Swift Academy Podcast, Episode 12, Season 2
Modern iOS Security: Attacks, Defenses & AI
Dave Poirier and Deya Elkhawaldeh on iOS security as an engineering culture problem rather than a tooling one, and on what AI has already changed for the people attacking your app.
Watch the Episode
Why This One Matters
“Apple handles security for us” is, according to both guests, the single most expensive misconception in iOS development. The platform gives you good defaults. It does not give you a threat model.
This is not a conversation about theoretical vulnerabilities or hacker theatre. It is about engineering culture, architecture, and the gap between what developers assume the OS protects and what it actually protects. The uncomfortable part is how small the mistakes are that open the largest attack surfaces.
The second half looks at what AI has changed. Work that used to demand deep expertise can now be automated and scaled, which moves the floor for attackers rather than the ceiling. That reframes when security has to enter a project: not before shipping, but on day one.
The Conversation
How small mistakes become large surfaces
- The implementation errors that show up again and again in shipped iOS apps
- What developers assume the device protects, and where that assumption fails
- Why the responsibility sits with the engineering team, not with a security review at the end
Thinking like the attacker
- How attackers actually choose targets, and why they start with the low-hanging fruit
- Where jailbreaking stands today, and whether it still deserves the attention it gets
- What defending an app realistically looks like in 2026
- Why a defensive culture beats any individual tool
What AI moved
- How AI-driven tooling accelerates offensive work, and what that does to the economics of an attack
- The same tooling on the defensive side, and where it genuinely helps
- How far to trust AI inside a development workflow that has security consequences
- Which security myths survive, and which best practices actually hold up
About the Guests
Dave Poirier & Deya Elkhawaldeh
iOS security specialists • Runtime protection, application hardening, defensive security
Dave Poirier and Deya Elkhawaldeh work on runtime protection, application hardening and defensive security techniques for Apple platforms. Dave is also the co-author, with Walid Sassi, of AI Driven Swift Architecture (Packt), and a recurring voice on the security thread that ran through the first season of this podcast.
Key Takeaways
- The platform is not your threat model. Apple's defaults are good and they are not a substitute for deciding what you are protecting and from whom.
- Attackers start with the easy wins. Most breaches do not need a sophisticated exploit, they need one careless implementation detail.
- Culture beats tooling. A team that reasons about security during design will outperform one that buys a scanner and runs it at the end.
- AI raised the floor for attackers, not the ceiling. Work that once required an expert is now automated, so the volume of competent attacks goes up.
- Security belongs on day one. Retrofitting it after the architecture is set is where the cost explodes.
Resources & Links
Listen & Subscribe
If your team still treats security as something that happens after the feature is built, this is the episode to send them.