On this page
What is the difference between a security check and hardening?
A security check looks at a setting and reports what it found. Hardening changes supported settings so there are fewer ways in. In between, you review what the change will do, approve it and check the new result.
Protection against suspicious activity is a separate job. It keeps running alongside all of this.
What does hardening mean?
What hardening means.
Your Mac has many security switches of its own, such as disk encryption and the screen lock. Hardening turns them on the safe way, and keeps them on.
On the Proof plan cybee sets the safe values and switches them back if someone changes them. Anything that changes a Mac asks the person who uses it first.
Where do the checks come from?
Where the checks come from.
From the CIS Benchmark, a public, industry maintained list of the safest settings for macOS. Many compliance frameworks accept it as a baseline for secure settings.
118 CIS Benchmark checks on every Mac, free.
The finding describes the starting point.
Someone steps away from their laptop, and the screen stays open long after they have gone. The check shows how long the Mac waits before it locks the screen, and when that value was seen. The finding has not changed anything on the Mac.
cybee compares the settings with the CIS Benchmark, a public security checklist. The free result, such as 117 of 118 checks holding, shows where to start. Checks nobody could assess stay unknown. And a better overall result does not answer every single question.
Understand the effect on your work.
Take one setting on one Mac: how long the screen waits before it locks.
Example Macsample values
One screen lock, three separate steps.
- Screen locks when you leaveScreen lockAfter 15 minutes
- observe
The check reports a 15 minute delay.Nothing on the Mac has changed yet.
- confirm
The owner reviews the proposed value, 5 minutes, and says yes.The change was requested in the chat. It waits for that yes.
- check
A new check shows 5 minutes in place.A new observation, with its own time.
Before you approve, ask which Macs are affected and what the change means for your work. A shared Mac may need a different setting from a personal laptop. And ask how to reverse the change.
Can a change be undone?
Undoing a change.
Ask your AI assistant how to undo a change on that Mac before you approve it, and check the result again afterwards.
Keep threat protection running.
Safer settings close gaps in how a Mac is set up. Threat protection watches what programs do and looks for the patterns of an attack. A Mac with every setting right can still meet a harmful program, which is why both jobs matter.
AI tools run on that same Mac. Their inventory and the actions recorded for them add context. But a connection in the settings, or an action marked completed, does not show on its own that the activity was safe.
Settings close the gaps. Protection watches what runs anyway.
What does protection watch?
What protection watches.
What programs do after they start. If one begins to behave like an attack, such as encrypting your files, cybee stops it and tells you in plain words.
It knows 137 patterns of how bad software behaves. Every time it starts, it checks that each one still works. Free on every Mac.
More than 26,000 new malware samples for Mac appeared in 2025, according to Jamf Security 360, 2026.
Keep the result, and keep the setting.
On the Proof plan, cybee applies supported settings and corrects them if they drift away from the profile you chose. Ask how to reverse a change before you approve it. When you review a Mac, read its most recent observation.
A dated record can answer a later client question about those Macs. It describes what was seen. A fix made today is not evidence for the weeks before it.
Example Macsample values
dated recordexample
Before
The screen lock check is open.
- Disk encryptionOn
- Screen lockAfter 15 minutes
Open item, waiting for the owner.
The owner says yes
dated recordexample
After
The screen lock check holds.
- Disk encryptionOn
- Screen lockAfter 5 minutes
No open items.
Which profiles can I choose?
The three profiles.
The Proof plan keeps your settings on one of three profiles: essential, balanced or fortress. You choose the profile.
Whichever you pick, anything that changes a Mac asks its owner first.
Start with one task you can manage.
- 1
Choose one open finding on a supported Mac.
- 2
Understand the effect, the approval and how to reverse it.
Do this before anything on the Mac changes.
- 3
Check the result, then include the other Macs it affects.
Keep your existing security tools while you find out whether they work well together. If a device management tool already controls a setting, agree which system keeps it before you add another.
Background: CIS Benchmarks and Apple’s malware protection overview.
What is device management?
What device management is.
A tool some companies use to set up and control their Macs from one place, often called MDM. If you already have one, it may set some of these settings for you.
Two systems pulling the same setting in different directions help nobody. Decide which one owns it.
Sources and product scope.
Written by cybee for small teams. The provider references explain the underlying controls. Our documentation sets out what cybee covers today.
Review a change before you approve it.
The safer settings guide covers approval, settings that stay on and how to reverse a change.
