LastPsyOp: Read the Full Brief
Objectives
- State who you are protecting against before choosing anything
- Tell market risk apart from person risk
Lesson
Security advice is useless until you say what you are protecting, from whom, and what happens if you fail. Everyone's answers differ, and the tools follow from the answers rather than the other way around.
Most people face a market rather than an enemy. Credential stuffing, phishing at scale, data brokers, opportunistic theft — none of it is personal, and all of it is automated.
Unremarkable measures defeat it: updates, a password manager, a strong second factor, a credit freeze, backups. If that is your situation, the work is one afternoon and then maintenance.
Some people face a person. An ex-partner, a stalker, a colleague, someone in the household. This is a different problem: the adversary knows your answers to security questions, may have had physical access to your devices, may be on the family plan or the shared account, and may escalate when they lose access.
Generic advice can make it worse — removing monitoring software can tell them they have been found. If this is your situation, the right first move is advice from a domestic-violence technology service, not a settings menu.
A few people face a targeted, well-resourced adversary because of what they do: journalists, activists, officials, people handling sensitive investigations. That is what the high-risk modes on both phone platforms are built for, and they work by deliberately removing capability.
Work out which of these you are in before you spend a weekend on the wrong problem. The LastPsyOp Posture Check is built around the first case, and it flags the points where the second case needs different advice.