Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
macOS TCC decides which apps can reach the camera, microphone and files. MITRE T1548.006 explained, with the abuse paths, detection signals and mitigations such as MDM scoping.
Just-in-time access, impersonation and PassRole can all become escalation paths when misconfigured. MITRE T1548.005 explained, with CloudTrail signals and least privilege steps.
The AuthorizationExecuteWithPrivileges API lets any program ask for root with a password prompt. MITRE T1548.004 explained, with detection and mitigation steps.
Sudo remembers your password for a while and the sudoers file can skip it entirely. MITRE T1548.003 explained, with the settings that close the gap and signals to log.
UAC bypasses let a process reach high integrity without a prompt. MITRE T1548.002 explained, with auto-elevation, registry and process signals, plus UAC settings and read-only checks.
A binary with the setuid bit runs as its owner, which makes it a privilege escalation target. MITRE T1548.001 explained, with detection signals and a read-only audit command.
Setuid, UAC, sudo, macOS prompts, TCC and cloud role elevation all share one idea. MITRE T1548 explained, with detection analytics, mitigations and a cross-platform checklist.
Login items launch apps at macOS login, and two different mechanisms create them, one of them hidden from System Preferences. MITRE T1547.015 explained, with detection and a review command.
Active Setup runs a StubPath program for each user at logon, and attackers can plant their own entry. MITRE T1547.014 explained, with what to log and why prevention is limited.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
