[throawayonthe]

could you please elaborate on how you determine that your devices have been breached? e.g. referring to "anomaly free" makes it sound like you might witnessing non-security related unexpected behaviour? sorry for the doubt, i'm curious

[walterbell]

Explained at length below: after subjective indicator of possible breach, by monitoring, allowlisting and then deleting outbound network traffic sources (i.e. apps) on the device, then look closely at any remaining, non-allowlisted traffic, which should be zero.

apps: https://news.ycombinator.com/item?id=46993016 | https://news.ycombinator.com/item?id=46997970

Apple: https://news.ycombinator.com/item?id=46994394