Apple adds a dormant Endpoint Security stack to the iOS 27.2 beta
Firmware analysis found a gated kernel extension and user-space library, while Apple's public Endpoint Security API remains limited to the Mac.
By Ryan Merket · Published
Primary source: IRIS C2 on X
Why it matters
Apple could gain desktop-style exploit telemetry on iPhones without granting third-party security vendors equivalent kernel access, tightening its control over mobile threat detection.
Apple has placed the foundations of an Endpoint Detection and Response system inside the first iOS 27.2 beta, adding kernel-level monitoring code that could give the operating system deeper visibility into attempted exploits and compromised processes.…
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.