Secure By Design: Inside the SecurePhone's Defenses Against Commercial Spyware

Commercial spyware used to be a nation-state problem. It isn't anymore. This monetized industry now sells the ability to silently take over a phone, no click required, to any government willing to pay, and increasingly to buyers well outside government. According to the Carnegie Endowment for International Peace, at least 74 governments, nearly 40% of all nations, have contracted with commercial firms for spyware or digital forensics technology since 2011.

Most of the mobile phone market's response has been to make the phone you already own harder to compromise: opt-in security modes, hardened versions of the same operating systems, feature restrictions you have to remember to turn on. These approaches have real value. But they all work by restricting a foundation that was never built with the threat of commercial spyware in mind.

The Sotera SecurePhone starts from a different premise. Instead of hardening a general-purpose operating system after the fact, it's built on an architecture designed to remove the specific conditions most commercial spyware depends on to function. Below is a plain-language walk-through of how that works. If you want the full technical detail, you can download our technical brief on how the SecurePhone defends against commercial spyware.

Why a Fully Updated Phone Isn't a Protected Phone

Keeping your phone's operating system updated closes known vulnerabilities and remains genuinely worthwhile. But that protection only covers flaws that have already been discovered and patched, and the most advanced commercial spyware runs on zero-day vulnerabilities that haven't been. Paired with zero-click delivery, no tap, no link, no mistake required, that means a fully updated phone can still be exposed to an attack nobody has found yet.

To put this in perspective, in January 2025, a European journalist's iPhone was silently compromised by Paragon's Graphite spyware, not through a careless click, but through a zero-click iMessage exploit that required nothing from her at all. Her phone was fully updated at the time. Citizen Lab, the research group that later confirmed the infection, could only trace it back after the fact. Apple didn't patch the underlying flaw until months later.

This isn't a one-off. Commercial surveillance vendors, the companies that build and sell spyware like Pegasus, Graphite, and Predator, have now overtaken state-sponsored hacking groups as the leading exploiters of undisclosed vulnerabilities for the first time since Google began tracking the data, according to a March 2026 Google Threat Intelligence Group analysis. The reason is straightforward: general-purpose operating systems paired with open app ecosystems give well-funded attackers a target that's both large and static enough to justify sustained investment. Every vulnerability found in iOS or Android applies to well over a billion devices at once. That scale isn’t about attacking every device, in fact, commercial spyware is typically used in narrow, targeted campaigns against specific individuals. But vendors sell to a wide roster of clients, so an exploit has to work across a huge pool of devices to be worth reselling.

The Market Has Responded With Settings, Not Architecture

To be clear, the industry hasn't ignored this. Apple's Lockdown Mode and Google's Android Advanced Protection Mode both strip back messaging, browsing, and connectivity functionality specifically to shrink what an attacker can reach, and both have a genuinely strong track record. Apple has told reporters it isn't aware of any successful mercenary spyware attack against a Lockdown Mode–enabled device, a claim independently backed by both Amnesty International's Security Lab and Citizen Lab.

The limitation isn't effectiveness. It's timing and reliance on the user. Both modes are opt-in, which means protection only exists once someone has already decided they're a plausible target and turned it on. That's a difficult bar to clear against an attack category defined by leaving no visible trace to react to. The protection isn't even constant for people who do enable it. Lockdown Mode, for example, blocks incoming FaceTime calls from anyone the user hasn't previously been in contact with in the past 30 days. Someone expecting a call from a new source or contact has one option: turn Lockdown Mode off for the entire device. Every one of those moments is a return, briefly, to the device's full, ordinary attack surface.

That's the pattern across the market's response. Every current option is a restriction layered onto a foundation, iOS or Android, that was designed for openness first and retrofitted for protection after the fact. The protection is a mode you step into. It isn't the ground the device stands on.

Five Principles Behind SecurePhone's Architecture

The SecurePhone takes a different starting point: instead of restricting an open platform, it removes the conditions most commercial spyware needs to work in the first place. Here's the high-level picture, five layers, each closing off a different piece of how spyware typically gets in and spreads.

Protection #1: An Operating System Built for the Threat

The SecurePhone doesn't run iOS or Android. It runs Green Hills Software's Integrity-178B, a real-time operating system with no shared codebase, architecture, or exploit history with the platforms commercial spyware is built to attack. Its track record was forged in defense and avionics systems, environments under sustained attention from well-resourced adversaries for years, and it holds the highest security certification a commercial operating system has ever received. iOS and Android, by contrast, have never been evaluated at that level, or at any comparable level at all.

Protection #2: Attack Surface Reduction by Design

The second layer is what simply isn't there. No app store, no capability to install or download software, no web browser. Not switched off by a setting, but absent from the device as built. Wi-Fi, Bluetooth, and GPS hardware physically exist inside the phone but were never implemented in the firmware, so there's no active stack to attack. This is a different kind of claim than an opt-in restriction. There's no dormant capability sitting behind a setting, waiting to be reactivated by a configuration profile or a toggle someone forgets to flip back on.

Protection #3: No Exposed Inbound Connections

Nearly every zero-click attack needs the same thing to work: a way to reach the phone. The SecurePhone closes off that pathway by not exposing any open ports or listening services that something on the outside could connect to directly. Every network connection is initiated by the device itself, outbound, to Sotera's servers. Calls and messages still reach you. Sotera's servers notify the device through the connection it already has open, and the device pulls the message through that existing channel. There's simply no point in that process where an outside party can initiate contact with the device directly.

Protection #4: Isolating the Unknown With Sanitation Compartments

Closing off inbound connections handles one delivery path, but a message from a known contact still has to be received and processed once it arrives. By default, incoming data on the SecurePhone is decoded first inside an isolated, disposable compartment, separate from the rest of the system. If anything about that decoding fails or behaves unexpectedly, it's treated as a contamination event: everything that touched the data is cleaned, and nothing moves further into the device. This isn't a mode you can turn off. It's how the device handles incoming data every time, by default.

Protection #5: 96 Partitions, Enforced at the Hardware Level

The last layer is what happens if something still goes wrong somewhere. The SecurePhone is divided into 96 discrete hardware-level partitions, enforced at the kernel and hardware level rather than by software convention alone. Every driver and application, regardless of function, runs inside its own partition, restricted to a virtualized version of the hardware it's actually authorized to use. If spyware did manage to compromise one part of the device, a single driver or application, that compromise is confined to the partition it occurred in by default. There's no automatic path from one compromised process into the keys, messages, or drivers held in another.

Encryption Is Part of This, But It's Not the Whole Story

It's easy to assume encrypted messaging is the same thing as spyware protection. It isn't.

Pegasus and similar tools don't break the cryptography protecting a message. They compromise the device itself and read data from the same place the legitimate app does, before it's encrypted for sending or after it's decrypted for display. That's exactly why encrypted apps like WhatsApp and Signal don't stop spyware: their encryption secures the connection between devices, not the device itself. Once a device is compromised, that protection is bypassed, not broken.

The SecurePhone uses the same encryption protocol family as Signal to encrypt voice and text between two SecurePhones. That encryption keeps communications private in transit, but it's a different layer of protection from the five above, addressing a different threat. Together, they cover both problems: spyware getting onto the device, and communications being intercepted in transit.

Read the Full Technical Brief

This post covers the architecture at a high level. The technical brief, Secure By Design: Inside SecurePhone's Defense Against Commercial Spyware, goes further: the specific encryption protocols and key management design, how the partition architecture is enforced at the kernel level, and the full scope of independent penetration testing by Netragard, the security firm that validated the SecurePhone's core claims.