# How cybee protects your Mac. And what an alert tells you.

> How cybee stops bad software on your Mac, how to read an alert in Slack, Teams, SMS or macOS, and what stays on the Mac. Free for every Mac.

Page: https://cybee.ai/docs/protection/ (Mac protection and security alerts: guide)

- [Documentation](https://cybee.ai/docs/)

- Protection and alerts

protection guide

cybee watches what programs do on each Mac and stops the ones that behave like malware. When it acts, you get one alert in plain words. Protection and alerts are free for every Mac.

free on every Mac alerts in macOS, Slack, Teams and SMS Macs with Apple silicon updated 28.09.2026

**Q:** In this section

Start

- [Overview](https://cybee.ai/docs/)

- [Install cybee](https://cybee.ai/docs/install/)

- [Requirements](https://cybee.ai/docs/requirements/)

- [Your AI assistant](https://cybee.ai/docs/assistant/)

Use

- [Protection and alerts](https://cybee.ai/docs/protection/)

- [Safer settings](https://cybee.ai/docs/hardening/)

- [Trust Passport](https://cybee.ai/docs/trust-passport/)

- [Team devices](https://cybee.ai/docs/team-devices/)

Help

- [Help and support](https://cybee.ai/docs/help/)

- [All questions](https://cybee.ai/faq/)

## What protection does

Protection stops bad software while it runs. Apple checks an app when it arrives. cybee keeps watching after it starts, and stops a program that behaves like malware.

Figure: Apple locks the disk all day and checks at two moments. cybee watches the whole day and writes it down.

**Q:** My Mac already has security. Why add anything?

### Apple’s security, and what cybee adds.

Apple gives you a locked safe. cybee gives you a bodyguard who watches what happens inside, keeps the whole building in order, and writes the report.

what Apple does

Gatekeeper checks apps at the door. FileVault locks the disk. XProtect is Apple’s list of known bad software.

what cybee adds

cybee watches what programs do after they start. It dates what it sees, so you can show it later. On the Proof plan it also turns Gatekeeper back on if someone turns it off, once the owner has said yes.

**Q:** How does cybee spot bad software?

### On the Mac itself.

It watches what programs do, and stops one that behaves like malware. And it compares files on the Mac with a list of known bad software from a live feed.

No AI model on our servers decides which software is bad.

137 behaviour patterns, each self tested at every start. About 295,000 known bad files on the list.

Protection is one job. Safer settings are another: your Mac’s own security switches, such as disk encryption and screen lock, set the safe way.

| The job | What cybee does |
|---|---|
| Protection | Stops a program that behaves like malware, while it runs. Free |
| Safer settings, checked | Checks 118 settings on each Mac and tells you which ones are off. Free |
| Safer settings, kept on | Sets them the safe way and switches them back if anyone changes them, after the owner says yes. Proof plan |

Both matter, and no tool stops every attack. cybee tells you what it saw and what it did. [How safer settings work](https://cybee.ai/docs/hardening/)

## Read an alert

When cybee stops something, you get one message in plain words: what happened, on which Mac, and what cybee already did. Every alert has an id you can ask your AI assistant about.

Figure: One alert, shown in Slack. Read it from the top down.

1

Read what happened.

The alert says what the program did, on which Mac, and when. Here, it began encrypting files in Documents on Ana’s MacBook Pro at 14:07.

2

Ask whether it was expected.

Some alerts describe normal work, such as “A screenshot was taken”. The wording alone does not mean something bad happened. Ask the person who uses that Mac whether they expected it.

3

Read what cybee already did.

The State line says what happened next. Stopped and quarantined means cybee ended the program and set it aside on the Mac.

4

Ask about it by its id.

Every alert has an id, such as c-2029. Your AI assistant can explain it and tell you what still needs attention.

Ask your AI assistant

Explain my latest alert. What happened, what did cybee do, and what still needs my attention?

A message is not a decision

Receiving an alert does not close it, and it never approves a change to a Mac. The Mac’s owner still decides.

### Where alerts arrive

On the Mac itself as a macOS notification, and in Slack, Microsoft Teams or by SMS. Each carries the same alert and the same id. To get them in Slack, Teams or on your phone, ask your AI assistant to set it up. Daily and weekly summaries are in build.

## What the person at the Mac sees

Your teammates do not open cybee. They see a notification when something happens, and one icon in the menu bar. It opens a card with the Mac’s state and anything waiting for them.

Figure: The same alert as a macOS notification, on the Mac where it happened.

### What the menu bar icon can show

| The card says | What it means |
|---|---|
| Protected | Protection is on and nothing is waiting. |
| Scanning | cybee is checking this Mac’s settings right now. |
| Needs you | Something waits for a yes, such as a setting to turn on. Nothing changes until the person agrees. |
| Threat stopped | cybee stopped a program. The card names the alert id. |
| Training due | A security training is waiting. Part of the Proof plan. |
| Not observed | cybee has not heard from this Mac for a while, for example because it was switched off. |

## What stays on your Mac

Detection, checks and fixes run on the Mac. Only security facts leave it, so cybee can answer your questions and send alerts.

| Stays on your Mac | Leaves your Mac |
|---|---|
| The contents of your files | Security events and alerts |
| Saved passwords and app tokens | Which settings are on |
| Spotting and stopping bad software | Which apps, extensions and AI agents are installed, and what cybee recorded the agents doing |

cybee watches programs, not people. It checks security, not how anyone works. An alert can still name an everyday action, such as a screenshot, and the Mac it happened on. Tell your team that before you add their Macs. [Security and privacy details](https://cybee.ai/security/)

## Check the AI tools too

An AI agent is a program that acts on its own on someone’s Mac. When an alert lands, ask cybee which agents are on that Mac, what each one is connected to, and what cybee recorded them doing.

What this does not tell you

A connection does not prove an agent used it. An activity record may not hold every action. Choosing what each agent may reach is planned, not live.

[AI agents on your Macs](https://cybee.ai/product/ai-agents/)

## Keep your current protection while you try cybee

If your Macs already run security software or device management, keep it running while you try cybee. Write down what is installed, with names and versions, and ask us whether they work side by side before you change anything.

Device management, protection and evidence are different jobs. [Work through an alert, step by step](https://cybee.ai/use-cases/security-alerts/)

## If something looks wrong

Find the moment that matches yours.

### An alert names a program you use for work

Ask your AI assistant about the alert by its id before you do anything else. If you still think cybee got it wrong, email [hello@cybee.ai](mailto:hello@cybee.ai) with the id.

### No alert arrives in Slack, Teams or by SMS

Ask your AI assistant to set up the channel you want. Alerts also appear as a notification on the Mac itself.

### The menu bar says Not observed

cybee has not heard from this Mac. Check that it is switched on and online. The record shows the missing time as not observed.

### You want to check that protection is on

In Terminal, type `cybee status` and press `Return`. Or ask your AI assistant “Is every Mac protected?”

Still unsure

Email [hello@cybee.ai](mailto:hello@cybee.ai) with the alert id and what you saw. Leave out your admin token and any password. We answer within one working day, and the Proof plan adds chat support.

[Previous Your AI assistant](https://cybee.ai/docs/assistant/)[Next Safer settings](https://cybee.ai/docs/hardening/)

On this page

- What protection does

- Read an alert

- What the person at the Mac sees

- What stays on your Mac

- Check the AI tools too

- Keep your current protection

- If something looks wrong