Apple’s Lockdown Mode reportedly unbeaten for nearly four years

Lockdown Mode stands its ground

It has been reported that since Apple launched Lockdown Mode in 2022, no device running the feature has been publicly documented as successfully compromised by commercial spyware. TechCrunch cited an Apple spokesperson, Sarah O’Rourke, as confirming the company is not aware of any successful attacks against devices with the mode enabled. Lockdown Mode is an optional, extreme protection setting aimed at a tiny subset of users who face highly targeted digital threats — journalists, activists, diplomats and other high‑risk individuals.

Independent labs back the claim — and explain how it works

Third‑party researchers reportedly corroborate Apple’s assessment. Amnesty International (国际特赦组织) Security Lab and the University of Toronto’s Citizen Lab (多伦多大学公民实验室) said they found no evidence that devices in Lockdown Mode were breached in dozens of spyware investigations; Citizen Lab has previously credited the feature with stopping top tools such as Pegasus and Predator. Reportedly, Google security researchers observed that some spyware will abandon an infection attempt once it detects Lockdown Mode, apparently to avoid exposure. Security researcher Patrick Wardle described the setting as one of the most aggressive consumer‑facing hardening measures, because it blocks many message attachments, restricts WebKit functionality and dramatically narrows the remote attack surface to cut off “zero‑click” exploit paths.

Why this matters — and the limits

This finding matters beyond Apple. Commercial spyware vendors and state clients have been the focus of mounting legal and diplomatic scrutiny in recent years, with export controls, sanctions and lawsuits reshaping the market. If Lockdown Mode truly deters high‑end operators, it changes attackers’ calculus — they may shift to softer targets or more clandestine methods. But Lockdown Mode is not a mass solution; it is an opt‑in, high‑friction tool for a small group, and security is never absolute. Reported effectiveness depends on timely updates, correct configuration, and the evolving ingenuity of adversaries.