Active Incident? 24/7 Response →
SleuthX

Read this first

Are you on a device or network the person can see?

  • If they might be able to see this device, use one they can’t access — a friend’s phone, a library or public computer, or a domestic-violence shelter’s safe device. If you continue here, your visit may be visible on a synced iCloud, Google account, or shared family plan.
  • If you think spyware or stalkerware is on this device, removing it can alert the person monitoring you and can destroy evidence. Make a safety plan — ideally with a domestic-violence advocate — before you remove anything, and use a device they can’t access in the meantime.
  • The Quick Exit button(top right) replaces this page with weather.com immediately — but it does noterase this visit from your history, and private/incognito mode doesn’t fully hide it either. To be safe, use a device the person can’t access.
  • If you’re in immediate danger, call 911. If you have a few quiet minutes, keep reading.

National Domestic Violence Hotline: 1-800-799-7233 · text START to 88788 · thehotline.org — 24/7, free, confidential.

988 Suicide & Crisis Lifeline: call or text 988 · 988lifeline.org — free, confidential crisis and emotional support, 24/7.

NNEDV Safety Net: techsafety.org — technology-safety help for survivors.

Device Hardening

Apple Lockdown Mode for High-Risk Users

Lockdown Mode is a free, built-in Apple setting that sharply reduces the ways mercenary spyware can reach your device. It is one of the most useful protections a targeted journalist can turn on — and it is not a force field.

Lockdown Mode is an optional, extreme protection built into iPhone, iPad, Mac, and Apple Watch. Apple designed it specifically for the small number of people who may be targeted by the most sophisticated, state-grade spyware — a group that includes some journalists, their sources, and human-rights defenders. It is free and already on your device; you do not buy or install anything.

What it actually does

Lockdown Mode works by shrinking the attack surface— it switches off or restricts the features that targeted exploits most often abuse. Per Apple’s documentation, that includes limiting certain message attachment types, disabling some complex web technologies unless you trust a site, blocking unsolicited FaceTime calls and invitations, and restricting wired connections to a locked device. Fewer open doors means fewer ways in.

What you give up

Because it disables features on purpose, some things will not work as smoothly: certain websites may render incompletely, some message attachments will not preview, and a few apps may behave differently. For most high-risk users that trade-off is worth it, but it is a real one — turn it on deliberately, not by reflex.

The honest limit

Lockdown Mode reduces risk; it does not guarantee safety.It makes a successful attack meaningfully harder and more expensive, which is the whole point against a targeted adversary. But no single setting makes a phone un-hackable, and turning it on does not undo a compromise that already happened. If you think you have already been targeted, treat the device carefully — see how a journalist checks a phone for spyware.

Where it fits

Lockdown Mode is one layer in a larger plan: strong account protections, a current operating system, careful communication habits, and a realistic threat model. Put it in context with digital security for journalists and threat modeling your reporting. The free helplines in the sources can walk you through enabling it.

Primary sources

  1. Apple, About Lockdown Mode — official documentation (iOS, iPadOS, macOS, watchOS). https://support.apple.com/en-us/105120
  2. The Citizen Lab (University of Toronto), Research on mercenary spyware targeting high-risk users. https://citizenlab.ca/
  3. Access Now, Digital Security Helpline — free guidance for journalists and activists. https://www.accessnow.org/help/

Meet Your Practitioner

Quinnlan Varcoe

Founder & CEO

GIAC-certified · 15 industry certifications

With operational experience across Fortune 50 security programs and the defense industrial base, Quinnlan founded SleuthX in 2022 to provide clients with the caliber of expertise typically reserved for the largest enterprises. Her work in threat intelligence and digital forensics has earned the trust of 26,000+ cybersecurity professionals who follow her analysis.

“26,000 professionals follow my work because I say what others won't — and I can back it up technically.”

Fortune 50 BackgroundDefense IndustryThreat IntelligenceDigital PrivacyIncident Response
Quinnlan Varcoe, Founder & CEO

Certified Expertise

GIAC · AWS · Splunk · CompTIA

Transparent pricing

Trusted by partners across the practice

DAS Health
Exhibit A Cyber
Ally Security
KIRO Group
Black Mirage
Kalles Group
Gridware
CQR
Archstone Security
Cyvergence
Sentinel Cyber
Cloud Underground
Seron Security
Hexen
Koru Risk Management
DAS Health
Exhibit A Cyber
Ally Security
KIRO Group
Black Mirage
Kalles Group
Gridware
CQR
Archstone Security
Cyvergence
Sentinel Cyber
Cloud Underground
Seron Security
Hexen
Koru Risk Management