What a compromised Mac actually looks like
Not a skull on the screen. A paste into Terminal, a file with an Apple-sounding name, and a quiet connection out. Here is the whole sequence, and what you can check yourself.
Blog
Field notes on Mac and Linux threats.
What attacks on small Mac and Linux teams actually look like, and what to do about them, written for people who don't have a security department.
Why we don't install a kernel driver
Our agent runs entirely in user space. That gives up some visibility, and we think it's the right trade for a small company. Here's the reasoning, including the part that isn't flattering.