Solutions · Mac fleets
Endpoint security for Mac that stops an app before it launches.
Macs are no longer the machines nobody attacks. ThreatBreaker gives your Mac fleet endpoint security built on Apple's own Endpoint Security framework: a malicious app is refused at launch, ransomware is contained, and every case arrives investigated.
macOS 12 and later, native on Apple silicon. Notarised by Apple, with a menu bar icon.
Built on Apple's own security framework
Apple gives security tools one supported way to see and decide what happens on a Mac: the Endpoint Security framework. It is the interface Apple built after retiring kernel extensions.
ThreatBreaker uses it to authorize every launch. When an app or binary is about to execute, macOS asks the agent first; the agent decides with its rules, signatures and an on-device model, and macOS enforces the answer. Alongside it, FSEvents file monitoring and rootkit scanning watch for what happens after launch.
What happens when something bad lands on a Mac
Pick a threat to see what ThreatBreaker does with it.
What the agent watches on macOS
Every launch
Endpoint Security events for process execution, with the authorization gate to deny.
Files
FSEvents file monitoring and YARA-X scanning of files at rest.
Rootkits
Rootkit scanning for what tries to hide from the system.
Rules and models
Sigma rules, hash and filename indicators, and an on-device machine-learning model.
Fresh intelligence
Threat-intelligence feeds refresh every six hours, on their own.
Known vulnerabilities
A per-Mac CVE inventory, scanned on first check-in and every week.
For the person using the Mac
A visible, notarised agent
Signed and notarised by Apple, with a menu bar icon instead of a hidden process and notifications that follow the system settings.
Plain-language notices
If something is stopped, the user is told what happened in words, separately from the alert to IT.
A report of their own machine
One click produces an HTML report of what the agent has collected and checked.
For whoever manages the fleet
Deploys through your MDM
Roll the agent out with Jamf, Kandji or Intune, natively on Apple silicon and Intel Macs.
Macs, PCs and servers in one table
Every agent with its client company, status, threats, CVEs and last-seen time.
Exceptions by hash only
Silence a rule for one binary by its content hash, never by name or path, because an attacker controls both.
Lite mode for non-analysts
One scrolling page with a plain-language explanation and a single button for each threat.
Protected offline
Detection runs on the Mac, so a laptop on a plane or off the VPN is still covered.
Configuration locked down
Agent settings are encrypted on the Mac, optionally bound to the macOS Keychain.
Approval by default
Isolating a Mac or deleting a file waits for a person unless you promote that playbook to Auto.
What it does not do
- –Manage your Macs. It is not an MDM: settings, apps and updates stay with your device management.
- –Restore files after ransomware. Keep Time Machine or another backup.
- –Cover iPhone or iPad. This is for macOS.
Mac endpoint security questions
- Do Macs need endpoint security?
- Yes. Macs are targeted by infostealers, adware, backdoors and ransomware, and in many companies they are the least monitored machines in the fleet.
- Isn't Apple's built-in protection enough?
- Gatekeeper and XProtect are a good baseline that blocks known threats. They do not investigate an incident, show you what happened across the fleet or let your team respond. ThreatBreaker adds those, alongside Apple's own protection.
- What is the best endpoint protection for Mac?
- One built on Apple's Endpoint Security framework that can refuse a launch rather than react afterwards, keeps working offline, and fits the console your team already uses for Windows and Linux.
- How is this different from a Mac EDR?
- A typical macOS EDR detects and raises an alert. ThreatBreaker also stops the launch, investigates the case and contains it, under rules you control: endpoint control and prevention rather than detection alone.
- Which macOS versions are supported, and does it run on Apple silicon?
- macOS 12 and later, running natively on Apple silicon as well as Intel Macs.
- How do I deploy it across a Mac fleet?
- Through your MDM, such as Jamf, Kandji or Intune. The agent is signed and notarised by Apple, so it installs like any trusted macOS software.
- Will it slow the Mac down?
- It is built to stay out of the way: one small native agent, with heavier scans throttled. Our whitepaper's indicative figures are tens of MB of RAM and under 1% CPU at idle; re-measure on your own Macs.
See it stop an app on a Mac.
Thirty minutes: a launch refused, the case it leaves behind, and the fleet view across Mac, Windows and Linux.