You might have heard about the notorious Pegasus malware in the news. It's made headlines for its high-profile targets, like journalists, activists, and government officials. But here's the thing: understanding Pegasus matters without assuming everyone faces the same risk. Apple says the vast majority of users will never be targeted by mercenary spyware. These are highly resourced, individually targeted attacks—not everyday malware campaigns.
What is Pegasus, and why should you care?
Pegasus is powerful spyware developed by NSO Group. Once installed on a target's phone, it can collect sensitive communications and enable surveillance through the microphone and camera. Amnesty International's July 16, 2026 technical analysis, drawing on internal NSO documents and forensic investigations, describes these capabilities and the government-customer systems used to operate Pegasus. Talk about a privacy nightmare!
Pegasus isn't just a hypothetical human-rights concern. The 2021 Pegasus Project investigation documented spyware attacks and abuses, including attacks against human rights defenders. Its findings are historical evidence, not a claim that every person named as a potential target was successfully infected.
Nor can Pegasus simply infiltrate any device at will. Successful infection depends on a viable attack method for the target's device. Amnesty's July 16, 2026 analysis describes both one-click attacks and zero-click attacks, which require no interaction from the target. Infection methods change as vendors patch vulnerabilities and new exploits are developed.
Why Pegasus matters to individuals and private businesses
Pegasus should not be confused with ordinary opportunistic cybercrime. Apple describes mercenary spyware attacks as exceptionally sophisticated operations directed at a very small number of specific people, often because of who they are or what they do. For a private business, the useful question is whether particular employees face that kind of targeted surveillance risk—not simply how large the company is.
If a phone containing business information were compromised, confidential communications, customer information or intellectual property could be exposed. Those are possible consequences, not evidence that Pegasus routinely targets all businesses. Our advice: take the threat seriously where the circumstances warrant it, while keeping everyday cybersecurity protections in place.
Key takeaways and action steps
- Update your devices: Keep devices and software up-to-date with the latest security patches. Updates are a core part of Apple's security guidance, but don't treat them as a guarantee against every targeted attack.
- Be cautious with links and attachments: Be wary of unknown links and unfamiliar senders. This remains useful security hygiene, but Pegasus zero-click attacks can require no interaction at all.
- Use unique passwords and enable two-factor authentication (2FA): These are recommended account-security measures, not a substitute for protecting the device itself.
- Monitor your digital footprint—and take credible warnings seriously: Review account activity, but don't assume that an absence of visible symptoms proves a phone is clean. If you receive an Apple threat notification, verify it by going directly to your Apple Account website. Apple recommends expert assistance, including Access Now's Digital Security Helpline, for notified users.
- Consider Lockdown Mode if you face targeted risk: On supported Apple devices, Lockdown Mode reduces the features attackers may exploit, but also limits some apps, websites and functions. On iPhone or iPad, open Settings > Privacy & Security > Lockdown Mode, then follow the prompts to turn it on and restart. Update your devices first. This is optional, extra protection for people facing unusually sophisticated attacks—not a necessary setting for everyone.
- Educate your team: Make sure employees understand the difference between everyday malware and targeted spyware. Consider a clear route for escalating credible spyware warnings to qualified security specialists.
- Consider cybersecurity insurance: For businesses, insurance may be worth discussing as part of financial risk planning. Don't assume a policy covers a particular spyware incident, and don't treat insurance as a way to prevent infection.
In today's interconnected world, cybersecurity deserves attention—but Pegasus risk isn't evenly distributed. Keep the basics strong, seek tailored help if you have credible reasons to believe you're being targeted, and avoid promises of complete protection. Stay cyber smart!