Apple builds in a huge array of tools that help if your device is physically compromised, as when someone gains access to your iPhone or computer without your permission, someone takes your device away without your knowledge or steals it in order to try to break into it, or when someone extracts hardware (like a drive) from your Mac.
Apple created the chip-based Secure Enclave technology for iPhones and iPads, then expanded it for Macs starting with Intel models. It’s an integral part of Apple silicon Macs. Secure Enclave was a big improvement for device security and data integrity.
Apple created the Secure Enclave coprocessor, first for the iPhone, as a way to provide a tamper-resistant one-way vault to handle encryption secrets, biometric information, and many kinds of private data. The design of the Secure Enclave prevents Apple from accessing information inside it, so the chip that contains it can’t be removed or manipulated without almost always destroying its contents.
Technically, the Secure Enclave is a component of a system-on-chip (SoC), a single piece of silicon that integrates all the functions that previously required separate silicon, such as a CPU, memory, and various I/O chips.
The Secure Enclave coprocessor is part of all Apple silicon Macs. It’s also found in Intel Macs with the T1 chip (for the Touch Bar) or T2 Security Chip; Apple’s support site lists the starting models. All Macs that can run Sonoma or later have a Secure Enclave. You can install macOS 26 Tahoe on all Apple silicon Macs, but only the last series of Intel models support it; macOS 27 Golden Gate works only on Apple silicon Macs. (Most Macs with a Secure Enclave can run macOS 14 Sonoma or later, but fewer work with Tahoe.)
All iPhones from the iPhone 5s onward have it, as do all iPad models introduced since the iPad Air in 2013.
Not surprisingly, Apple’s other devices with its A-series mobile chips also have a Secure Enclave: the Apple TV (HD and later), Apple Watch (all models), and HomePod (all models).
The Secure Enclave is used for a number of different purposes, some of which are directly relevant to this chapter:
- Touch ID/Face ID: Fingerprints are enrolled and stored securely within, and logins send patterns to the Secure Enclave to match.
Note: The Magic Keyboard with Touch ID enables fingerprint recognition on Apple silicon Macs by pairing directly with the Secure Enclave in a proprietary secure wireless process.
- SSD encryption: All iPhones and iPads with a Secure Enclave encrypt all data stored on their invisible “startup volume.” All Macs with a T2 chip or Apple silicon processor have an internal SSD startup volume, and that volume has always-on, hardware-based disk encryption.
- Storage of encryption keys: Apple uses the Secure Enclave to keep the raw stuff of encryption unavailable to anyone—even Apple. Developers can also make use of the Secure Enclave for keys they want their apps to store.
- Boot integrity (Mac): The Secure Enclave has some hardcoded information that prevents subverting a Mac when it starts up. Startup is a bootstrap process, like “pulling oneself up by one’s bootstraps.” Little bits of software get more complicated pieces of software running in a cascade until the OS is running. With the Secure Enclave, the first stage is loaded from read-only memory—instructions burned permanently into silicon—and each subsequent stage relies on encrypted validation to avoid hijacking.
Secure Enclave has no management associated with it that you have access to. It’s just neatly there carrying out cryptographic and validation operations behind the scenes.
Memory Integrity Enforcement
Starting with A19- and M5-family devices—the iPhone 17, iPhone Air, and M5-based Macs—Apple built in an extra tier of exploit protection called Memory Integrity Enforcement (MIE). Because of Apple’s system architecture and security focus, they have avoided large-scale malware attacks on their platforms that have plagued other companies. Generally, most of us are safe nearly all of the time from all but phishing attacks.
But it doesn’t mean your devices are immune! Smart companies look at the edges to see what’s missing to fill in the picture, and that’s what MIE does, although this may never have an impact on you. MIE is designed to block particular kinds of “mercenary spyware,” as Apple terms it: products designed to execute against specific targets, developed by companies and sold to governments, or created inside government agencies.
For a computing device to run software, the software must be loaded into memory. From memory, the operating system executes code, which carries out operations, including reading from and writing to memory, a video display, external storage, a network, and more. Memory is divided by the system into what used to be logical chunks—that is, the operating system defined these, but there wasn’t a particular prohibition against software writing in any place in memory. Some parts of memory help the operating system; some are drivers or code that manage interactions with hardware; and some are designed for user space, meant for user-loaded programs and data.
Over decades, that’s changed, where the operating system and hardware restrict how different components of a system and loaded software can write to memory. These restrictions have increasingly reduced the attack surface of malware by making it harder for an attacker to circumvent the operating system and run code where they want.
MIE blocks a common form of exploit, in which an attacker pushes more information into a response or request than the code executing it can handle. This can result in a buffer overflow, in which data spills past the end of the chunk of memory set aside for it and corrupts whatever sits alongside (typically values and pointers that other parts of the program rely on). Attackers use that corruption as a foothold to read secrets or take control of the program.
With MIE, these buffer overflows are blocked at the hardware level: every allocation of memory is marked with a secret tag. Malware can’t write into adjacent allocations because those carry a different tag, and the processor refuses at a hardware level to let data be written there, which stops the app from running. MIE also blocks attempts to read or write the same memory locations after an app releases them for other uses, because those locations receive a fresh tag or tags when they’re reallocated; this foils “use-after-free” exploits.
Apple spent years testing this solution and evaluated it against six real-world exploit chains, or sequences of exploited vulnerabilities strung together to gain control or access information that had previously been used against their platforms. Components of MIE blocked all of them. Apple says they couldn’t rebuild any of the chains to get around MIE, even by swapping in new exploits.
Security researchers reported in May 2026 that they had been able to work around MIE in macOS 26.4.1, and disclosed their findings to Apple.
Now, you will likely never be attacked by top-tier criminals or a government’s security agency. (See whether you need more security than Apple’s defaults; and if you are a target, see Lockdown Mode.) These exploit chains previously cost millions to develop and, if created by companies, were sold for huge sums to governments, which deployed them against high-value targets.
Nonetheless, by making such chains far more expensive to build and maintain, MIE reduces the odds that these techniques would ever trickle down to become attacks aimed at the rest of us.
Password lockout protections
On an iPhone, iPad, or Mac with a Secure Enclave, you can’t keep entering an incorrect password without the system taking notice and action. Or, more particularly, someone trying to break into your device cannot try over and over.
After your device has started up and reached a point at which you can enter an account password or passcode, and that secret is repeatedly entered incorrectly, Apple enforces certain limits and timeouts.
An iPhone, iPad, Mac, and even Apple Watch have the same initial timeout and lockout sequence. You can enter your password incorrectly at the login window or passcode entry field up to four times in a row without a delay between entries. However, after the fourth try, Apple adds a one-minute delay before you can try again. After the fifth, five minutes; after the sixth, 15 minutes; seventh, 1 hour; eighth, 3 hours; and ninth, 8 hours. If your tenth password entry fails, the path splits, as described below. Restarting a device doesn’t reduce the time you wait.
If you enabled the erase option on an iPhone or iPad, after the tenth attempt, the device is wiped. However, Apple notes that “consecutive attempts of the same incorrect password don’t count toward the limit.”
With an iPhone, iPad, or Apple Watch, you have to connect to another device: an iPhone or iPad to a Mac or Windows system; an Apple Watch to an iPhone. The device can’t be unlocked, but can be erased and restored.
With macOS, however, Apple provides up to 40 (yes, 40!) additional login attempts through other means to ensure you have the greatest possible options before permanent lockout:
- Restart in recovery mode (see how macOS protects its own system files). You can try up to 10 times to enter a correct password for a login account after clicking the Options button.
-
If that fails, you have 10 attempts each for:
- iCloud recovery
- FileVault recovery
- Use of an institutional key, if your Mac is managed by a company
If all of the above fails, Secure Enclave locks the volume: it will no longer process any effort to decrypt your startup volume or verify a password you enter. The drive’s data is unrecoverable. The Mac has to be erased and a new system installed to use it again.
