Thread Info
Options
Suggested

Intercept X on Android: engine not updating when set to "only in Wi-Fi"

Stephan Schaller

Hello,

I installed intercept X a week ago and i really appreciate that there is a security app that is free of charge and ad-free.

There is one issue that is bothering me: i set the engine update to "only in Wi-Fi" and this seems to cause the engine to never be updated automatically. I am connected to Wi-Fi every day most of the time, but still, every 2nd day i get a security warning that the engine data is outdated, so i update it manually. This is very annoying, especially when i am in Wi-Fi at the same moment the warning appears. Why can't the app just do the update instead of showing the warning?

Is it a bug that will be fixed in the future?

Thank you!



Added Tags
[edited by: GlennSen at 12:04 PM (GMT -7) on 3 Jun 2025]
  • 0

    Thank you for reaching out to the community forum. 

    The update mode on the Intercept X mobile free version is working as it's designed. It does not have any function to automatically install the update when it's available. It only allows you to choose which mode of update you wish to use if an update is ever available. This feature is only applicable on the full license of Intercept X mobile. 

    To install the latest update on the free version, a manual user intervention is required

    Glenn ArchieSeñas (GlennSen)
    Global Community Support Engineer

    The New Home of Sophos Support Videos!  - Visit Sophos Techvids
    • 0 in reply to GlennSen

      Hello Glenn,

      Thank you for your reply! I think you are not correct about the fact that user interaction is always required to update the engine data. I remember that it updated automatically in the background before i set it to "only in Wi-Fi".

      I just double-checked it right now: i checked the last updated time, it was yesterday. Then i set it back to "always allowed" and closed the app without doing a manual update. 15 minutes later, i opened the app again to see the time of the last engine update and it was 3 minutes ago. It did update on its own in the background without any user interaction while it was set to "always allowed".

      • +1 in reply to Stephan Schaller

        Hello  

        We appreciate you reaching out to the Sophos Community Forum.

        Thank you so much for the information. Please refer to this information if it helps you.

        The update mode is set to "always allowed," so Sophos Intercept X for mobile (even in the free version) can update the engine data automatically in the background without requiring user interaction.

        Update mode: This setting defines the data connection Sophos Intercept X for Mobile uses to download updates of the virus detection data.

        • The key difference is in the update mode setting:
        • Always allowed: The app is permitted to check for and install updates automatically, regardless of the network connection (Wi-Fi or mobile data), as long as background data and battery optimization settings allow it.
        • Only in Wi-Fi: The app restricts updates to Wi-Fi connections only. However, in some cases, the app may not immediately recognize that it’s connected to a Wi-Fi network or background update triggers may be less frequent or more conservative to save resources. This can result in delayed updates or the need for manual intervention, especially if the app wasn’t running in the foreground when Wi-Fi became available.
        • If you want the most seamless automatic updates, "always allowed" is the best setting. If you prefer to restrict updates to Wi-Fi for data usage reasons, just be aware that updates might not always happen instantly and could sometimes require opening the app or waiting for the next scheduled background check.

        Let me know if you need any further help. 

        Regards, 

        Regards, 
        Rutvik Chavda
        Global Digital Endpoint Security Engineer
        If a post solves your question, please use the "Verify Answer" button.

        The New Home of Sophos Support Videos!  - Visit Sophos Techvids
        • 0 in reply to Rutvik Chavda

          Hello Rutvik,

          Thank you very much for this detailed and competent answer!

          Maybe it would be worth reconsidering if the current behavior is optimal? If Wi-Fi only causes lots of "engine out of date" warnings for people who have Wi-Fi at home but not at work, it is annoying. And usually, Wi-Fi is where the electricity is so it would even make more sense the other way round: save resources when on mobile data.

          I have found a workaround that I'm currently testing and seems to work: I have the app "Rethink DNS" which is a DNS filter and firewall. I set it to block Intercept X from using mobile data, only allowing Wi-Fi. In Intercept X, i set the updates to always allowed. This is fine for me because scanning for malware is the only feature of Intercept X that i use but it might break other features while on mobile data.

          • 0 in reply to Stephan Schaller

            Hello Stephan, 

            Thank you for your kind words and for sharing your experience and workaround with the community!

            I will make sure to pass your feedback and suggestions about the updated behaviour to our product team for their consideration. Improving the user experience for different network scenarios is always valuable input.

            Please let us know if you have any further suggestions or encounter any workarounds. Your insights help us improve Sophos Intercept X for Mobile for everyone!

            Thank you again for your engagement and contribution to the community.

            Regards, 

            Regards, 
            Rutvik Chavda
            Global Digital Endpoint Security Engineer
            If a post solves your question, please use the "Verify Answer" button.

            The New Home of Sophos Support Videos!  - Visit Sophos Techvids
            • 0 in reply to Stephan Schaller

              I have tested my workaround for quite some time now, and while it does work, it has a major drawback: when the firewall app blocks Intercept X from updating, it retries to update every 5 seconds. I saw this in the firewall log. This causes excessive battery usage.

              • 0 in reply to Stephan Schaller

                Hello  

                You’ve identified a significant drawback of using a firewall to block Intercept X’s mobile data access: the app’s persistent retry behaviour can cause excessive battery drain. This is because Intercept X is designed to keep its threat intelligence up to date and will attempt to connect to update servers at regular intervals if it can’t complete an update. When blocked, these rapid retries can add up, impacting battery life.

                Currently, Intercept X’s built-in “Only in Wi-Fi” update setting is intended to help users manage data and battery usage. As you’ve seen, it may not always trigger updates as quickly as users expect. Improvements in update scheduling and network detection could enhance the user experience, especially for those who frequently use Wi-Fi but occasionally see update warnings.

                Your feedback is highly valuable. I will share your observations, including the battery drain issue with firewall workarounds, with our product team for further consideration. In the meantime, we recommend using the app’s native update settings and avoiding third-party firewalls to block network access, which can lead to unintended side effects.

                Let me know if you need any further help. 

                Regards, 

                Regards, 
                Rutvik Chavda
                Global Digital Endpoint Security Engineer
                If a post solves your question, please use the "Verify Answer" button.

                The New Home of Sophos Support Videos!  - Visit Sophos Techvids
                • 0 in reply to Rutvik Chavda

                  Hi Rutvik,

                  Thank you for your reply again. Blocking Intercept X using a firewall app is a very special use case, but maybe the battery drain would also appear in a more common case, for example when the user is out of range of any network, so it might be a good idea to make the retry interval longer.

                  I would be happy if a future release of Intercept X could update the engine data automatically in background when set to only in WiFi.

                  For my part, I am not blocking it by firewall anymore, I set it back to WiFi only and do the manual update every time the warning appears (every 2nd day).

                  My concern was mainly about recommending Intercept X to inexperienced (elderly) users with a very small data plan. I would only recommend it if Intercept X stayed invisible and worked quietly in the background unless there is an actual threat. Having regular warnings about outdated engine data and having to perform the updates manually is unfortunately not a comfortable user experience, leading to questions like "can you please remove that thing that keep popping up again and again?"

                  BR
                  Stephan