Day 14 of our FAAdvent Calendar: Learn how attackers can bypass macOS Gatekeeper by stripping the quarantine attribute with xattr, and see how to block this technique using Workshop and Santa's CEL rules. northpole.security/blog/2025-ad...

Day 13 of our FAAdvent Calendar: Workshop and Santa's file access rules can lock down cron and at job persistence before attackers even get a chance to set their alarms. northpole.security/blog/2025-ad...

Day 12 of our FAAdvent Calendar: Launch Agents and Daemons are a convenient way for programs to run in the background, but they’re also a great way for malware to gain persistence on a device. northpole.security/blog/2025-ad...

Day 11 of our FAAdvent Calendar: Prevent persistence by securing /etc/pam.d with a Santa file access rule. Block write attempts even from root! northpole.security/blog/2025-ad...

Day 10 of our FAAdvent Calendar: A one-liner command is all you need to see if a password is legit, but Santa's CEL rules can stop this common post exploitation behavior. northpole.security/blog/2025-ad...

Day 8 of our FAAdvent Calendar: Hide your macOS password hashes! A one-liner command can expose the hash and salt, but Workshop & Santa's file access rules & CEL rules can protect these crown jewel files. northpole.security/blog/2025-ad...

Day 7 of our FAAdvent Calendar : Prevent macOS Gatekeeper from being disabled on your fleet by creating a Santa CEL rule! northpole.security/blog/2025-ad...

Day 6 of our FAAdvent Calendar: Protect your browser cookies from infostealers with Santa's File Access Rules—limit access so only the browser can read its own cookies! northpole.security/blog/2025-ad...

We've started our FAAdvent Calendar a collection of short things you can do with Workshop and Santa to improve improve your security while staying productive. northpole.security/blog/2025-ad...

'Tis the season for new features. 🎁 Introducing On-Demand Monitor Mode in Workshop & Santa—monitor mode access only when you need it, only when you prove you're at the keyboard. Check out the Loom ⬇️ www.loom.com/share/0c09ed...

Join us in celebrating North Pole Security's first anniversary! 🎉 Reflect on a year of innovation, growth, & unwavering commitment to livable security with Santa and Workshop. Read about our journey and what's next! #FirstAnniversary #Santa #Workshop northpole.security/blog/one-yea...

Yesterday we released Santa v2025.8 on GitHub. github.com/northpolesec... This release includes a handful of new features. Some highlights include: - Support for CEL string extensions to enable writing more powerful policies. This lets you do things like args.join(" ").contains("-flag option")

Incredibly humbled by the amazing feedback from our community! Thank you for growing with us - here's to continuing to build something great together! 🚀

Keeping with our Christmas in July🎄, we just released Santa 2025.7 on GitHub github.com/northpolesec... This release includes: - A new icon that matches the company's branding - Ready for Tahoe! - Bug fixes and more

🎉 It's Christmas in July! We raised $4M to make proactive macOS security scalable for everyone. Workshop is the first commercial platform built for Santa. Finally making allowlisting usable at scale. Thanks to A16Z & everyone's who's believed in our mission.

📢 Earlier this month we released Santa 2025.6 github.com/northpolesec... 🧵 This is a large release with several features

📢 We've just released Santa v2025.5 on GitHub github.com/northpolesec... This release includes a handful of new features and changes: Some highlights Below 🧵:

Very exciting to see Santa called out as a tool that works in the @specterops.io SO-Con talk on Modern macOS Red Teaming Tactics by Lance Cain and @werdhaihai.bsky.social www.youtube.com/watch?v=t_L2...

📢 Last week we released Santa v2025.4 github.com/northpolesec... Along with some big changes 🧵

Today we released Santa v2025.3 on GitHub github.com/northpolesec.... This release includes a handful of new features.

We agree with CISA and think you should use Santa too www.cisa.gov/sites/defaul...

📣 We’ve just released Santa v2025.2 on GitHub. github.com/northpolesec... Some highlights include: - Process-centric File Access Authorization rules are now in Beta! This means FAA rules can now target all access from a given process without knowing the files that will be accessed ahead of time.

Last night we released Santa 2025.1 github.com/northpolesec... Notable features include: Entitlements in the Sync Protocol This allows you to avoid authorizing or see which applications are disabling code signing on libraries.

We've released v2024.12 of Santa. github.com/northpolesec... This addresses an upgrade issue when running in lockdown mode and also a minor issue where a root user is able to inject rules when it is configured to use a sync service is configured.

Today we're excited to release Santa v2024.11! github.com/northpolesec... Highlights: 1. Our initial beta for standalone mode: This lets you authorize binaries using TouchID. So you can live in lockdown mode. www.youtube.com/watch?v=Hd4t...

Our co-founders (Russell Hancox and @plm.bsky.social) were recently on the @MacAdmPodcast talking about Santa and @northpolesec.bsky.social podcast.macadmins.org/2024/11/19/e...

Today is Santa's 10th Birthday 🎂🎉. The first commit was from Russell Hancox at 4:23 PM

Last week we made our first Open Source release of Santa version 2024.10 github.com/northpolesec... Highlights: 1. Streamlined UI with silencing options and added a button to copy relevant data to the clipboard to help users report issues / blocks to security