// 9TO5MAC — MOBILE & WEB
Security Bite: Apple details Secure Exclaves, a glimpse at its ambient computing future
9to5Mac Security Bite is exclusively brought to you by Mosyle, the only Apple Unified Platform. Making Apple devices work-ready and enterprise-safe is all we do. Our unique integrated approach to management and security combines state-of-the-art Apple-specific security solutions for fully automated Hardening & Compliance, Next Generation EDR, AI-powered Zero Trust, and exclusive Privilege Management with the most powerful and modern Apple MDM on the market. The result is a totally automated Apple Unified Platform currently trusted by over 45,000 organizations to make millions of Apple devices work-ready with no effort and at an affordable cost. Request your EXTENDED TRIAL today and understand why Mosyle is everything you need to work with Apple.
Apple published a new security research post this week detailing Secure Exclaves, a new architecture built to handle what the company calls “ambient sensing.” The latter isn’t anything new. “Hey, Siri” has been using a version of this always-on listening technology for years. The difference now (particularly on newer devices like Apple Watch Series 12 and HomeView) is new features need far more data from your surroundings, and Apple has changed where that data gets processed.
Today, on most Apple hardware, wake-word detections run locally on-device on a smaller, low-power chip. But once it thinks it heard you say “Hey, Siri,” the main operating system gets involved to confirm and wake up the smart assistant for use. There’s nothing necessarily wrong with this process. The split second of audio is all processed locally and not sent to Apple servers.
The problem lies in Apple’s newer features that ask for a lot more from users than a wake word.
Person recognition on HomeView identifies who’s in the room by face and voice, and Siri Recap and Live Rewind need to keep a running sense of what’s been happening around you. That adds up to a constant stream of sensitive camera and mic data, and it needs a more secure way of being processed than anything Apple had before.
Much like the existing Secure Enclaves architecture for authentication, instead of passing operations to the main OS, Secure Exclaves (notice the x) run their own tiny, separate operating system. Raw data goes in and a simple “that’s Arin” or “that’s the wake word” is outputted back to the OS, everything else is thrown away. According to Apple, that data “cannot be accessed by the main operating system, apps, or Apple.”
The changes don’t stop there. In recent SB column, I mentioned how on iPhone, the green dot that appears indicating that the camera or mic is live is all software connected, not like the hardwired LED that exists on the Mac. Now on iPhone 18 Pro, iPhone Duo, and MacBook Neo, the camera and mic indicators now live inside this new exclave, meaning even a compromised OS shouldn’t be able to hide them for malicious purposes.
It’s apparent Apple is building toward this new level of ambient computing across every type of device when you read technical reports like this. Future AI-first products, like the heavily rumored AirPods Pro with inferred cameras, will most certainly built on this new Secure Exclave architecture.
Overall, this new technical post reads like Apple laying the privacy groundwork for the always-listening, always-watching products that are here and coming in the near future. It’s the privacy-first approach we’ve come to love from Apple and further demonstrates its lead on this front. I highly recommend checking it out.
Security Bite is 9to5Mac’s weekly deep dive into the world of Apple security. Each week, Arin Waichulis unpacks new threats, privacy concerns, vulnerabilities, and more, shaping an ecosystem of over 2 billion devices. Every other week on the Security Bite Podcast, he sits down with experts in the field to break down the most pressing topics.