Apple Intelligence Enterprise Security: CISO Guide 2026

Apple Intelligence enterprise security is no longer a future concern. Since iOS 18.3 shipped in January 2025, Apple Intelligence has been on by default across every supported iPhone, iPad, and Mac in your fleet. If your organization has not deployed a configuration profile to control it, the models are running now, processing email content, summarizing documents, and in some cases offloading tasks to Apple's Private Cloud Compute infrastructure. This guide covers what security teams actually need to know: the confirmed attack surface, the PCC compliance gaps that affect regulated industries, the MDM restrictions that work (and those that do not), and how WWDC 2026 expanded the risk profile with iOS 27 and new agentic Siri capabilities.

The Attack Surface: On-Device Models Plus PCC Hybrid Architecture

Apple Intelligence runs across two distinct execution environments, and the security properties of each are different.

The on-device tier runs two models locally: a text-focused model and a new multimodal model introduced at WWDC 2026 for text and image tasks. On-device processing means data does not leave the device for those requests, which is a meaningful privacy control. The on-device models have direct access to system APIs: Mail, Messages, Calendar, Notes, Reminders, and third-party apps that expose data through App Intents. This access is what makes the platform useful, and it is also what makes prompt injection consequential.

The Private Cloud Compute tier handles tasks that exceed on-device model capacity. PCC uses Apple-designed server hardware running a purpose-built OS with no persistent storage and cryptographic attestation of the software stack. Apple cannot log or store request data, and the PCC architecture has been reviewed by independent security researchers at Apple's invitation. At WWDC 2026, Apple announced PCC expansion onto Google Cloud infrastructure and NVIDIA hardware for higher-capacity workloads, extending the same cryptographic commitments to third-party data centers for the first time.

The hybrid nature of the architecture creates ambiguity. From the device, it is not always clear to the user (or to security tooling) whether a given request was processed on-device or sent to PCC. Apple provides no real-time telemetry of PCC routing decisions to enterprise MDM systems.

Confirmed Vulnerabilities: Neural Exec and Unicode Injection

In April 2026, researchers from the RSAC Research Lab published the technical details of two prompt injection techniques that bypassed Apple Intelligence safeguards. The disclosure followed coordinated vulnerability reporting to Apple in October 2025.

The first technique, Neural Exec, generates adversarial inputs using a machine-learning optimization algorithm. The inputs look like nonsensical text to a human reader but act as execution triggers for the on-device model, causing it to perform attacker-specified actions. Because the trigger is optimized computationally rather than handcrafted, it is difficult to filter with signature-based defenses.

The second technique exploits Unicode's right-to-left override (RLO) character (U+202E) to conceal malicious instructions inside text that renders normally in the interface. The model processes the actual character sequence, not the rendered display, so the hidden instruction executes while the visible text appears benign.

Combined, these two techniques achieved a 76% success rate across 100 test cases against Apple Intelligence on-device models. Apple patched the affected systems in iOS 26.4 and macOS 26.4, released March 24, 2026.

What the patch does not resolve is the underlying attack class. Prompt injection through untrusted content retrieved by an AI model, whether from an email, a web page, a document, or a calendar event, is an architectural challenge rather than a fixable bug. The real-world impact of an exploit is bounded by what data and capabilities the model can access. In enterprise environments where Siri AI reads CRM records, ITSM tickets, and financial documents (see the iOS 27 App Intents expansion below), that bound is significantly wider than it is on a personal device.

Private Cloud Compute Compliance Gaps

The PCC architecture provides genuine privacy protections. Apple has made the PCC OS binary verifiable by any third party, and the attestation model prevents modified software from being deployed to PCC nodes. For many enterprise use cases, this is sufficient.

For regulated industries, the gaps are specific and material.

HIPAA: Apple will not sign a Business Associate Agreement for Apple Intelligence or Private Cloud Compute. Without a BAA, any PHI processed through Apple Intelligence falls outside the HIPAA-covered arrangement. Healthcare organizations, health insurers, and their business associates must treat Apple Intelligence as a non-covered service. The practical consequence: any Apple Intelligence feature that might summarize or process email, notes, or documents on devices that handle PHI must be blocked via MDM.

Data residency: Apple has explicitly stated it does not disclose the physical location of PCC nodes, citing "non-targetability" as the reason. This design choice, while defensible from a privacy standpoint, makes it impossible for an enterprise to satisfy data residency requirements that mandate processing within a specific jurisdiction. GDPR Article 44 transfer restrictions, FINRA Rule 4370 data location requirements, and various state-level privacy laws that specify intra-country processing cannot be satisfied when the processor refuses to disclose node geography.

PCI DSS: Any Apple Intelligence feature that could process cardholder data (CHD) as part of summarizing communications or documents creates a potential scope expansion under PCI DSS. Since Apple Intelligence operates at the OS level and reads content from apps, organizations with narrow PCI scope need to assess whether device-level AI processing brings CHD into scope.

GDPR Article 28: PCC processes personal data on behalf of the user. Apple's privacy documentation describes the data handling obligations, but it does not constitute a Data Processing Agreement that meets Article 28 requirements for EU personal data. Organizations subject to GDPR should consult legal counsel on whether PCC processing requires supplementary contractual controls.

MDM Restriction Matrix: What You Can Block and What You Cannot

Apple Intelligence restrictions apply only to supervised devices enrolled through Apple Automated Device Enrollment (ADE). A device that was updated to iOS 18.3 without a supervision profile in place had Apple Intelligence activate automatically. BYOD devices, unsupervised corporate devices, and devices enrolled via user-initiated enrollment are not subject to Apple Intelligence restriction keys.

What MDM Can Disable

The following features can be blocked via MDM restriction payload keys on supervised devices running iOS 18.1 / macOS 15.0 or later:

| Feature | MDM Key | Effective Since | |---|---|---| | Writing Tools | allowWritingTools | iOS 18.1 / macOS 15.0 | | Image Playground | allowImagePlayground | iOS 18.1 / macOS 15.0 | | Genmoji | allowGenmoji | iOS 18.1 / macOS 15.0 | | Mail summaries | allowMailSummary | iOS 18.1 | | Safari summaries | allowSafariSummary | iOS 18.1 | | External intelligence integrations | allowExternalIntelligenceIntegrations | iOS 18.2 | | External intelligence workspace IDs | allowExternalIntelligenceIntegrationWorkspaceID | iOS 18.2 |

The allowExternalIntelligenceIntegrations key is particularly significant: it controls whether third-party AI services (such as ChatGPT, which Apple integrated via OpenAI partnership) can be invoked from Apple Intelligence. This is a separate exposure from Apple's own models.

What MDM Cannot Disable

The following Apple Intelligence features currently have no MDM restriction keys and cannot be blocked via configuration profile:

• Visual Intelligence (point-at-real-world-objects feature via camera)
• Natural Language Search in Photos
• Clean Up (AI object removal in Photos)
• Enhanced Siri context awareness
• Siri AI cross-app action capabilities introduced in iOS 27

Siri AI's cross-app intelligence in iOS 27 is the most consequential gap. Siri AI can now read from and take action across apps that expose App Intents data, including third-party enterprise apps for CRM, ITSM, project management, and finance. There is no MDM key to restrict which apps Siri AI can access or what data it can read.

Supported MDM Platforms

The Apple Intelligence restriction keys are supported across Jamf Pro, Microsoft Intune, Workspace ONE, Kandji, Mosyle, SimpleMDM, ManageEngine Mobile Device Manager Plus, and Addigy.

WWDC 2026: Session 347 and the iOS 27 Attack Surface Expansion

WWDC 2026 marked the first time Apple dedicated a developer session explicitly to the security risks of AI features. Session 347, "Secure your app: Mitigate risks to agentic features," covered indirect prompt injection, data exfiltration via AI tool calls, lock-screen action invocation, and action poisoning within the App Intents framework. Apple's acknowledgment in a developer session that these are active, exploitable risks is meaningful: it signals that the attack surface is real and that third-party apps built without mitigations are vulnerable today.

iOS 27 and macOS 27 expand the App Intents exposure. Siri AI in iOS 27 can reach across apps to read customer records in CRM systems, open tickets in ITSM platforms, project tasks, invoices, calendar events, documents, and expenses, and it can take action on them. The attack surface this creates is what researchers describe as the "lethal trifecta": an assistant that can read private data, ingest untrusted content, and transmit or act on information, all triggered by a malicious instruction embedded in content the assistant reads.

For enterprise security teams, the practical implication is that a salesperson's iPhone with access to Salesforce via App Intents is now a potential exfiltration vector if an attacker can get a prompt injection payload into any content the Siri AI reads. This is not hypothetical: the same mechanism that enables Siri AI to summarize a support ticket can be used to instruct it to forward data to an attacker-controlled endpoint if the ticket contains a crafted injection payload.

CISO Decision Framework: Policy Tiers for Apple Intelligence

The all-or-nothing framing ("block everything" versus "allow everything") does not reflect the actual controls available or the risk levels across different user populations. A more useful approach is a tiered policy based on data access:

Tier 1: Block all Apple Intelligence (highest-restriction environments). Apply this to supervised devices that handle PHI, CHD, or classified data. Use the restriction payload to disable Writing Tools, Mail summaries, Safari summaries, Image Playground, Genmoji, and all external intelligence integrations. Accept the productivity trade-off in exchange for compliance certainty. Supplement with shadow AI monitoring to detect employees who attempt to use personal devices to circumvent corporate restrictions.

Tier 2: Block external integrations, allow on-device features. Apply this to devices in regulated but not HIPAA/PCI-scoped roles. Disable allowExternalIntelligenceIntegrations to prevent ChatGPT and other third-party AI services from receiving data via Apple Intelligence. Allow on-device features (Writing Tools, Genmoji) where the data stays on the device. Monitor for iOS 27 Siri AI app access patterns.

Tier 3: Audit mode for general workforce devices. Allow Apple Intelligence features for standard users but deploy logging and monitoring to establish baseline behavior before iOS 27's expanded cross-app capabilities go live. Review which enterprise apps have published App Intents schemas to assess what Siri AI can reach.

For regulated industries that cannot satisfy the HIPAA BAA or data residency requirements, Tier 1 is not optional; it is the only compliant configuration. For everyone else, the enterprise AI acceptable use policy should explicitly address Apple Intelligence as a distinct category from enterprise AI tools, since it operates at the OS level rather than as an app the user chooses to open.

Enterprise Hardening Checklist

The following checklist applies to organizations managing Apple devices via MDM. Prerequisites: supervision via ADE and an MDM platform with Apple Intelligence restriction support.

Immediate (apply before next OS update cycle):

• Audit supervision status of all enrolled devices; unsupervised devices cannot receive Apple Intelligence restrictions
• Deploy restriction payload with allowExternalIntelligenceIntegrations: false to all supervised devices
• Disable allowWritingTools: false and allowMailSummary: false on any devices with access to PHI, CHD, or high-sensitivity data
• Review which enterprise apps have published App Intents schemas that Siri AI can access
• Confirm all devices are running iOS 26.4 / macOS 26.4 or later to receive the Neural Exec patch

Before iOS 27 deployment:

• Inventory all App Intents integrations across enterprise app catalog
• Apply allowExternalIntelligenceIntegrations: false to any device tier that should not allow third-party AI service access
• Brief application owners on Session 347 mitigations: indirect prompt injection hardening, data exfiltration mitigations via tool call controls
• Update AI incident response playbook to include Apple Intelligence-specific triage steps (on-device model action logs, App Intents execution records, PCC request indicators)

Ongoing:

• Monitor NowSecure, RSAC Research Lab, and Apple Security Research for new vulnerability disclosures specific to Apple Intelligence
• Review MDM restriction key updates with each major iOS release: Apple has added new keys with each point release since iOS 18.1
• Include Apple Intelligence in annual AI security assessments alongside other enterprise AI tools

Conclusion

Apple Intelligence enterprise security requires a different security posture than managing a SaaS AI application. The features are embedded in the OS, on by default, and the controls that exist apply only to supervised, ADE-enrolled devices. Regulated industries face real compliance gaps: no HIPAA BAA, no data residency transparency from PCC, and Siri AI's expanded cross-app access in iOS 27 creates a prompt injection attack surface that has no current MDM-level mitigation.

The Neural Exec patch addressed a specific exploitation path, but it did not change the underlying architecture. As long as Siri AI can read enterprise data across apps and act on it, prompt injection via untrusted content remains an active risk. Security teams that treat Apple Intelligence as an MDM problem alone are missing the AI security layer that sits underneath.

If you want to assess your current Apple Intelligence exposure, including which features are active across your device fleet and which enterprise data Siri AI can reach, book an AI security assessment or run a Securetom scan to identify uncontrolled AI access paths in your environment.