MacOS Frequently Asked Questions (FAQ’s)
macOS
BlackFog supports macOS 13 (Ventura) and above, this includes macOS 14 (Sonoma) and macOS 15 (Sequoia). It natively supports both Apple M Series and Intel processors running 64 bits.
BlackFog has closely aligned the macOS edition with its Windows counterpart. It has 95% feature parity and uses the same AI based algorithms. It shares the same rulesets and additionally includes macOS specific threats.
The macOS platform has undergone many changes over the last few years that has now made it possible to provide similar functionality to our Windows platform without reverting to raw kernel drivers. Apple has introduced system extensions that can be managed and deployed more seamlessly within the enterprise. We also took the opportunity to rewrite our entire architecture in Swift to future proof the product on macOS and provide rapid updates. This will ensure better support and ultimately make macOS safe and secure from escalating threats.
Yes. We price our macOS edition the same as our Windows edition. The goal is to ensure you can cover your entire enterprise at the same cost, no matter what platform or mix of platforms you use.
Apple takes security and privacy very serious. As a result they demand full disclosure when a product requires elevated permissions or installs system extensions like BlackFog requires. When you manually deploy the mac edition you will be asked to approve 3 things.
- Installation of a system extension
- Activate the network extension, and finally
- Allow the BlackFog filter
There is no way to bypass these dialogs, as they are mandated by Apple to ensure the user is aware of what it is happening. If you are system administrator and using a management solution you can bypass these dialogs by installing the package remotely.
No. To get the best protection BlackFog has designed each agent to work natively on each operating system. It is highly optimized to leverage the hardware using low level API’s. A specific version that operates on iPads will be available soon.
Yes. BlackFog operates natively on both Intel and M1 based macs as long as they use macOS 13 or later.
Yes. The macOS edition can operate with any other software, including VPN’s, and runs seamlessly in the background.
If you are using the Privacy relay feature under System Settings > iCloud > Private Relay you will notice less blockings than normal. This is because your system is redirecting traffic through iCloud and effectively hiding the destination of requests by some applications. While BlackFog will still pickup nefarious bad actors on other levels of the operating system it will not see general browser activity through Safari.
The initial release of BlackFog for macOS does not support Chrome because it requires support for Chromes QUIC network protocol. This is a low level protocol that uses UDP instead of TCP for web browsing. While BlackFog operates across the entire operating system using UDP and TCP, special handling is required for Chrome. An updated version with Chrome support is forthcoming.
Anti Data Exfiltration (ADX)
The goal of any cyberattack is data theft. Adding an ADX solution to a security strategy ensures that there is nothing for an attacker to gain. Without data exfiltration there is no breach, no ransom and no extortion. When cybercriminals can’t steal data, they move on to the next target.
We know that any cybercriminal intent on infiltrating a device or network will eventually find a way in, regardless of the perimeter defense solutions that are in place. ADX looks at the problem in a new way. By making the assumption that bad actors will get into the network, it focuses on preventing them from leaving with an organizations data. No data exfiltration means no successful cyberattack.
Pioneered by BlackFog, ADX is a technique used to prevent unauthorized data from leaving a device. By targeting multiple parts of the kill chain, ADX effectively blocks the activation and spread of cyberattacks. Since cyberattacks, especially ransomware focuses on data theft for extortion this has become an important technique to thwart modern polymorphic attacks that cannot be stopped by traditional anti-virus or EDR solutions.
ADX works by investigating outgoing data on endpoint devices. This gives it a markedly smaller footprint than other solutions, such as firewalls or DLP, which examines incoming and outgoing traffic at the edge of the network. ADX solutions are lightweight enough to run on mobile devices and do not need to work on the corporate network. Instead of comparing traffic to a dictionary of attack signatures, ADX solutions use behavioral analytics to identify unusual behaviors on a user-centric basis. ADX limits the ability for users – including privileged users and administrators – to send sensitive data outside the network.
BlackFog has been around since 2015 and is the leader in ADX, a new category for anti data exfiltration technology. BlackFog has been endorsed by leading analysts and received several industry awards, so you can trust ADX technology. Hundreds of global customers across all industry verticals trust BlackFog to secure their data and prevent cyberattacks.