Google has shipped Intrusion Logging as part of Android’s Advanced Protection Mode, a capability that stores end-to-end encrypted forensic logs on remote servers, outside the reach of spyware that has already compromised the device. Co-developed with Amnesty International and Reporters Without Borders, the feature directly addresses the forensic destruction problem that has historically allowed commercial spyware operators, including NSO Group and Paragon Solutions, to evade post-incident attribution. Paired with expanded live threat detection, banking call verification, and announced post-quantum cryptography improvements, this update signals that mobile device security is maturing from reactive patching toward proactive forensic resilience, a shift with direct implications for enterprise mobile programs and high-risk user protection policies.