In 2026, Apple made a claim bold enough to raise eyebrows in a field allergic to bold claims: no iPhone running Lockdown Mode has ever been successfully compromised by mercenary spyware. Not “rarely.” None. The genuinely surprising part is that the independent evidence mostly backs it up.

So, does Lockdown Mode actually work? The short answer is yes, and better than almost any consumer security feature ever shipped, for the specific threat it was built to stop. The longer, more useful answer is worth having, because knowing exactly what it does, what it does not, and where a ground-up hardened phone goes further is the difference between real protection and a false sense of it.

What it is and what it turns off

Lockdown Mode is Apple’s opt-in extreme-security setting, introduced in iOS 16 in 2022, aimed squarely at people likely to be personally targeted by nation-state-grade spyware: journalists, activists, lawyers, executives, dissidents. When you switch it on, it aggressively strips away the features that sophisticated spyware tends to exploit.

Most message attachment types are blocked, with only some images, video, and audio allowed through. Link previews in Messages are disabled. Complex web technologies in Safari, the kind exploit chains love, are heavily restricted. FaceTime calls from people you have never contacted are blocked. Wired accessory connections are refused while the phone is locked. Shared album and HomeKit invitations are blocked, and the phone will not auto-join insecure Wi-Fi. It is, by design, a bit annoying to live with. That friction is the feature, not a flaw.

The evidence that it works

This is not marketing, which is what makes it notable. Citizen Lab, the research group that has tracked mercenary spyware for a decade, confirmed real-world cases where Lockdown Mode blocked live zero-click attacks, one from NSO Group’s Pegasus, another from Predator, and in some cases even alerted the target that an intrusion was being attempted.

The most convincing evidence is subtler. Google’s security researchers found spyware that was coded to abort its own infection attempt if it detected Lockdown Mode was active, specifically to avoid leaving traces that might expose the tool. When the attackers program their million-dollar weapons to back away from a feature rather than risk tripping it, that is the strongest endorsement a defense can get. As one prominent Apple security researcher put it, Lockdown Mode is one of the most aggressive consumer-facing hardening features ever shipped. Credit where it is due: it works.

Why it works, and it’s the same reason everything does

Lockdown Mode succeeds for the exact reason all real security succeeds: attack-surface reduction. As we have written about zero-click exploits, spyware needs a door, an auto-processed attachment, a web feature, a message preview, some piece of code your phone runs on incoming data without asking you. Lockdown Mode slams most of those doors shut. Fewer doors, fewer ways in. It is the same principle a hardened phone is built on, delivered as a single toggle on iOS.

What it does not do

Now the honest limits, because they matter as much as the wins.

It is reactive and opt-in. You have to know it exists and choose to turn it on, and attackers adapt, NSO reportedly learned to fingerprint Lockdown Mode to defeat its warning behavior. It raises the cost of attacking you dramatically. It does not grant permanent immunity.

It is a mode on iOS, which means you are still on Apple’s operating system underneath it. Lockdown Mode reduces the spyware attack surface, but it does nothing about the everyday data collection, the effectively mandatory iCloud account, the telemetry, or the fact that iOS is a closed system you cannot inspect or independently verify. It closes the spyware doors while leaving the ordinary surveillance running, and it asks you to trust a black box that you have blocked some attacks, without the means to check the rest.

And it only addresses one slice of your threat model, the mercenary-spyware slice. It does nothing against a coercive person who has your passcode, a thief, the data brokers, your carrier, or someone forcing you to unlock the phone. It is an excellent tool for a narrow job.

Lockdown Mode versus a phone hardened from the ground up

This is where the comparison gets interesting, and where your threat model decides the answer.

Lockdown Mode is the best you can do within an iPhone. If you are on iOS and there is any chance you are a target, turn it on today. It is free, it is real, and it is genuinely one of the few security features that has earned its reputation. We will happily tell an iPhone user exactly that.

A hardened Android, like the de-Googled builds we work with, is a different philosophy entirely. Instead of a toggle that subtracts risky features from a still-Apple-controlled OS, it is a device designed from the ground up so that attack-surface reduction and user control are the default state, not a mode. It is de-Googled, so the everyday telemetry and forced account are gone, not just the spyware doors. It gives you per-app network and sensor control, verified boot you can attest yourself rather than take on faith, a duress option, compartmentalized profiles, and a minimal attack surface as the baseline. In other words, it addresses the parts of your threat model, the ordinary surveillance, the coercion, the need to actually verify your device, that Lockdown Mode leaves untouched, and it does not ask you to trust a system you cannot see into.

These are not enemies. They are points on a spectrum. Lockdown Mode is aggressive attack-surface reduction bolted onto a consumer OS. A hardened phone is a device whose entire design is attack-surface reduction plus control you can verify. For the narrow mercenary-spyware threat, Lockdown Mode is excellent and often enough. For a threat model that also includes everyday data collection, physical coercion, and the desire to own and inspect your own device, a ground-up hardened phone goes further. The right answer is the one that matches what you are actually defending against.

The verdict

Does Lockdown Mode work? Yes, remarkably well, for what it is for. If you carry an iPhone and could be a target, turn it on now, this is not a case where we are going to talk you out of a competitor’s good feature. It is real, and it might save you.

Just know its edges. It is a narrow, reactive tool riding on an operating system you do not control, and it does not touch most of what threatens most people. If your needs run past the mercenary-spyware attack surface, or you want a device you can actually verify rather than trust, a phone hardened from the foundation is the next step. Either way, the honest thing to say is that Lockdown Mode is one of the rare security features that lives up to the hype, and knowing precisely where it stops is how you decide whether you need more.

If you want help figuring out whether Lockdown Mode is enough for your situation or whether you have outgrown it, email hello@spicycorp.com, or book a call.