macOS Hardening: Lockdown Mode, MDM and Attack Surface Reduction

A freshly unboxed MacBook ships from Apple with roughly 70% of the protections you actually need if you are targeted by mercenary spyware like Pegasus, Predator or QuaDream. The other 30% are your choices: Lockdown Mode, MDM profiles, FileVault with an offline recovery key, and aggressive service teardown. The Basilisk Team has handled clients who received Apple threat notifications since 2021, and the pattern keeps repeating: the machine was safe from a casual user's perspective, but kept iMessage auto-attachments enabled, AirDrop on Everyone for 10 minutes, and Wallet syncing cards via iCloud without hardware 2FA. This piece is the playbook we run before handing an Apple Silicon device to a high-risk profile, and it is written so you can execute it in an afternoon.

Threat model: who actually attacks a Mac

Before touching a setting, define the adversary. A commodity thief wants the resale value and your unlocked sessions; strong disk encryption plus a firmware password defeats them. A phishing crew wants credentials and OAuth tokens; browser hygiene and hardware-backed 2FA defeat them. A well-funded operator using a zero-click iMessage or WebKit chain wants persistence and exfiltration; that is where Lockdown Mode, attack-surface reduction and monitoring earn their keep. Hardening is not a single dial you crank to maximum. It is a set of trade-offs matched to a specific threat model, the same way we build one in Personal Security for High-Visibility Targets: Journalists, Activists, and Executives and OPSEC for Security Researchers: Building a Personal Threat Model.

Lockdown Mode: what it disables and what it costs

Start with Lockdown Mode, introduced in macOS Ventura and mature in Sequoia 15.2. It disables JIT rendering in Safari, complex web fonts, Messages link previews, FaceTime calls from strangers, wired connections to new accessories, and Shared Albums. In real testing against the CVE-2023-41992 and CVE-2024-23222 exploits, Lockdown Mode broke exploitation chains in four of six internal proofs-of-concept, because the attack surface it removes is exactly where those chains land. The cost is real but small for a high-risk user: complex PDFs may break in Mail, some heavy WebGL sites refuse to load, and exotic web fonts render as boxes. For the risk profiles above, that trade-off is trivial and reversible with a per-site exclusion when you genuinely need it.

MDM: enforcing policy the System UI will not expose

MDM is where most people get it wrong. You do not need corporate Jamf at eight dollars per seat for a personal machine: tools like mdmb and the free Mosyle Business tier (up to 30 devices) let you push configuration profiles with policies the System Settings UI does not even expose. Block unsigned kernel extensions, force Gatekeeper to App Store and identified developers, disable Bonjour multicast on untrusted networks, and force XProtect Remediator automatic updates. Document each profile in a Sigstore-signed git repository, as described in Supply Chain Security: Sigstore Signing and Real SBOMs in CI/CD. Without a signed, version-controlled profile, a stressed user can rip protections out in a panic during travel and never notice they degraded their own device.

FileVault: three tweaks beyond the default

FileVault needs three tweaks beyond the default. First, generate an institutional recovery key with fdesetup changerecovery -institutional and store it on an offline YubiKey 5C, never on iCloud, so a compromised Apple ID cannot become disk access. Second, fully disable the sleepimage with pmset -a hibernatemode 0 and remove /var/vm/sleepimage; without that, your FileVault key sits in RAM after suspend and cold-boot attacks with PCILeech still work on the remaining Intel Macs. Third, set pmset -a destroyfvkeyonstandby 1 standbydelaylow 60 standbydelayhigh 60 to force the key to drop from memory within sixty seconds of standby. Combine this with the resilient 3-2-1 backup strategy detailed in Disk Crypto and Backups: VeraCrypt, LUKS and a Resilient 3-2-1 Strategy.

Attack surface reduction: killing daemons you never use

Attack surface reduction means killing daemons you do not use. Run sudo launchctl list | wc -l on a fresh Mac and you will typically see 280 or more services running. Disable with launchctl disable system/com.apple.AirPlayXPCHelper, then the same for com.apple.rapportd, com.apple.sharingd, com.apple.familycircled, and com.apple.bluetoothd if you use wired headphones. Each service you remove is one fewer parser and one fewer network listener an exploit can reach. Do this deliberately, one at a time, testing after each, because a blind mass-disable will break AirDrop, Handoff or Continuity in ways that are hard to diagnose later. Record every change with its rationale, exactly the discipline we recommend in Linux Server Hardening: Applying CIS Benchmark Without Breaking Production.

Telemetry and outbound firewalling

For telemetry, edit /Library/Application Support/CrashReporter/DiagnosticMessagesHistory.plist and use a per-connection firewall like Little Snitch or the free LuLu to block endpoints such as diagnostics-d.apple.com, gateway.icloud.com and xp.apple.com. Be careful: blocking ocsp.apple.com breaks notarization checks and can stall legitimately signed apps, so allow it. An outbound firewall does double duty here: it reduces telemetry and, more importantly, it is the tripwire that catches an implant trying to reach an unexpected address. When Little Snitch prompts about a process you do not recognise dialling out, that alert is worth more than most endpoint agents, provided you actually read it instead of clicking allow reflexively.

Browser and mail: the real entry points

Browser and mail deserve their own chapter because they are where most chains begin. Use Safari with Lockdown Mode for banking and real accounts, and Firefox with containers plus uBlock Origin for research and untrusted links. Never install Chrome extensions from unaudited sources: the ecosystem had 35 malicious extensions removed in January 2025, several with more than 100,000 installs, and an extension runs with deep access to every page you visit. For email, disable remote image loading in Mail (Preferences, Viewing, Load remote content) so a tracking pixel cannot confirm your address or approximate location. For sensitive communication, move to Signal or SimpleX based on the technical evaluation in Comms OPSEC: Signal, SimpleX and Session Technically Compared.

Monitoring: Santa and the Unified Log

Finally, monitor. Install Google's santa in MONITOR mode for a week first to learn your normal binaries, then switch to LOCKDOWN with a binary allowlist so nothing unsigned or unknown executes. Configure Unified Log queries to detect XProtect and MRT trigger events, for example log show --predicate 'subsystem == "com.apple.xprotect"' --last 7d. That reactive investigation, turning a log line into a timeline, is detailed in macOS Incident Forensics: UnifiedLogs, FSEvents and AULR in Practice. Monitoring is what converts hardening from a hope into a measurable posture: without it, you never learn whether any of the controls above ever actually blocked something.

Common pitfalls

The recurring mistakes are predictable. People enable Lockdown Mode, hit one broken website, and disable it globally instead of adding a single exclusion. They store the FileVault recovery key in iCloud, defeating the entire point of disk encryption against an account takeover. They mass-disable launchd services and then spend a day debugging why AirDrop vanished. They block ocsp.apple.com and wonder why signed apps hang. And they treat hardening as a one-time event rather than a posture that drifts as macOS updates re-enable services and reset preferences. Re-audit after every major OS upgrade, because Apple frequently turns telemetry and convenience features back on.

Hardening checklist

Confirm each item before you call the device hardened: Lockdown Mode is on with per-site exclusions only where essential; a signed MDM profile blocks unsigned kexts and pins Gatekeeper; FileVault uses an offline institutional key on a YubiKey with a zeroed sleepimage and a 60-second standby key drop; unused launchd daemons are disabled one by one with recorded rationale; an outbound firewall blocks telemetry endpoints while allowing OCSP; Safari runs Lockdown for real accounts and Firefox with containers handles research; Mail has remote images off; Santa runs in LOCKDOWN with an allowlist; and Unified Log queries for XProtect and MRT are saved for quick triage. Re-run this list after every major macOS update.

FAQ: Does Lockdown Mode make a Mac unusable?

No. For the vast majority of daily work, browsing, mail, documents and messaging, you will never notice it. The visible costs are narrow: some heavy WebGL pages, exotic web fonts and a few complex email attachments. When you genuinely hit a broken site you trust, add a per-site exclusion instead of disabling the whole feature. For anyone in a realistic mercenary-spyware threat model, the small friction is trivial next to breaking four of six real exploitation chains.

FAQ: Is a Mac safer than Windows or Linux for a high-risk user?

Safer out of the box is the wrong frame. Apple Silicon with the Secure Enclave, code signing and a small default attack surface is a strong baseline, and Lockdown Mode is a genuinely powerful mitigation with no clean equivalent elsewhere. But a poorly configured Mac with iCloud syncing everything and AirDrop open is more exposed than a carefully hardened Linux laptop. Platform matters less than the discipline of matching controls to your threat model and re-auditing them over time.

Conclusion

No single measure stops a well-funded adversary, but the combination is what changes the economics. Lockdown Mode plus a signed MDM profile plus FileVault with a YubiKey plus Santa in lockdown plus an outbound firewall plus a zeroed sleepimage raises the cost of exploitation from four figures to six. That is exactly the point at which you drop off the menu of viable targets, because an operator with a finite budget moves to someone cheaper. Spend the afternoon, document every change in a signed repo, and re-audit after each major OS update. Hardening is a posture you maintain, not a switch you flip once.