iPhone vs Samsung Galaxy Security Compared: Who Is Safer in 2026?

Neither phone is simply "more secure." A current iPhone and a current Galaxy flagship, both kept updated, are hard targets, and the gap between them is smaller than the gap between either one and an old, unpatched phone of any brand. The honest answer depends on who you are: the iPhone has the stronger documented record against targeted spyware and broader end-to-end encrypted cloud backups, while Galaxy flagships carry a published "up to 7 years" security update commitment, deeper enterprise controls through Knox, and more freedom (and more rope) for people who install apps from outside the store.

Below, each part of the question gets its own answer: update length, patch speed, security chips, app stores and sideloading, hardening modes, cloud encryption, theft protection, certifications, fleet management, bug bounties and repair. Every vendor fact comes from Apple's, Samsung's or Google's own pages, checked on 23 October 2026.

Key takeaways

• Pick by persona, not by logo. If someone could be individually targeted by mercenary spyware, the iPhone with Lockdown Mode has the clearest public track record. If you want a written update policy or tight fleet control, a Galaxy flagship on Samsung's monthly list is a strong choice.
• Update length. Samsung says that from January 2024 it extended Galaxy security support "by up to 7 years." Apple publishes no fixed number on its consumer pages but was still shipping iOS 18 fixes in August 2026, almost a year after iOS 26.
• Patch speed. Apple pushes fixes directly to every supported iPhone. Android fixes flow from Google's monthly bulletin into Samsung's monthly release, then through carriers.
• Hardware. Apple's Secure Enclave and Samsung's Knox Vault both isolate keys from the main processor. iPhone 17 and iPhone Air add Memory Integrity Enforcement against spyware exploit chains.
• Cloud backups. Apple's Advanced Data Protection covers 25 categories, including backups and Photos. Samsung's Enhanced Data Protection covers call logs, messages, clock, settings and app backups.
• Theft. Apple's Stolen Device Protection and Android's theft protection features both target the thief who watched you type your passcode.

The short answer by persona

This maps what each person cares about to what the vendors document. It is not a product ranking.

How long does each phone get security updates?

Start here, because an unpatched phone loses every other comparison.

Samsung's published policy

Samsung's security site, security.samsungmobile.com, sorts Galaxy devices into update tiers. On 23 October 2026 the monthly tier listed the Galaxy S26, S25, S24 and S23 families (including FE models), foldables from the Z Fold5 and Z Flip5 onward, the Z TriFold, and enterprise models such as the Galaxy A54 5G to A57 5G and the XCover7 range. The quarterly tier included the Galaxy S22 series, Z Fold4, Z Flip4, and many A, M, F and Tab models.

The same page says that as of January 2024 Samsung extended security update support "by up to 7 years." Note "up to." The page does not say which models get the full span, warns that timing varies by market, carrier and model, and notes that some carriers may support only quarterly updates even for monthly tier models. In practice:

1. A model's tier changes over its life. The S22 series is now quarterly.
2. The clock starts at launch, not at purchase. A flagship bought two years after release has two fewer years left.
3. A carrier variant can lag the unlocked model.

Apple's approach

Apple does not publish a fixed number of years on its consumer support pages. Its security releases page shows two useful patterns. Apple keeps patching the previous major iOS version for devices that cannot or do not upgrade: on 17 August 2026 it shipped iOS 18.7.10 alongside iOS 26.6.1. And it can ship fixes between point releases: the page lists "Background Security Improvements" for iOS 26.3.1 on 17 March 2026.

The trade-off is predictability. Samsung gives a written ceiling and a tier list; Apple gives a long track record but no consumer facing promise you can put in a procurement document. Enterprises that need one should ask Apple or their reseller for the support statement that applies in their market.

How to check your phone today

On an iPhone, open Settings > General > About, read the iOS version, and compare it with the newest entry for your device on Apple's security releases page.

On a Galaxy, open Settings > About phone > Software information and read Android security patch level, a date such as 2026-10-01. On a monthly tier device, anything more than about two months old means a pending update, a carrier delay or a model that has dropped a tier.

IT teams can read the same values from a lab device with USB debugging enabled. Auto Blocker blocks USB commands while on, so do this on test devices only and turn debugging off afterwards:

# Read patch level, Android version and model from a connected test device
adb devices
adb shell getprop ro.build.version.security_patch
adb shell getprop ro.build.version.release
adb shell getprop ro.product.model

For fleets, your MDM reports iOS versions and Android patch levels. Alert on anything more than one release behind.

How fast do security patches arrive?

The Android chain: Google, then Samsung, then your carrier

Google publishes the Android Security Bulletin on the first Monday of each month, or the next working day after a holiday. Each bulletin lists patch level strings such as 2026-10-01 and 2026-10-05 and covers the Android platform, the upstream Linux kernel and chip makers' components. The October 2026 bulletin appeared on 5 October. Google's overview also notes a 2026 change: Android source code now reaches the open source project in Q2 and Q4.

Samsung then publishes its Security Maintenance Release (SMR). SMR-OCT-2026 appeared on 6 October 2026 and bundled Google's fixes (9 Critical and 33 High CVEs from Google's bulletin, plus Moderate ones), 4 High CVEs from Samsung Semiconductor, and 27 Samsung Vulnerabilities and Exposures (SVE) items for Samsung's own software. Samsung builds firmware per model and region, carriers may test it, and then it rolls out. That is why two people with the same model can see different patch dates.

The Apple chain: one vendor, one push

Apple writes the OS, designs the chips and signs the updates, so a fix reaches every supported iPhone at once. Apple says it does not disclose or confirm security issues until fixes are generally available, so the fix and the disclosure land together, with little warning. Automatic updates matter.

Hardware security: Secure Enclave vs Knox Vault

Both companies keep the most sensitive keys in a separate processor, so a compromised main OS kernel does not automatically expose them.

Apple's Secure Enclave

Apple's Platform Security guide describes the Secure Enclave as an isolated subsystem inside the system on chip. It has its own processor running an Apple customised L4 microkernel, a memory protection engine that encrypts and authenticates its memory, a true random number generator, and an AES engine whose hardware keys software cannot read out. A paired Secure Storage Component (from the A12) holds "counter lockboxes" that cap passcode guesses and erase protected data when the limit is reached. The Secure Enclave guards file system keys, Face ID and Touch ID data, and passcode protected data, which is why a passcode cannot be brute forced at full speed from outside the phone.

Samsung's Knox Vault

Samsung's Knox whitepaper describes Knox Vault as an isolated subsystem that runs independently of the main processor. One half sits inside the system on chip with its own processor, memory, random number generator and crypto engine; the other, Knox Vault Storage, is a separate chip with its own secure core and flash. They talk over a dedicated encrypted bus. Knox Vault holds hardware backed Android Keystore keys, biometric data, the Knox attestation key and lock screen credentials, which a feature called Samsung Weaver protects with exponential back off. Samsung says sensors watch for temperature, voltage glitch and laser attacks, and that the storage chip is wiped if an attack is detected. The components are Common Criteria evaluated to EAL4+ under BSI PP0084, and Knox Vault ships in select devices from the Galaxy S21.

Memory safety in hardware

Most serious phone exploits still start with a memory corruption bug. On 9 September 2025 Apple described Memory Integrity Enforcement, shipping in all iPhone 17 models and iPhone Air. It combines type separated memory allocators, Enhanced Memory Tagging Extension in synchronous mode, and protection for the tag secrets, always on for the kernel and more than 70 userland processes. Apple says its main target is mercenary spyware. On Android, Google's Advanced Protection enables Memory Tagging Extension for supported apps on supported devices; I did not find a Samsung page listing which Galaxy models support it.

App stores, sideloading and the EU DMA

The biggest everyday difference is where apps come from.

On a Galaxy, apps come from Google Play, the Galaxy Store, or anywhere you allow. Google Play Protect is on by default; Google says it checks apps at install, scans the device periodically, can send an outside app to Google for a code level evaluation, and can warn about, disable or remove a harmful app. Samsung adds Auto Blocker, which its support page says blocks installs from unauthorised sources (Play and Galaxy Store still work), blocks commands from malicious chargers or computers over USB, blocks suspect images in messaging apps through Samsung Message Guard, and blocks system software Samsung did not authorise. The page says it is on by default on devices released with One UI 6.1.1.

On an iPhone, consumer apps have historically come from the App Store. On 25 January 2024 Apple announced that, under the Digital Markets Act, iOS 17.4 would let EU users install apps from alternative app marketplaces run by developers Apple authorises. Apple applies notarization, a baseline of automated and human review, to all iOS apps however they are distributed, adds installation sheets, and can stop an installed app from launching if it contains malware. Apple's own announcement says "many risks remain."

The practical reading: sideloading is the biggest self inflicted risk on either platform, since most phone malware that reaches ordinary people is an app the person installed. A Galaxy with Auto Blocker on behaves much like an iPhone for installs; turning it off for one app and forgetting to turn it back on is a common way in.

Lockdown Mode vs Auto Blocker Maximum restrictions

Both platforms now have a switch that shrinks the attack surface at the cost of convenience.

Apple Lockdown Mode (iOS 16 or later, more protections from iOS 17) is, in Apple's words, for "the very few individuals" who may be personally targeted. It blocks most message attachments and link previews, some complex web technologies, FaceTime calls from people you have not called in 30 days, and service invitations from people you have not invited. It removes shared albums, strips location from shared photos, requires the phone to be unlocked to connect to accessories or computers, refuses to auto join non secure Wi-Fi, turns off 2G and 3G, and blocks new configuration profiles and MDM enrolment. Administrators cannot turn it on for users.

Samsung Maximum restrictions, part of Auto Blocker from One UI 6.1.1, scans installed apps for malicious activity, blocks device admin apps and work profiles, blocks 2G, stops automatic reconnection to non secure Wi-Fi, hides links and previews in messages with web addresses, blocks shared albums, and removes location data from pictures shared through Samsung Messages or Gallery.

Google Advanced Protection, on supported Android devices, locks Play Protect on, blocks unknown sources, turns on Memory Tagging Extension for supported apps, limits accessibility tools, enables theft and offline locks, reboots after 72 hours locked, blocks USB access while locked, blocks 2G on supported devices, hardens Chrome, and offers optional Intrusion Logging for later investigation.

The last row is the honest difference. On 7 September 2023 Citizen Lab reported BLASTPASS, a zero click chain delivering NSO Group's Pegasus spyware that worked against iPhones on the then current iOS 16.6 (CVE-2023-41064 and CVE-2023-41061). Citizen Lab wrote that Apple's security team confirmed "Lockdown Mode blocks this particular attack." I found no equivalent published case for Samsung's or Google's modes. That is not proof they would fail; the public record is simply thinner, partly because researchers have mature tools for examining iPhones and many high value targets carry them.

Apple also sends threat notifications to people it believes were targeted by mercenary spyware: users in more than 150 countries since 2021, delivered on the lock screen, by email and at account.apple.com. Apple says real notifications never ask you to click a link or install anything.

Advanced Data Protection vs Samsung's Enhanced Data Protection

A locked down phone can still leak everything through a cloud backup if the provider holds the keys.

Apple's standard protection end-to-end encrypts 15 categories, including Health, Passwords and Keychain, and Messages in iCloud; Apple holds the keys for the rest. Advanced Data Protection raises that to 25 by adding iCloud Backup, iCloud Drive, Photos, Notes, Reminders, Safari Bookmarks, Shortcuts, Voice Memos, Wallet passes and Freeform. It needs two factor authentication, a recovery contact or recovery key, and iOS 16.2 or later on all your devices. Apple cannot recover your data if you lose access. iCloud Mail, Contacts and Calendars stay outside end-to-end encryption because they interoperate with standard email, CalDAV and CardDAV.

Samsung's Enhanced Data Protection (One UI 5.1.1 or later, not on some carrier devices or regions) end-to-end encrypts call logs, messages, clock, settings and app backups in Samsung Cloud, with a 28 character recovery code Samsung does not store. Samsung warns that some large files, including message attachments, may not be encrypted, and unsupported items are backed up without encryption. Many Galaxy owners back up photos through other services with their own encryption models, so check where your photos go.

On the pages checked, Apple's feature covers more, including full backups and photos. This is one of the clearer differences in the iPhone's favour.

Private Relay and network privacy

iCloud Private Relay, part of iCloud+, sends Safari browsing through two relays: Apple's sees your IP address but not the site, because DNS is encrypted; a third party's assigns a temporary address and connects you. Apple says no single party, "not even Apple," sees both who you are and which sites you visit. It is not available in every country, and some sites may ask for extra sign in steps.

I did not find a built in Samsung equivalent on the Samsung pages checked. A VPN or private DNS gives some of the benefit on a Galaxy, but you trust one provider with both halves. Private Relay is a privacy feature, not a malware defence.

Stolen Device Protection vs Android theft protection

Phone theft changed when thieves started watching people type passcodes in public, then grabbing the phone and locking the owner out of their account.

Apple Stolen Device Protection (iOS 17.3 or later, on before the theft) requires Face ID or Touch ID with no passcode fallback, away from familiar locations, to use saved passwords and passkeys, use saved payment methods, turn off Lost Mode, erase the phone, open locked apps or move an eSIM. Critical changes, including the Apple Account password, the passcode, Face ID enrolment, MDM enrolment and turning the feature off, need a one hour security delay and a second biometric check. You can make it apply everywhere.

Android theft protection, under Settings > Google > All services > Theft protection, includes Theft Detection Lock (spots a grab and run and locks the screen), Offline Device Lock, Failed Authentication Lock (on by default), Remote Lock from android.com/lock, and Identity Check, which requires biometrics away from trusted places for actions such as changing the screen lock, factory reset or turning off Find Hub. Google says Identity Check is available only on certain devices and support varies by model; a greyed out toggle means your phone lacks it.

Apple's delay targets the account takeover that follows a stolen passcode; Android's set adds automatic locks at the moment of theft. Neither works if it is off when the phone goes.

Government certifications

A certification means an independent lab tested a specific product version against a specific standard. It is not a promise that a phone cannot be hacked, and it ages as versions move on.

Apple's certifications guide lists Common Criteria certification for iOS 18, dated 15 December 2025, against the Mobile Device Fundamentals configuration with biometric, Bluetooth, MDM agent, VPN, WLAN and TLS modules. iOS 26 was listed as under evaluation. Apple also lists 2026 FIPS 140-3 certificates for its iOS 18 corecrypto modules, including sepOS hardware modules at Security Level 2 with Physical Security Level 3.

Samsung said in October 2014 that Knox based Galaxy devices were the first consumer mobile devices NIAP validated under the Mobile Device Fundamentals and VPN protection profiles and placed on the Commercial Solutions for Classified (CSfC) component list. Today NIST's validation program lists the Samsung Kernel Cryptographic Module under FIPS 140-3, overall Level 1, validated 1 May 2026 and active. Samsung's whitepaper stresses that certificates apply to specific hardware and software combinations and are renewed for each release. Its current certifications page did not render for my fetch, so check it and NIAP's product compliant list for your exact model and Android version.

The useful question is not "Apple or Samsung" but "is my model and OS version on the current list, and have I applied the evaluated configuration?"

Enterprise management: Apple Business Manager vs Knox Suite

Apple's deployment guide describes Apple Business Manager (listed there as Apple Business) working with your MDM for automated device enrolment, Managed Apple Accounts and supervision. Remember that Lockdown Mode blocks MDM enrolment and Stolen Device Protection delays it.

Samsung's Knox Suite bundles Knox Platform for Enterprise (work security controls), Knox Mobile Enrollment (bulk enrolment into your EMM), Knox Manage (Samsung's own EMM), Knox E-FOTA (schedule and push OS and security updates as campaigns), plus Asset Intelligence, Remote Support, Capture and Authentication Manager. Galaxy devices also support Google's Android Enterprise.

E-FOTA is what IT teams notice: test a firmware version on a pilot group, then roll it out on your schedule. On iPhone, MDM can defer and enforce updates, but the update is the one Apple ships to everyone. Samsung gives more knobs; Apple gives fewer variables.

Bug bounty programmes

Apple's research site says the Apple Security Bounty pays up to $2 million for exploit chains similar to real world attacks, and "over $5M" with bonuses, across remote, wireless proximity, physical access and sandbox escape categories. Samsung's Mobile Security Rewards Program pays $200 to $1,000,000, scaled by severity, affected scope (newer flagships pay more), difficulty and report quality, with the base reward doubled for strong High or Critical Android reports with a working proof of concept. Bounty size reflects exploit markets and vendor priorities, not a security score.

Repairability and parts pairing

Apple shows Parts and Service History in Settings > General > About on iOS 15.2 and later, labelling parts Genuine, Unknown, Unverified (a replaced logic board) or Used. Genuine parts are calibrated with data on Apple's servers, and Face ID or Touch ID will not work until calibration finishes in Repair Assistant. That is parts pairing in practice: visibility and protected biometrics, at the cost of tying some repairs to Apple's process.

Samsung runs a Self Repair programme with manuals for the Galaxy S25 family and Z Fold6, genuine parts through its distributor and an iFixit collaboration, and says some parts may need calibration after repair. Its page does not mention parts serialisation, and I found no Samsung page describing a pairing system, so this post claims neither way.

On both: use authorised repair for screens and biometric sensors, check the parts record afterwards, and change your passcode if a shop had the phone unlocked.

Step by step: harden either phone in 20 minutes

Menu names shift between versions; search Settings if a path differs.

iPhone

1. Update. Settings > General > Software Update; turn on Automatic Updates.
2. Passcode. Use a longer alphanumeric passcode in Settings > Face ID & Passcode.
3. Stolen Device Protection. Same menu. Consider "Always" if you commute through crowds.
4. Advanced Data Protection. Settings > your name > iCloud. Set up a recovery contact or key first and store the key offline.
5. Two factor authentication on your Apple Account, and passkeys where sites support them.
6. Lockdown Mode, if you are a likely target. Settings > Privacy & Security > Lockdown Mode, on each Apple device separately.
7. Profiles. Settings > General > VPN & Device Management; remove anything you did not knowingly install.

Galaxy

1. Update. Settings > Software update; turn on automatic download. Check the patch level date.
2. Screen lock. A strong PIN or password, not a pattern.
3. Auto Blocker. Settings > Security and privacy > Auto Blocker. Keep it on; add Maximum restrictions if you are a likely target.
4. Theft protection. Settings > Google > All services > Theft protection. Turn on everything your model offers.
5. Play Protect. Play Store > profile icon > Play Protect; leave scanning on.
6. Enhanced Data Protection. In Samsung Cloud settings; write down the 28 character recovery code.
7. Advanced Protection and device admin apps. Search Settings for both; turn on the first if offered and remove any device admin app you did not knowingly approve.

For an IT team

1. Enrol through Apple Business Manager or Knox Mobile Enrollment, never by hand.
2. Add an MDM compliance rule that flags devices more than one release behind.
3. On Galaxy fleets, stage firmware with Knox E-FOTA to a pilot group first.
4. Tell high risk staff that Lockdown Mode and Maximum restrictions conflict with MDM or work profiles, and who to call. Before a phone leaves the company, follow your reset checklist; see what a factory reset removes and what it leaves behind.

Common mistakes

• Comparing brands instead of models and ages. A four year old mid range phone on quarterly updates is a different product from a current flagship.
• Reading "up to 7 years" as "7 years for my phone." Samsung's wording is "up to," varying by model, market and carrier.
• Assuming Apple has no limit because it publishes none. Older iPhones do drop off. Check the security releases page for your model.
• Turning off Auto Blocker for one app and never turning it back on.
• Turning on Advanced Data Protection without saving the recovery key. Apple cannot recover your data.
• Leaving theft protection off. Both platforms' features must be on before the theft.
• Treating certifications as a blanket badge. They cover a specific model, OS version and configuration.
• Buying a carrier locked phone when patch speed matters. Samsung says some carriers only support quarterly updates.
• Expecting a hardening mode to fix an old OS. Apple recommends updating before turning on Lockdown Mode.
• Trusting a "threat notification" that asks you to click something. Apple says real ones never do.

Fix it without waiting for upstream

Phone operating system patches have to come from Apple, Google and Samsung, and nothing here changes that. But the apps your team ships to those phones, and the backends they talk to, are built from open source SDKs and dependencies you do control, and a well patched handset does not help if your own app carries a known vulnerable library.

Whatever the vulnerability, most of the risk sits in two gaps. The first is the time between a fix being published and that fix actually running in your production builds. The second, and worse, is the time before any fix exists at all, while a maintainer works out a patch and a release schedule. Waiting through both gaps is a habit, not a requirement. Safeguard gives teams three ways to close them.

1. Autonomous remediation: pull requests, not tickets

When a fixed version exists, Safeguard's Griffin models open a tested, policy gated pull request that moves the affected dependency to the safe version. You can run it on one repository or in bulk across every project that carries the vulnerable version. Remediation covers eight categories, including dependencies, licenses, security posture and findings. Reachability analysis ranks the vulnerable code paths your application actually calls first, so the first pull requests you merge are the ones that matter most. Autonomous remediation ships switched off, with every category set to Manual, so your team decides how much runs on its own and what still needs a human approval.

2. Gold Open Source: the safe version in seconds, free

gold.safeguard.sh is free and needs no login. Search any CVE or package to see affected and fixed versions, CVSS, EPSS, CISA KEV status and a recommended safe version, or use the "Am I affected?" checker. The same data is available through a free read API, README status badges and RSS threat feeds. The safeguard-sh/gold-scan-action GitHub Action can fail a build on a known exploited vulnerability, on any known vulnerability, or never, so a version you have just removed cannot quietly come back in next week's merge.

3. Gold Registry: start from components that are already fixed

registry.safeguard.sh provides hardened, drop in replacements for upstream packages and container images. Every Gold artifact is held continuously to zero exploitable critical or high CVEs, zero malware and a completed license check, with SLSA L3 or higher provenance, a Sigstore signature and a public evidence page you can hand to an auditor. An artifact loses its Gold badge if it regresses. Teams can point their own package directory at the registry so hardened equivalents resolve without changing how developers install anything.

When upstream has no fix yet, or will not ship one, Safeguard first works to get the fix accepted upstream. If the issue is severe or upstream will not move, Safeguard builds a fork, fixes the vulnerability there and publishes a hardened Gold build, so you are not stuck on a maintainer's release schedule. You can also request a hardened, compatibility tested build of a specific package. This fork and patch flow is in early access today, so ask which packages it covers before you plan around it.

One honest limit: when the vulnerable code lives in a vendor appliance, a hosted service or an operating system runtime you do not build yourself, the fix still has to come from that vendor or distribution. The steps above apply to the open source dependencies and container images you build and ship, which is where most teams carry the largest and least tracked share of their exposure.

Where Safeguard fits, honestly

Safeguard does not manage phones, scan them for malware, push OS updates or rate handsets, and it plays no part in choosing an iPhone or a Galaxy. The fit is on the software side: if your company builds iOS or Android apps, or the services behind them, Safeguard scans those repositories and container images, matches dependencies against vulnerability data, uses reachability to rank what matters, and can open fix pull requests when you turn remediation on. Safeguard's phone app also lets you send work to a computer running the Safeguard CLI and approve each command from your phone, so a fix can move forward while you are away from your desk, with a person approving every step.

FAQ

Is iPhone more secure than Samsung?

Not for everyone. The iPhone has the clearer public record against targeted spyware, including Lockdown Mode blocking BLASTPASS, and broader encrypted backups. Galaxy flagships offer a published "up to 7 years" update policy and deeper enterprise control. Both are strong when updated.

How many years of security updates does a Samsung Galaxy get?

Samsung says that from January 2024 it extended support "by up to 7 years" and lists which models get monthly or quarterly updates. It does not give the span per model, so check your model's tier and launch date.

How long does Apple support iPhones with security updates?

Apple states no fixed number on its consumer pages. Its security releases page shows it patching earlier iOS versions for older devices, such as iOS 18.7.10 in August 2026.

Does Samsung have something like Lockdown Mode?

Yes: Auto Blocker with Maximum restrictions, from One UI 6.1.1. Google's Advanced Protection adds another layer on supported Android devices.

Is Knox Vault the same as Apple's Secure Enclave?

They do the same job. Both are isolated security processors that keep keys and biometric data away from the main processor. Knox Vault adds a separate storage chip and is in select Galaxy devices from the S21.

Are Samsung phones approved for government use?

Samsung says Knox based Galaxy devices were the first consumer phones NIAP validated and CSfC listed, in 2014, and it holds a current FIPS 140-3 kernel crypto certificate. Approval applies to specific models and OS versions.

Why does my Samsung security update arrive later than other people's?

Google publishes its bulletin, Samsung builds per model and region firmware, and carriers may test it. Samsung notes some carriers only support quarterly updates.

Does Advanced Data Protection encrypt everything in iCloud?

No. It covers 25 categories including backups, Photos and iCloud Drive. Mail, Contacts and Calendars stay outside end-to-end encryption.

Should I turn on Lockdown Mode?

Only if your work or identity could make you a target, or Apple has sent you a threat notification. Apple says most people are never targeted this way, and the mode breaks some features.

See how Safeguard would help

These demos show the software side, not phone hardening. To try them yourself, download Safeguard and follow the CLI docs.

This first demo is a real Android session. You send work to a computer running the Safeguard CLI and approve the command on the phone with Allow once, Allow for turn or Deny. Whichever phone you carry, it becomes the approval point for fixes running on a machine you control, so nothing executes without a person saying yes.

Click through it at your own pace, or open it full screen.

The second demo is a real CLI session. You install the CLI, open the interactive terminal with safeguard, and ask it to "fix the lodash CVE in this repo"; it reads the finding and advisory, asks before each command, edits package.json to lodash 4.17.21, runs npm install and npm test with your approval, prints a summary and pushes nothing. The same flow applies to the JavaScript dependencies in a React Native app or the API behind a mobile app.

Click through it at your own pace, or open it full screen.

The third demo connects Claude to the Safeguard MCP server with OAuth and lets you choose which tools Claude can use. A mobile team can then ask about vulnerabilities in its app projects in plain language, with access limited to what it allows.

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Apple Support: About Lockdown Mode
• Apple Support: iCloud data security overview (Advanced Data Protection)
• Apple Support: About Stolen Device Protection for iPhone
• Apple Support: Apple security releases
• Apple Platform Security: The Secure Enclave
• Apple Security Research: Memory Integrity Enforcement
• Apple Newsroom: Apple announces changes to iOS, Safari and the App Store in the European Union (25 January 2024)
• Apple Support: About iCloud Private Relay
• Apple Support: About Apple threat notifications
• Apple Support: iPhone parts and service history
• Apple Platform Certifications: iOS security certifications
• Apple Platform Deployment: Apple School Manager and Apple Business
• Apple Security Research: Apple Security Bounty
• Samsung Mobile Security: Security updates scope and policy
• Samsung Mobile Security: Security Maintenance Release bulletins
• Samsung Mobile Security: Rewards Program
• Samsung Knox: Knox Vault (Knox security whitepaper)
• Samsung Knox: Knox certifications (Knox for Android whitepaper appendix)
• Samsung Knox: Knox Suite documentation
• Samsung Support: Protect your Galaxy device with the Auto Blocker feature
• Samsung Support: What is Enhanced data protection on Galaxy phones?
• Samsung: Self Repair
• Samsung Mobile Press: Galaxy devices based on Knox are the first consumer mobile devices NIAP validated and approved for US government classified use (21 October 2014)
• NIST CMVP: Certificate 5253, Samsung Kernel Cryptographic Module
• Android: Security bulletins
• Android: Android Security Bulletins overview
• Android Help: Protect your device against theft
• Android Help: Advanced Protection
• Google Play Help: Use Google Play Protect to help keep your apps safe
• Citizen Lab: BLASTPASS, NSO Group iPhone zero click, zero day exploit captured in the wild (7 September 2023)
• Safeguard: What a factory reset removes and what it leaves behind

Last reviewed: 23 October 2026.