Use Lockdown Mode as a hardening step after the initial forensic capture when possible, not as a substitute for investigation. The control reduces attack surface, but it does not prove the device was clean or that related accounts were safe, so identity review and evidence preservation still matter.
What balance should teams strike between lockdown and evidence handling?
For targeted users, the practical balance is to preserve evidence first, then harden. lockdown mode is valuable because it narrows common intrusion paths, but once enabled it can also change device behaviour, disrupt app functions, and complicate later reconstruction of attacker activity. That means the sequence matters: capture what you can before you reduce the attack surface.
The key question is not whether Lockdown Mode is “good” or “bad”, but whether it is being used as a containment step or mistaken for proof of compromise status. A device placed into a stricter mode may be safer going forward, yet still contain artefacts that matter for triage, timeline building, and account impact review.
For targeted users, that distinction is especially important because the device is only one part of the incident picture. Account sessions, cloud tokens, linked devices, and message or browser artefacts may reveal whether the user was actually reached, when access occurred, and what else may need to be contained or reset.
Why evidence preservation comes before hardening
Incident teams should preserve the device state that existed at the point of suspicion, because later hardening can overwrite, delete, or invalidate useful artefacts. If a forensic capture is possible, it should happen before major security changes, including mode changes that alter networking, communications, or telemetry paths.
That does not mean delaying protection indefinitely. If the user is actively targeted and the device is still exposed, containment can be justified quickly. The judgement is to take the least disruptive preservation step available first, then apply harder controls once the evidence baseline has been secured.
In practice, the most useful artefacts are often not just the local device image but the surrounding identity and access record: recent logins, session tokens, OAuth grants, recovery activity, mail forwarding rules, and any linked services that could let an attacker persist after the device is locked down.
How to avoid treating Lockdown Mode as a clean bill of health
Lockdown Mode reduces exposure, but it does not answer the forensic question of whether the device was already compromised or whether adjacent accounts were abused. A targeted user may still have had data exfiltrated, sessions stolen, or secondary access paths established before the control was enabled.
That is why identity review belongs in the same incident workflow. If the user’s account, password reset path, mailbox, cloud session, or management profile was touched, the response has to cover more than the device itself. The hardening step is only one containment layer, not the full investigation.
Teams should also remember that enabling a restrictive mode can change what analysts can observe afterward. Some communications, exploits, or persistence mechanisms may fail once the device is hardened, but that can make it harder to confirm exactly what happened if capture was not done first.
Risk and Threat Considerations
Targeted users face a real trade-off between immediate containment and preserving the conditions needed to understand the intrusion. If hardening is applied too early, organisations can lose the artefacts needed to prove initial access, scope lateral account exposure, or identify whether the attack moved beyond the device.
Failure mechanism: The device is secured before the relevant evidence is captured, which can truncate logs, interrupt attacker activity in ways that obscure timeline reconstruction, and leave the team unable to distinguish attempted compromise from successful account abuse.
Impact: Response actions may become incomplete or misdirected, with missed resets, missed session revocations, or a false assumption that the user is safe simply because the device is now harder to attack.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AU-6 — Audit Review, Analysis, and Reporting | Supports preserving and reviewing incident evidence before hardening. |
| IR-4 — Incident Handling | Directly applies to containment decisions during targeted-user incidents. | |
| IA-5 — Authenticator Management | Applies because targeted-user incidents often require session and credential review. | |
| Recommendation — Review available logs and timelines before changing controls that may obscure evidence. Coordinate containment with preservation steps so response actions do not destroy needed evidence. Rotate or revoke exposed credentials and sessions when compromise is plausible. | ||
| CIS Controls v8 | CIS-17 — Incident Response Management | Covers preserving evidence while controlling and documenting incident response actions. |
| Recommendation — Preserve evidence and document containment actions before full remediation. | ||
| OWASP Non-Human Identity Top 10 | NHI-02 — Secret Leakage | Targeted-user incidents often involve stolen tokens or secrets beyond the endpoint. |
| Recommendation — Check for leaked tokens and rotate any secrets that could still authenticate. | ||
Practitioner Guidance
What to prioritise: Capture the highest-value volatile and account-linked evidence first, then move to Lockdown Mode if the situation allows. If the user is high-risk or under active targeting, decide quickly whether the preservation value outweighs the delay in containment.
What to verify: Confirm whether identity artefacts were reviewed alongside the device, especially active sessions, recovery channels, and linked services. If those were not checked, the response is not complete even if the endpoint is now hardened.
Decision rule: If you must choose, preserve evidence before you harden; if delay increases exposure materially, harden immediately but record that the forensic picture may be incomplete.
Practitioner takeaway: Use Lockdown Mode to reduce future risk, not to rewrite the incident timeline. The response is strongest when containment and preservation are both deliberate, with identity impact reviewed as part of the same case.
Related resources from NHI Mgmt Group
- How should organisations balance Lockdown Mode, app restrictions, and user education for mobile spyware risk?
- How do organisations operationalise NHI ownership at scale?
- When should organisations treat an NHI as a high-priority risk?
- How can organisations reduce the blast radius of compromised agent identities?