from only 92 regional ratings at the check. We attach the country and date because another storefront can show a different count or score.

The year difference matters. A support page refreshed in 2026 does not prove the iOS binary received a 2026 feature release. Conversely, an older version date does not by itself prove abandonment while the product remains listed and Sophos publishes current known-issue material. Treat it as a maintenance signal to recheck before relying on Authenticator or Password Safe for years.

Android, personal iPhone and managed business feature matrix

The matrix is intentionally conservative. It reports what the current consumer stores and Sophos documentation support, not everything a Sophos-branded enterprise product can do. That boundary also prevents a personal iPhone user from wasting time looking for a scan or web switch that only appears in managed instructions.

Android earned a current 18/18 from AV-TEST

AV-TEST's May 2026 Android result evaluated Sophos Intercept X for Mobile 9.7 on Android 15. It detected 99.9% of the latest real-time Android malware set and 99.8% of widespread malware from the previous four weeks. The displayed industry averages were 99.9% and 99.9%, so Sophos matched one and trailed the other by one tenth of a percentage point.

The lab awarded 6/6 for protection, 6/6 for performance and 6/6 for usability: 18/18 overall. It reported no measured battery-life impact, normal-use slowdown or excessive traffic in its performance checks, and zero false warnings across the legitimate Google Play and third-party-store app sets it tested. January and March 2026 also ended at 18/18.

That is strong evidence, but keep its scope intact. It covers the tested Android build, operating system, samples and lab method. It does not test phishing judgment, every browser, every future signature, App Protection bypass resistance or any iPhone scanning. We use the exact 99.9% and 99.8% values instead of repeating Google Play's rounded “consistently 100%” marketing line.

The Android scanner checks apps, APKs and optional storage

Sophos scans applications during installation and can run manual or scheduled checks. Settings can include system apps, SD-card content and connected USB storage where Android exposes it. The engine looks for malware, potentially unwanted applications and low-reputation apps, using cloud lookup plus an on-device component for some offline protection.

An APK received outside Google Play can be sent to Sophos through Android's Share action before installation. This is useful when a legitimate developer distributes directly, but it does not make an unknown package safe. Verify the publisher, signature, download origin and reason for sideloading; a clean result is one observation, not permission to ignore a suspicious source.

The daily-while-charging schedule waits until the phone has been connected to power for more than 30 minutes. That is a sensible compromise for battery and heat, especially on a large app library. We would use real-time install checks, keep Play Protect on and schedule periodic coverage rather than run repeated full scans after every harmless notification.

Web Filtering works through a powerful Android permission

Android Web Filtering depends on Accessibility Service access. Sophos says the feature observes addresses opened in supported browsers, sends the URL to SophosLabs for classification and does not store browsing history. The permission is technically connected to the job, but Accessibility can observe and interact with sensitive screen content, so confirm the publisher and do not approve a look-alike prompt from a browser page.

Current known issues name Chrome, Firefox, Edge and the old native Android browser. That is not the same as every browser or every embedded webview. If an important banking, messaging or social app opens links internally, test a known safe classification page and a benign blocked category rather than assuming the Sophos layer sees it.

Android may disable Accessibility after an update or under vendor battery-management rules. Sophos can prompt for re-enablement, but a persistent notification is not proof that filtering is active. Check the feature status after operating-system upgrades, app updates and aggressive “optimizer” changes, especially on phones that routinely stop background services.

Link Checker and the secure QR reader cover different entry points

Link Checker can inspect a URL opened from a non-browser app when Sophos is selected as the handler. This is useful for links arriving through mail, chat or a document where browser-only filtering might begin too late. It still evaluates the destination, not the honesty of the sender, and a clean domain can host a convincing request for a password or payment.

The QR reader decodes URL, contact and Wi-Fi codes and applies checks before handing off. Use it instead of a camera's blind auto-open behavior when a sticker could have been replaced. A QR result that contains a shortened URL, unexpected login, cryptocurrency address or configuration profile deserves independent verification even if reputation systems have not flagged it.

Neither tool validates a person's identity. When a message claims to come from a bank, employer or delivery service, leave the supplied route and open the known app or type the saved official address. Sophos can reduce known malicious destinations; it cannot make social pressure, a newly registered domain or an authorized payment harmless.

App Protection is a convenience lock, not a secure container

On Android, App Protection can require a PIN, password, pattern or optional fingerprint before selected apps open. It can be helpful on a shared family phone or when a child sometimes uses the device. Device Administrator permission supports the control and makes casual removal harder, so record the chosen credential and understand how to disable the feature before uninstalling.

Sophos documents important bypasses. Other apps and system functions can still interact with a protected app; split-screen, floating and tiny windows can bypass the normal gate; Samsung pop-up view is unsupported; Xiaomi needs an extra background-popup permission. These are not theoretical footnotes when banking, messaging or password apps are the reason for enabling the lock.

Use the phone's screen lock, short auto-lock timeout, biometric protections and app-specific security as the primary boundary. App Protection adds friction for direct taps, but it does not encrypt another app's data or create a work profile. For strong separation, use Android's supported profile or enterprise container features rather than treating a launcher gate as isolation.

Wi-Fi Security is useful, but a green network is not certified safe

Wi-Fi Security checks network and certificate conditions that can reveal captive portals or suspicious content manipulation. On Android, Sophos requests location permission to obtain the connected network name or SSID and says it does not use that access to track location. Modern Android's permission label can sound broader than the specific technical reason, which is why the in-app explanation matters.

Platform restrictions remove one familiar test. Sophos says ARP-spoofing detection is unavailable on Android 10 or later and iOS 10.3 or later. That means the absence of a warning cannot rule out every local interception method. HTTPS certificate validation, application encryption and cautious behavior on an unknown network still carry the security load.

For a sensitive transaction, use the known mobile app, confirm the expected domain and keep the operating system current. A trustworthy VPN can reduce exposure to the local network, but Sophos Intercept X for Mobile does not include a consumer VPN. Avoid turning “public Wi-Fi” into a magic danger label or “home Wi-Fi” into automatic trust; account compromise and malicious sites work on either.

Privacy Advisor and Security Advisor turn settings into a checklist

Android's Privacy Advisor groups applications by the permissions they can use, while Security Advisor highlights important device settings. These views are most useful as prompts for a monthly review: remove apps you no longer need, revoke camera, microphone, contact or location access that no longer matches a feature, and keep installation from unknown sources off when sideloading is finished.

A permission is not proof of abuse. A navigation app can reasonably need location, a camera needs the camera, and an authenticator may request camera access to scan setup codes. Judge the combination of publisher, function, timing and background behavior. Uninstalling a dubious app is safer than repeatedly granting and revoking permissions while continuing to trust it with an account.

The advisor cannot see what happens on a vendor's server after legitimate data leaves the phone. Review account settings, cloud history, marketing consent and deletion options separately. For a broader Android shortlist, our best Android antivirus guide compares products without pretending an on-device permission screen is a complete privacy audit.

Authenticator and Password Safe are capable, but migration matters

Sophos Authenticator generates standard TOTP RFC 6238 and HOTP RFC 4226 codes. That makes it compatible with many services that display a generic authenticator QR code. Before adding the account, save the service's recovery codes somewhere separate and, where possible, register another factor such as a hardware security key or a passkey.

Deleting an entry from the phone does not disable MFA at the service. The server will continue asking for a code, and without a backup factor the user can be locked out. Test exports, backups and device migration before the old phone is wiped. A security app that works perfectly today can still become a single point of failure if its seeds exist on one device only.

On iOS, Password Safe supports KeePass KDBX 3 or earlier databases and can combine a master password with a key file. That is useful for an existing compatible vault, but it is not the same as a modern synchronized password-manager service. Keep an encrypted backup, know where the key file lives and verify that another maintained KeePass-compatible client can open the database before depending on it.

Lab performance was clean; notifications are the bigger daily cost

AV-TEST's May 2026 checks found no measurable battery-life penalty, normal-use slowdown or excessive traffic for the tested Android build. It does not reproduce every phone vendor's background rules or a huge SD card, so measure battery history after a normal week rather than judging the first indexing day.

Google Play reviews praise the breadth and App Protection while criticizing persistent scan or protection notifications. Sophos documents that clean-app scan notifications can be disabled while threat alerts remain. Keep security warnings visible, but turn off success noise if it trains you to dismiss everything.

Current mobile-security discussion often recommends the Android app as a rare free, ad-free option, while iPhone threads expose confusion about the missing scan button. These are directional user-experience signals only; community posts cannot replace current lab results or platform documentation.

Current Android known issues change how several features should be used

Web Filtering's browser list is limited, and Android can turn off Accessibility on some devices or after updates. App Protection cannot securely block every system or cross-app route, with explicit split-screen, floating-window and vendor-mode exceptions. Wi-Fi Security cannot detect ARP spoofing on Android 10 or later, so each of those features needs a narrower promise than its label suggests.

Storage coverage also has edges. On Android 6 or later, continuous SD monitoring may not see every file copied from a computer over USB. Android backup may fail to restore Sophos settings on some devices, so a replacement phone should be checked as a fresh installation rather than assumed protected because the app icon returned.

Sophos also notes that Gmail can omit a support-log attachment on some Android devices or versions. If support receives an empty message, use another mail application and inspect the attachment before sending. Logs can contain device and diagnostic details, so send them only through the official support route and remove unrelated private material where the workflow allows.

What the personal iPhone app can genuinely do

Device Security reports the model and iOS version, recommends updates and checks for signs of jailbreaking. Wi-Fi Security looks for selected network and content-manipulation problems. The secure QR reader helps inspect codes before opening them, while Authenticator and Password Safe provide the same standards-based MFA and compatible KeePass functions discussed above.

That bundle can be convenient for a person who wants several offline-oriented tools in one free app. It can also be redundant. iOS already exposes software updates and many Wi-Fi facts; Apple's Passwords app and numerous dedicated authenticators handle credentials; the Camera app reads QR codes. Install Sophos for a specific workflow, not because an iPhone needs a green antivirus shield to be complete.

The App Store listing says Web Filtering is available on supervised devices in managed mode. That is a business deployment condition, not a hidden switch for a personal phone. If an employer manages the device, its administrator may activate supported controls; the user should not install or remove profiles merely to imitate the feature on an unmanaged phone.

Why the iPhone edition cannot scan other apps

Apple's app-security architecture places third-party apps in sandboxes and restricts access to files stored by other apps. Explicit system services can share selected information, but a consumer antivirus cannot walk through every installed application's executable and private data as an Android scanner can.

There is therefore no honest “full iPhone virus scan” button for Sophos to expose. A screen that pretended to scan the whole device would mostly animate checks it cannot perform. The useful defenses live elsewhere: current iOS updates, App Store review and code signing, Lockdown Mode for unusually targeted users, safe account recovery, passkeys or strong MFA and prompt response to suspicious profiles or calendar subscriptions.

Sophos also does not turn the personal iPhone into a managed endpoint, remote-wipe console or full web gateway. Apple's Find My handles device location and remote erase, while organization policy requires an MDM relationship. Our iPhone security guide ranks tools by the jobs iOS actually permits rather than awarding points for imaginary scanning.

The iOS privacy label and current crash deserve attention

Apple's store privacy label says Browsing History may be collected and linked to identity for app functionality, while Usage Data and Diagnostics may be collected without linkage. This is a developer-supplied disclosure that Apple says it has not verified. It is useful for identifying data categories, but it is not an independent audit of retention, access controls or every server-side purpose.

Current Sophos known issues identify an occasional navigation crash in iOS version 9.7.13. Sophos says functionality is unaffected, a fix is planned and there is no workaround. If Authenticator or Password Safe is the main reason for installation, that combination of a May 2025 store update and an unresolved interface crash strengthens the case for tested recovery data and an alternate compatible client.

The privacy decision is not simply “Sophos collects browsing history.” Personal unmanaged iOS lacks the broad managed Web Filtering feature, while specific URL and QR checks still need enough information to classify a destination. Review the live store label in your country, the requested permissions and the exact feature you enable; do not infer more or less collection than the evidence supports.

Keep Google Play Protect and Apple's built-in defenses enabled

Google Play Protect checks Play Store, installed and sideloaded apps and can warn, disable or remove harmful software. Sophos adds another engine and extra tools. Neither layer justifies untrusted APKs or disabling the other to silence a warning.

On iPhone, code signing, sandboxing, updates and App Store controls are the baseline. Sophos cannot replace them. Jailbreaking removes important boundaries; restore a normal personal phone to supported stock iOS rather than seeking an “antivirus” that makes the jailbreak safe.

Both platforms still depend on account security. Stolen sessions, approved push prompts, reused passwords and fraudulent support calls can bypass a clean scan. Use unique credentials, strong MFA, protected recovery email and a separate channel to verify urgent requests.

Our permission and privacy judgment

The Android app needs meaningful access to do meaningful work: Accessibility for web classification, Device Administrator for App Protection and location permission for the Wi-Fi network name. Those requests are not automatically abusive, but they expand the consequences of a compromised update or look-alike package. Install only from Google Play or Sophos' current official route and verify the developer as Sophos Limited.

Google Play's developer disclosure says the app shares no data with third parties, may collect app activity, web browsing, app information and performance, encrypts data in transit and currently marks data as not deletable through the store mechanism. Treat those as vendor/store statements, not an external privacy certification. “No third-party sharing” also does not mean “no collection” or “no service provider.”

Use least privilege by feature. If you do not want Web Filtering, do not leave Accessibility enabled merely because the setup checklist asks. If App Protection adds no value, remove its administrator role before uninstalling. Recheck permissions after major updates and read explanations inside the installed version, because Android labels and Sophos implementation details can change.

Who should install it, and which alternatives fit better

Android users can compare our current ESET Mobile Security review, AVG Android review and Kaspersky Android review. Availability, lab participation and free-tier limits differ, so choose the exact build offered in your country.

Sophos best fits an Android owner who values a free scanner and will configure permissions deliberately. It is a poor fit for someone who wants a silent app, uses an unsupported browser or expects App Protection to create a secure container. On iPhone, choose it only when its Wi-Fi, QR, MFA or KeePass tools beat your dedicated alternatives.

Home Premium support may help with the unmanaged app, but the phone remains local and outside the Home dashboard. That separation suits privacy-conscious users and disappoints parents expecting remote control.

Final verdict: excellent free Android security, optional iPhone tools

Sophos Intercept X for Mobile earns a strong Android recommendation. Version 9.7 achieved 18/18 in AV-TEST's May 2026 Android 15 evaluation, the scanner covers apps and APKs, and the free app adds web, link, app-lock, Wi-Fi and advisor tools without advertising. Our 8.8/10 reflects that evidence and value while reserving points for permission complexity and documented feature gaps.

The personal iPhone edition is a different proposition. It cannot scan other applications, and the App Store reserves Web Filtering for supervised managed devices. Device checks, Wi-Fi diagnostics, secure QR reading, TOTP/HOTP codes and a KeePass-compatible safe can be useful, but they do not create antivirus protection. We rate that unmanaged toolbox 5.8/10: competent at its permitted jobs, easy to misunderstand and less compelling when dedicated tools are already installed.

The clean buying decision is simple. Keep built-in platform defenses active, install Sophos on Android when you want its real scanner and extra controls, and install it on iPhone only when you can name the helper feature you need. Do not pay for Sophos Home expecting mobile upgrades, and do not borrow business-management claims for a personal phone.