Apple Lockdown Mode is the setting Apple built to shrink the attack surface that highly targeted mercenary spyware, such as NSO Group's Pegasus, aims at through messaging and web content, for the few people likely to be targeted. This guide explains exactly what Lockdown Mode blocks on iPhone, iPad, Mac and Apple Watch, what it breaks in daily use, who in an organisation should turn it on, how it interacts with MDM, and how to roll it out and support it. Facts on features come from Apple's own support documentation, checked on 8 November 2026; Apple changes the feature between releases, so re-check before relying on a detail. It is for security teams running an executive or high-risk user programme, and for IT teams who will be asked to support those devices. For the wider threat, read the Commercial Spyware Guide.
This is an independent guide from NHI Mgmt Group, based on Apple's public documentation as of November 2026. It is not sponsored or reviewed by Apple. Product features change, so confirm settings against Apple's current documentation.
Key takeaways
- It is an extreme, optional protection. Apple describes Lockdown Mode as being for the very small number of users who face grave, targeted threats, not as a default for everyone.
- It works by removing features. Most message attachments, link previews, complex web technologies, unsolicited FaceTime calls and invitations, shared albums, 2G and 3G, and wired connections to a locked device are blocked or limited.
- It has stopped real attacks. Citizen Lab reported in September 2023 that Apple confirmed Lockdown Mode blocks the BLASTPASS zero-click exploit chain used to deliver Pegasus.
- Administrators cannot switch it on. The user enables it per device; once on, the device cannot install configuration profiles or enrol in MDM, so enrol first.
- Exceptions weaken it. Websites, apps and, from the 27 releases, contacts can be excluded; each exclusion reopens part of the attack surface.
What Lockdown Mode blocks
Apple introduced Lockdown Mode on 6 July 2022 for iOS 16, iPadOS 16 and macOS Ventura, describing it as hardening device defences and strictly limiting certain functions to reduce the attack surface that highly targeted mercenary spyware could exploit. Apple's support page now lists support from iOS 16, iPadOS 16, watchOS 10 and macOS Ventura, with additional protections from iOS 17, iPadOS 17, watchOS 10 and macOS Sonoma, and recommends updating to the latest release first.
| Area | What changes | Attack surface removed |
|---|---|---|
| Messages | Most attachment types blocked, except certain images, video and audio; links and link previews unavailable | Parsers for complex attachments, the route used by zero-click iMessage exploits |
| Web browsing | Certain complex web technologies blocked; some sites slow or break; web fonts and some images may not display | Browser engine features often used in exploit chains |
| FaceTime | Incoming calls blocked unless you called that person in the past 30 days; SharePlay and Live Photos unavailable | Unsolicited call handling |
| Apple services | Incoming invitations, such as Home invitations, blocked unless you invited that person first; Game Center disabled | Unsolicited invitation processing |
| Photos | Shared Albums removed, new invitations blocked; location excluded when sharing photos | Shared content from untrusted parties, location leakage |
| Wired connections | iPhone and iPad must be unlocked to connect to an accessory or computer; Apple silicon MacBooks must be unlocked and give explicit approval | Forensic and exploitation tools attached to a seized or unattended device |
| Wi-Fi | No auto-join to non-secure networks; disconnects from them when turned on | Rogue open hotspots |
| Cellular | 2G and 3G turned off on iPhone and iPad | Downgrade to legacy networks and fake base stations |
| Configuration profiles and MDM | Profiles cannot be installed; device cannot be enrolled in MDM or supervision | Malicious profiles and enrolment as a persistence route |
Phone calls and plain-text messages keep working, and emergency features such as SOS are not affected. Apple notes that incoming calls do not ring on a paired Apple Watch.
Who needs it
Apple's threat notification page says it sends notifications to users who may have been individually targeted by mercenary spyware, usually because of who they are or what they do, and that the vast majority of users will never receive one. Its first recommendation to recipients is to enable Lockdown Mode, and its second is to get expert help such as Access Now's 24/7 Digital Security Helpline.
| Group | Recommendation | Reason |
|---|---|---|
| Anyone who received an Apple threat notification | Turn on now on every Apple device | Apple's own first recommendation; treat devices as possibly compromised |
| Journalists, human rights defenders, lawyers on sensitive cases, political staff | Default on | The population mercenary spyware has repeatedly targeted |
| Board members, executives in sensitive negotiations, staff travelling to high-risk destinations | On for the period of elevated risk, or permanently by choice | Targeting tends to follow deals, disputes and travel |
| Administrators of identity, cloud and security platforms | Consider on their primary phone | Their phones hold the authenticators for the most valuable systems |
| General workforce | Not recommended | The feature cost outweighs the risk for untargeted users; patching and phishing-resistant MFA matter more |
See the Personal Security for High-Risk Individuals Guide and the Mobile Communications Protection for High-Risk Individuals Guide for the rest of a protected-tier programme.
Administration, MDM and privileged access
Lockdown Mode is a user decision, not an administrator setting. Apple states it is not configurable by administrators. This has three consequences for IT teams.
- Enrol before enabling: a device in Lockdown Mode cannot install configuration profiles or enrol in MDM or supervision, but a device already enrolled before Lockdown Mode was turned on stays managed. Provision, enrol and supervise company devices first, then have the user turn it on.
- Replacement devices: when a protected user gets a new phone, enrol the replacement before Lockdown Mode is enabled, or the user will have to turn it off to enrol.
- Turning it off is a security event: asking a high-risk user to disable Lockdown Mode to fix a problem reopens the attack surface. Make it a documented, time-limited exception approved by security, never a help desk shortcut.
- Privileged accounts: for administrators whose phone holds the authenticator for identity or cloud consoles, Lockdown Mode protects the device but not the account. Pair it with phishing-resistant MFA and separate admin accounts; see the Phishing-Resistant MFA Guide.
For management architecture, see the iOS and iPadOS Enterprise Security Guide and the Apple Declarative Device Management and Managed Device Attestation Guide.
Apps, websites and exceptions
Lockdown Mode applies to apps as well as Safari, because apps that display web content use the same engine. Apple lets users exclude trusted items, and warns that exclusions reduce protection and should be used only when necessary.
| Exception type | Where on iPhone and iPad | Where on Mac | Risk |
|---|---|---|---|
| Website | Safari page menu, Website Settings; list under Settings, Privacy & Security, Lockdown Mode, Customize Web Sites | Safari, Settings for the website; list under Safari, Settings, Websites, Lockdown Mode | A compromised or impersonated site regains full web features |
| App | Settings, Privacy & Security, Lockdown Mode; only apps opened since enabling and showing limited functionality appear | Not offered | The app's web content runs with full features |
| Contact (iOS 27, iPadOS 27, macOS 27 and later) | Settings, Privacy & Security, Lockdown Mode, Customize Contacts | Privacy & Security, Lockdown Mode, Customize Contacts | A hijacked contact account can send content without messaging limits |
Apple notes that removing a contact, or a change to that contact's phone number or email address, restores the limits automatically. Set a rule for your protected users: exclude only internal business sites and apps that are essential, review the lists quarterly, and never exclude contacts outside a small set of verified family and close colleagues.
Enabling Lockdown Mode across devices
Lockdown Mode is turned on separately on iPhone, iPad and Mac; Apple Watch follows the paired iPhone automatically, and enabling it on one device prompts the user to enable it on their others.
- iPhone and iPad: Settings, Privacy & Security, Lockdown Mode, Turn On Lockdown Mode, confirm, Turn On & Restart, then enter the passcode.
- Mac: System Settings, Privacy & Security, Lockdown Mode, Turn On, confirm (the user password may be needed), Turn On & Restart.
- Apple Watch: no separate step.
A rollout that does not generate a stream of help desk tickets:
- Define the protected group with the criteria in the table above and get each person's agreement; this is a personal device experience change.
- Update and enrol first: bring every device the person uses to the latest OS release and complete MDM enrolment and supervision.
- Pilot with three to five volunteers for a month: record which business sites, apps and workflows break, and decide which justify an exclusion.
- Brief each user on what will change (no link previews, blocked attachments, unknown FaceTime callers blocked, shared albums gone) and how to report suspicious messages or a threat notification.
- Enable on all of the person's devices together, including personal iPads and Macs they use for work communication, since an unprotected device on the same Apple Account remains a target.
- Roll back only through a security-approved exception: turning it off is the same path in Settings, and the user should turn it on again as soon as the task is done.
Logging and detection
Lockdown Mode reduces the chance of compromise but does not report attacks to you. Build detection around it.
- Threat notifications: ask protected users to forward any Apple threat notification to security immediately. Apple delivers them on the Lock Screen and in Settings, by email to the Apple Account addresses and as a banner at account.apple.com. Apple says it never asks recipients to click links, open files, install apps or profiles, or share passwords or codes, so treat any message that does as phishing.
- Device posture: use your MDM inventory to confirm OS version and patch level for every protected device; out-of-date devices lose protections Lockdown Mode cannot replace.
- Configuration drift: an attempt to install a profile on a protected device fails; repeated reports from a user that they were prompted to install one are a signal worth investigating.
- Forensic triage: where compromise is suspected, collect evidence before wiping, following the Commercial Spyware Guide.
| Metric | Source | Target |
|---|---|---|
| Protected-group devices with Lockdown Mode on | User attestation and periodic check-ins | 100% of devices for every person in the group |
| Protected devices on the latest OS release | MDM inventory | 100% within [7 days] of release |
| Active exclusions per user | Quarterly review with each user | Few, each justified |
| Time from threat notification to security engagement | Incident records | Same day |
Hardening baseline alongside Lockdown Mode
Lockdown Mode is one layer. For protected users, apply the rest of Apple's recommendations to threat notification recipients and the basics that close other routes.
- Updates: install updates promptly (see Apple security releases); Apple recommends running the latest software for full Lockdown Mode protections.
- Account security: strong passcode, Face ID or Touch ID, and two-factor authentication on the Apple Account; see the Securing Your Apple ID and Google Account Guide.
- Links: do not open links from unknown senders, which Lockdown Mode also helps by disabling link previews.
- Restart regularly: the NSA advises rebooting mobile phones regularly in its Securing Wireless Devices in Public Settings information sheet.
- Android users in the same group: use Android's equivalent hardening; see the Google Advanced Protection Program Guide.
| Control | NIST SP 800-53 Rev. 5 | NIST CSF 2.0 |
|---|---|---|
| Lockdown Mode as a hardened configuration for high-risk users | CM-6, CM-7, AC-19 | PR.PS-01 |
| Prompt OS updates | SI-2 | PR.PS-02 |
| Hardened devices for travel to high-risk locations | CM-2(7) | PR.PS-01 |
| Reporting threat notifications | IR-6 | RS.MA-01 |
Common misconfigurations
- Enabling before enrolment: the company device cannot then be enrolled in MDM, and the user is told to turn protection off to fix it.
- Protecting the phone only: the user's iPad or Mac on the same Apple Account stays exposed. Enable it on each iPhone, iPad and Mac.
- Exclusion creep: users exclude every site that renders oddly and every app that complains; after a year the protection is mostly gone.
- Running out-of-date software: Lockdown Mode is not a substitute for patching, and newer protections need newer releases.
- Help desk turning it off: support staff disable it to resolve a ticket and nobody turns it back on.
- Ignoring threat notifications: a notification is a high-confidence signal from Apple; treat it as an incident, not an FYI.
Practitioner checklist
- A named protected group exists, with criteria and each person's agreement.
- Every device of each protected person is updated, enrolled and supervised before Lockdown Mode is turned on.
- Lockdown Mode is on for every iPhone, iPad and Mac each protected person uses.
- A one-page user brief explains what breaks and how to report a threat notification.
- Exclusions are limited to essential business sites and apps and reviewed quarterly.
- Turning Lockdown Mode off requires a time-limited, security-approved exception.
- Threat notifications go to security the same day and trigger the spyware response process.
- Protected users also use phishing-resistant MFA and separate admin accounts where relevant.
Standards and references
- Apple: About Lockdown Mode
- Apple: About Apple threat notifications and protecting against mercenary spyware
- Apple Newsroom: Apple expands industry-leading commitment to protect users from highly targeted mercenary spyware
- Citizen Lab: BLASTPASS, NSO Group iPhone zero-click, zero-day exploit captured in the wild
- NIST: SP 800-53 Rev. 5, Security and Privacy Controls
- NIST: Cybersecurity Framework 2.0
- NSA: Securing Wireless Devices in Public Settings
Related NHI Mgmt Group resources: Commercial Spyware Guide · Mobile Communications Protection for High-Risk Individuals Guide · iPhone Security and Privacy Settings Guide · Travel Security Policy Template