On-device analysis is security detection that runs locally on a phone or tablet, using the device itself to inspect apps, behavior, and risk signals instead of sending everything to the cloud first. The local engine may still share alerts or summaries upstream, but the first judgment happens at the endpoint.
This matters in mobile security because it can reduce latency, work even with weak connectivity, and improve visibility into fast-changing device activity. Defenders use on-device analysis to spot suspicious apps, unsafe network actions, or signs of tampering quickly enough to trigger policy blocks or user warnings. Attackers also care about it: malware may try to hide from local checks, delay malicious behavior, or detect security tooling running on the device. Compared with cloud-only detection, on-device analysis can provide faster response and better privacy, but it may use more battery and depends on the device’s own resources.