In the next version of Santa, when paired with Workshop you'll be able to specify process tree relationships in a CEL rule. This lets you mark executables as not usable by processes or require TouchID from the user e.g. here's an example of us preventing Claude Code from running curl w/o TouchID.

Day 24 of our FAAdvent Calendar: Code injection is a major threat to binary allowlisting, especially when Electron/Chromium offer easy scripting/debugging northpole.security/blog/2025-ad... Workshop and Santa's CEL rules can prevent attackers from using debugging options to inject malicious code.

Day 23 of our FAAdvent Calendar: Learn how to use Workshop's Risk Engine with entitlements to flag unauthorized VPN and remote access software, preventing data exfiltration and enforcing compliance. northpole.security/blog/2025-ad...

Day 22 of our FAAdvent Calendar: macOS audio plugins are an old often overlooked persistence trick. northpole.security/blog/2025-ad... Malicious .component or .driver bundles dropped in well-known directories can execute code, sometimes as root. Lock them down!

Day 21 of our FAAdvent Calendar: macOS's built-in security command can be used for nasty actions like dumping Keychain contents or adding rogue certificates. Stop these attacks using Workshop and Santa CEL rules: northpole.security/blog/2025-ad...

Day 20 of our FAAdvent Calendar: Living off the land (LoTL) is a common attack technique. Learn how to use CEL rules to block potentially malicious subactions of legitimate tools like systemsetup, instead of blocking the tool entirely. northpole.security/blog/2025-ad...

Day 19 of our FAAdvent Calendar: SSH private keys are master keys for your systems. 🔑 northpole.security/blog/2025-ad... Infostealers like Atomic, Banshee, and Cthulhu target your ~/.ssh/ folder! Learn how to lock them down with Workshop and Santa’s file access Rules.

📢 We’ve just released version 2025.1010 of Workshop This release adds: 🎄 on-demand monitor mode 🎄 optional automatic updates 🎄 event export to S3/GCS 🎄 near-realtime directory syncing 🎄 local user/group management 🎄 added cwd & euid fields to CEL rules 🎄 live online status on the host details page

Day 18 of our FAAdvent Calendar: Don't let "Sploitlight" (CVE-2025-31199) leak your sensitive macOS data! northpole.security/blog/2025-ad... Attacks bypass TCC to exfiltrate files like Apple Intelligence databases. See how to prevent this persistence trick and data theft with Workshop and Santa:

Day 17 of our FAAdvent Calendar: Enhance your password manager security! 🛡️🔐 northpole.security/blog/2025-ad... Beyond the account password, using file access rules can prevent other apps from reading your database, protecting you even if encryption is compromised.

Day 16 of our FAAdvent: Attackers are using Docker on macOS to hide from security tools! They run containers in a Linux VM, bypassing Endpoint Security Framework & can still steal credentials by mounting host volumes. See how Santa and Workshop can prevent this: northpole.security/blog/2025-ad...

Day 15 of our FAAdvent Calendar: Apple changed macOS's dynamic loader to write temp files to disk, but stealthy attackers adapt. Learn how to use Workshop & Santa’s file access rules to block this basic technique: northpole.security/blog/2025-ad...

Day 14 of our FAAdvent Calendar: Learn how attackers can bypass macOS Gatekeeper by stripping the quarantine attribute with xattr, and see how to block this technique using Workshop and Santa's CEL rules. northpole.security/blog/2025-ad...

Day 13 of our FAAdvent Calendar: Workshop and Santa's file access rules can lock down cron and at job persistence before attackers even get a chance to set their alarms. northpole.security/blog/2025-ad...

Day 12 of our FAAdvent Calendar: Launch Agents and Daemons are a convenient way for programs to run in the background, but they’re also a great way for malware to gain persistence on a device. northpole.security/blog/2025-ad...

Day 11 of our FAAdvent Calendar: Prevent persistence by securing /etc/pam.d with a Santa file access rule. Block write attempts even from root! northpole.security/blog/2025-ad...

Day 10 of our FAAdvent Calendar: A one-liner command is all you need to see if a password is legit, but Santa's CEL rules can stop this common post exploitation behavior. northpole.security/blog/2025-ad...

Day 8 of our FAAdvent Calendar: Hide your macOS password hashes! A one-liner command can expose the hash and salt, but Workshop & Santa's file access rules & CEL rules can protect these crown jewel files. northpole.security/blog/2025-ad...

Day 7 of our FAAdvent Calendar : Prevent macOS Gatekeeper from being disabled on your fleet by creating a Santa CEL rule! northpole.security/blog/2025-ad...

Day 6 of our FAAdvent Calendar: Protect your browser cookies from infostealers with Santa's File Access Rules—limit access so only the browser can read its own cookies! northpole.security/blog/2025-ad...

We've started our FAAdvent Calendar a collection of short things you can do with Workshop and Santa to improve improve your security while staying productive. northpole.security/blog/2025-ad...

'Tis the season for new features. 🎁 Introducing On-Demand Monitor Mode in Workshop & Santa—monitor mode access only when you need it, only when you prove you're at the keyboard. Check out the Loom ⬇️ www.loom.com/share/0c09ed...

Join us in celebrating North Pole Security's first anniversary! 🎉 Reflect on a year of innovation, growth, & unwavering commitment to livable security with Santa and Workshop. Read about our journey and what's next! #FirstAnniversary #Santa #Workshop northpole.security/blog/one-yea...

Yesterday we released Santa v2025.8 on GitHub. github.com/northpolesec... This release includes a handful of new features. Some highlights include: - Support for CEL string extensions to enable writing more powerful policies. This lets you do things like args.join(" ").contains("-flag option")

Incredibly humbled by the amazing feedback from our community! Thank you for growing with us - here's to continuing to build something great together! 🚀

Keeping with our Christmas in July🎄, we just released Santa 2025.7 on GitHub github.com/northpolesec... This release includes: - A new icon that matches the company's branding - Ready for Tahoe! - Bug fixes and more

🎉 It's Christmas in July! We raised $4M to make proactive macOS security scalable for everyone. Workshop is the first commercial platform built for Santa. Finally making allowlisting usable at scale. Thanks to A16Z & everyone's who's believed in our mission.

📢 Earlier this month we released Santa 2025.6 github.com/northpolesec... 🧵 This is a large release with several features

📢 We've just released Santa v2025.5 on GitHub github.com/northpolesec... This release includes a handful of new features and changes: Some highlights Below 🧵:

Very exciting to see Santa called out as a tool that works in the @specterops.io SO-Con talk on Modern macOS Red Teaming Tactics by Lance Cain and @werdhaihai.bsky.social www.youtube.com/watch?v=t_L2...

📢 Last week we released Santa v2025.4 github.com/northpolesec... Along with some big changes 🧵

Today we released Santa v2025.3 on GitHub github.com/northpolesec.... This release includes a handful of new features.

We agree with CISA and think you should use Santa too www.cisa.gov/sites/defaul...

📣 We’ve just released Santa v2025.2 on GitHub. github.com/northpolesec... Some highlights include: - Process-centric File Access Authorization rules are now in Beta! This means FAA rules can now target all access from a given process without knowing the files that will be accessed ahead of time.

Last night we released Santa 2025.1 github.com/northpolesec... Notable features include: Entitlements in the Sync Protocol This allows you to avoid authorizing or see which applications are disabling code signing on libraries.

We've released v2024.12 of Santa. github.com/northpolesec... This addresses an upgrade issue when running in lockdown mode and also a minor issue where a root user is able to inject rules when it is configured to use a sync service is configured.

Today we're excited to release Santa v2024.11! github.com/northpolesec... Highlights: 1. Our initial beta for standalone mode: This lets you authorize binaries using TouchID. So you can live in lockdown mode. www.youtube.com/watch?v=Hd4t...

Our co-founders (Russell Hancox and @plm.bsky.social) were recently on the @MacAdmPodcast talking about Santa and @northpolesec.bsky.social podcast.macadmins.org/2024/11/19/e...

Today is Santa's 10th Birthday 🎂🎉. The first commit was from Russell Hancox at 4:23 PM

Last week we made our first Open Source release of Santa version 2024.10 github.com/northpolesec... Highlights: 1. Streamlined UI with silencing options and added a button to copy relevant data to the clipboard to help users report issues / blocks to security