An iPhone’s built-in security is strong enough that most of the harm people suffer on one comes from somewhere else: a thief who watched you type your passcode, an Apple Account that someone else gets into, or cloud backups that Apple itself can read. This page explains what iOS protects by default, where that protection stops, and which settings change the outcome.
It covers iPhones running iOS 27, which Apple released on 14 September 2026 for the iPhone 11 and later. Most of it applies worldwide. Where a country’s law or a regional rule changes the picture, we say so.
Once you’ve read it you can check four things on your own phone in about ten minutes: whether it’s fully updated, whether Stolen Device Protection is on, how well your Apple Account is guarded, and what happens to your iCloud data. The last section lists what this page leaves out.
What iOS is in plain terms
iOS is the operating system on the iPhone. (iPads run a close sibling called iPadOS.) Apple designs the chip, writes the software, runs the app store most people install from, and operates iCloud, the service that backs up and syncs your data. That control explains most of iOS’s strengths and most of its trade-offs. One company can fix problems across the whole stack, and one company is also the party you have to trust.
Much of this page is built around one scenario. Your phone is taken at a bus stop, and the thief watched you enter your passcode a few minutes earlier. In 2023 a Wall Street Journal investigation, summarized by CNBC, showed how thieves who knew a passcode could switch off theft protections and take over the owner’s accounts, potentially reaching banking and payment apps. Apple’s answer was a feature called Stolen Device Protection, covered below.
How iOS protects you
The chip and file encryption
When an iPhone starts, it first runs code stored in read-only memory called the Boot ROM. That code checks that the next piece of software is signed by Apple before letting it run, and each stage checks the one after it. Apple calls this the secure boot chain, and it is designed to stop altered system software from loading underneath you.
A separate processor inside the chip, the Secure Enclave, runs its own signed software. It handles Face ID, Touch ID and the creation and storage of encryption keys.
Your files are encrypted one by one as they’re saved. Each file gets its own 256-bit key, which a dedicated hardware engine uses to encrypt it. Apple calls this Data Protection. Each file belongs to a class, and the class decides when its key is available. Apple’s own apps use it by default, and third-party apps get it automatically.
In practice the hardest state to attack is a locked iPhone that has just restarted. Apple’s term is Before First Unlock. After you unlock the phone once, more keys become available (After First Unlock) until the next restart. Since iOS 18.1, Apple’s Automatic Restart restarts a phone that stays locked for a prolonged period, which clears sensitive keys from memory and puts it back in the harder state. Apple’s guide doesn’t state the interval. Researchers, and a forensic-tools company, measured 72 hours when the feature was found in 2024.
Updates
iOS 27 shipped with fixes for about 126 security flaws, 20 of them in the kernel, according to SecurityWeek’s reading of Apple’s advisory. Apple didn’t mention any being exploited in the wild. As of October 2026, Apple’s security releases page lists iOS 27.0.1 as the latest version.
Since iOS 26.1, Apple can also ship small fixes for Safari, WebKit and system libraries between full updates. It calls these Background Security Improvements. The first one went out on 17 March 2026 as “iOS 26.3.1 (a)” and fixed a WebKit flaw (CVE-2026-20643). You manage them under Settings > Privacy & Security, and they install automatically if you’ve turned on automatic software updates. If you remove one, the phone goes back to its base version without any of those patches.
The phone’s age matters. iOS 27 needs an iPhone 11 or later. Some older models still receive fixes on older iOS versions (the iPhone XS and XR got iOS 18.7.10 in August 2026, the iPhone 8 and X got iOS 16.7.16 in May 2026), but they don’t get new protections. Apple’s security releases page shows which updates reach which models.
Apps, permissions and tracking
Since iOS 14.5, apps have to ask before tracking you across other companies’ apps and websites. If you decline, the app can’t read your advertising identifier, can’t use your email address or similar identifiers for tracking, and still works. Settings > Privacy & Security > Tracking lists the apps that asked. This covers cross-app tracking for advertising and data brokers. It doesn’t stop an app collecting data for its own use.
In the European Union, Apple has allowed alternative app marketplaces since iOS 17.4 (March 2024). Apps distributed that way still go through Apple’s notarization, which Apple describes as a baseline review combining automated checks and human review. Rules in other regions have been changing, so check what applies where you live. An app from outside the App Store has had a lighter check than one inside it.
Stolen Device Protection
Stolen Device Protection (iOS 17.3 and later) adds two layers when the phone is away from familiar places such as home or work. Apple’s page lists what each one covers.
Some actions need Face ID or Touch ID with no passcode fallback. These include using saved passwords and passkeys, using payment methods saved in Safari, turning off Lost Mode, erasing the phone, and setting up a new device or eSIM. Other actions need Face ID or Touch ID, then a wait of one hour, then a second scan. These include changing your Apple Account password, signing out of it, changing your passcode, and adding or removing a face or fingerprint. Apple Pay purchases can still be approved with the passcode.
The feature needs two-factor authentication on your Apple Account, a passcode, Face ID or Touch ID, Significant Locations turned on, and Find My turned on. It has to be on before the phone is stolen. Apple’s page says it might be on by default, and AppleInsider reported in February 2026 that iOS 26.4 switched it on for everyone. Check Settings > Face ID & Passcode > Stolen Device Protection either way. If a phone is stolen, Apple has a what to do if your iPhone is stolen page.
Memory Integrity Enforcement and Lockdown Mode
Two protections target a different, much rarer threat: mercenary spyware, which is commercial surveillance software sold to governments and used against a few specific people.
Memory Integrity Enforcement, announced in September 2025, is built into the iPhone 17 line and iPhone Air. It checks every memory access in the kernel and more than 70 other system processes, so a common class of software bug becomes much harder to exploit. Apple says it could not rebuild real exploit chains from the past three years to work around it. That is Apple’s own evaluation, and we didn’t find an independent test.
Lockdown Mode is an optional setting for people who could be personally targeted. Apple says most people never will be. When it’s on, the phone blocks most message attachment types and removes links and link previews in Messages, blocks incoming FaceTime calls from people you haven’t called in the past 30 days, restricts some web technologies, won’t connect to accessories while locked, and turns off 2G. Calls, plain text messages and emergency SOS still work. You turn it on in Settings > Privacy & Security > Lockdown Mode.
iCloud is where the model changes
Everything above protects the phone. iCloud is a different arrangement. With standard protection, your data is encrypted, but Apple keeps the keys so it can help you recover an account. Only 15 categories, such as saved passwords and Health data, are end-to-end encrypted by default, meaning only your devices can decrypt them. Backups, Photos, Notes and iCloud Drive are not, so Apple can decrypt them, and so can anyone who compels Apple to.
Advanced Data Protection raises the count to 25 categories and adds backups, Photos, Notes and Drive. Mail, Contacts and Calendars stay outside it. Some metadata, such as file sizes and modification times, stays under standard protection. Shared Albums, Pages, Keynote and Numbers collaboration, and “anyone with the link” sharing are not end-to-end encrypted even with it on. Apple can’t recover Advanced Data Protection data for you, so you need a recovery contact or recovery key, and Apple prompts you to set one up first.
One regional exception. As of October 2026, Apple does not offer Advanced Data Protection to new users in the UK. It withdrew the option on 21 February 2025 after the UK government reportedly demanded access to encrypted iCloud data under the Investigatory Powers Act. Reports say the UK later dropped a worldwide demand and issued a narrower notice covering UK users, which Apple challenged at the Investigatory Powers Tribunal in July 2026. A hearing on 17 September 2026 dealt with the government’s refusal to confirm or deny such notices, and Reuters reported that a full hearing is unlikely before next year. This is general information, not legal advice.
What it protects against, and what it doesn’t
| Threat | What helps | Where it falls short |
|---|---|---|
| Thief who has your phone and passcode | Stolen Device Protection, Find My, Automatic Restart | Must be set up beforehand. Doesn’t prevent the theft. Apple Pay still accepts the passcode |
| Someone taking over your Apple Account | Two-factor authentication, recovery contact or key, Advanced Data Protection | Standard iCloud lets Apple read backups and photos. Advanced Data Protection isn’t offered to new UK users |
| Scammer who asks you for a code or payment | Lockdown Mode removes links in Messages | Nothing in iOS stops you handing over a code you’ve been talked into sharing |
| Mercenary spyware | Prompt updates, Memory Integrity Enforcement, Lockdown Mode | Aimed at few people. Memory Integrity Enforcement is on newer hardware only, and the evidence is Apple’s own |
| Apps tracking you for ads | The tracking prompt, per-app permissions | Doesn’t cover data an app collects for its own use |
| Legal or government access to cloud data | Advanced Data Protection for most categories | Mail, Contacts, Calendars and shared content stay readable. Not available to new UK users |
Two limits sit outside the table. iOS is proprietary software, so you can’t inspect it, and you’re trusting Apple’s account of how it works. And your Apple Account is the key to a great deal (backups, passwords, location sharing, payments), so a weak recovery setup on that one account can undo strong protection everywhere else.
Common myths
“iPhones don’t get hacked.” Apple says there has been no successful widespread malware attack against iPhone, and that the system-level attacks it sees are mercenary spyware used against a few people. That is different from being unhackable. A single release fixing around 126 flaws shows how much code there is to get wrong, which is why updating matters.
“Face ID means my passcode barely matters.” Face ID falls back to the passcode, and the passcode is what a thief tries to learn. Stolen Device Protection removes that fallback for the riskiest actions away from home, but the passcode still unlocks the phone for everything else.
“My iCloud is end-to-end encrypted.” Only some of it. Photos and backups aren’t unless you’ve turned on Advanced Data Protection. Even Messages in iCloud, which is end-to-end encrypted by default, includes a copy of its key in your iCloud Backup if backup is on, which lets Apple recover it.
“Lockdown Mode is the safest setting, so everyone should use it.” Apple designed it for a very small group, and it deliberately breaks features. For most people the cost outweighs a threat they’re unlikely to face.
What to do
- Update and turn on automatic updates. Go to Settings > General > Software Update and switch on automatic updates. Background Security Improvements follow that setting. This is the cheapest step and it covers the threat that affects the most people.
- Use a strong passcode and check Stolen Device Protection. A custom alphanumeric code or a long numeric one is harder to guess than a short PIN. Then confirm Stolen Device Protection is on, and that Find My is on, since the feature requires it.
- Secure your Apple Account. Keep two-factor authentication on and add a recovery contact or recovery key, so a locked-out you can get back in and an attacker can’t talk their way in.
- Decide about Advanced Data Protection. Turn it on if you’d rather Apple couldn’t read your backups and photos, and you can accept that Apple can’t rescue you if you lose access. Set up a recovery contact or key first. Apple’s guide to turning it on has the steps. It’s not offered to new users in the UK.
- Review permissions and tracking. Under Settings > Privacy & Security, check which apps have location, photos and contacts, and which are allowed to track you.
- Turn on Lockdown Mode only if you may be targeted. If you’re unsure whether you could be, start with threat modeling.
What this page doesn’t cover
We haven’t covered iMessage, RCS and FaceTime encryption, Siri and Apple Intelligence data handling, Find My location privacy, AirDrop, managed work phones, jailbreaking, or how iOS compares with Android. Each deserves its own page.
Sources
- Apple Platform Security: Boot process for iPad and iPhone devices. Apple, accessed 2026.
- Data Protection overview. Apple Platform Security, August 2026.
- Protecting user data in the face of attack. Apple Platform Security, January 2026.
- New Apple security feature reboots iPhones after 3 days, researchers confirm. TechCrunch, 2024.
- Apple security releases. Apple Support, 2026.
- Apple Patches 200 Vulnerabilities With New iOS 27, macOS Golden Gate 27 Releases. SecurityWeek, 2026.
- Apple starts issuing lightweight security updates between software releases. Help Net Security, 2026.
- Apple pushes first Background Security Improvements update to fix WebKit flaw. BleepingComputer, 2026.
- If an app asks to track your activity. Apple Support, 2025.
- Apple finally allows app sideloading and third-party stores on iPhones in the EU. Neowin, 2024.
- Apple begrudgingly allows app sideloading, third-party app stores. Notebookcheck, 2024.
- A new iPhone feature can help keep your money safe. CNBC via NBC DFW, 2024.
- About Stolen Device Protection for iPhone. Apple Support, July 2026.
- iOS 26.4 has iPhone Stolen Device Protection on by default. AppleInsider, 2026.
- Memory Integrity Enforcement: A complete vision for memory safety in Apple devices. Apple Security Research, September 2025.
- Lockdown Mode support. Apple Platform Support, October 2025.
- iCloud data security overview. Apple Support, January 2026.
- Apple disables iCloud’s Advanced Data Protection feature in the UK. Engadget, 2025.
- Why Apple is challenging UK demand for access to encrypted user data. Business Standard, 2026.
- Apple Challenges UK Secrecy Over iCloud Encryption Order. iClarified, citing Reuters, September 2026.