What protection does
Protection stops bad software while it runs. Apple checks an app when it arrives. cybee keeps watching after it starts, and stops a program that behaves like malware.
one day on Luca’s MacBook Pro26.09.2026
macOSbuilt in
FileVault· disk lock · on all day
Gatekeeper10:30 · app check at the door XProtect14:05 · Apple’s list of known bad softwarecybeeall day
00:0006:0012:0018:0024:00
My Mac already has security. Why add anything?
Apple’s security, and what cybee adds.
Apple gives you a locked safe. cybee gives you a bodyguard who watches what happens inside, keeps the whole building in order, and writes the report.
what Apple doesGatekeeper checks apps at the door. FileVault locks the disk. XProtect is Apple’s list of known bad software.
what cybee addscybee watches what programs do after they start. It dates what it sees, so you can show it later. On the Proof plan it also turns Gatekeeper back on if someone turns it off, once the owner has said yes.
How does cybee spot bad software?
On the Mac itself.
It watches what programs do, and stops one that behaves like malware. And it compares files on the Mac with a list of known bad software from a live feed.
No AI model on our servers decides which software is bad.
137 behaviour patterns, each self tested at every start. About 295,000 known bad files on the list.
Protection is one job. Safer settings are another: your Mac’s own security switches, such as disk encryption and screen lock, set the safe way.
| The job | What cybee does |
|---|---|
| Protection | Stops a program that behaves like malware, while it runs. |
| Safer settings, checked | Checks 118 settings on each Mac and tells you which ones are off. |
| Safer settings, kept on | Sets them the safe way and switches them back if anyone changes them, after the owner says yes. |
Both matter, and no tool stops every attack. cybee tells you what it saw and what it did. How safer settings work
Read an alert
When cybee stops something, you get one message in plain words: what happened, on which Mac, and what cybee already did. Every alert has an id you can ask your AI assistant about.
cybeeAPP14:07
A program was stopped on Ana’s MacBook Pro.
- Mac
- Ana’s MacBook Pro
- When
- Sat 26 Sep, 14:07
- What happened
- It began encrypting files in Documents.
- State
- Stopped and quarantined.
Ask cybeeMark reviewed
alert c-2029 · ask about it by id
- 1
Read what happened.
The alert says what the program did, on which Mac, and when. Here, it began encrypting files in Documents on Ana’s MacBook Pro at 14:07.
- 2
Ask whether it was expected.
Some alerts describe normal work, such as “A screenshot was taken”. The wording alone does not mean something bad happened. Ask the person who uses that Mac whether they expected it.
- 3
Read what cybee already did.
The State line says what happened next. Stopped and quarantined means cybee ended the program and set it aside on the Mac.
- 4
Ask about it by its id.
Every alert has an id, such as c-2029. Your AI assistant can explain it and tell you what still needs attention.
Ask your AI assistant
Explain my latest alert. What happened, what did cybee do, and what still needs my attention?
Select the question, then press Command and C.
Where alerts arrive
On the Mac itself as a macOS notification, and in Slack, Microsoft Teams or by SMS. Each carries the same alert and the same id. To get them in Slack, Teams or on your phone, ask your AI assistant to set it up. Daily and weekly summaries are in build.
What the person at the Mac sees
Your teammates do not open cybee. They see a notification when something happens, and one icon in the menu bar. It opens a card with the Mac’s state and anything waiting for them.
cybeenow
A program was stopped.
On Ana’s MacBook Pro. It was quarantined.
What the menu bar icon can show
| The card says | What it means |
|---|---|
| Protected | Protection is on and nothing is waiting. |
| Scanning | cybee is checking this Mac’s settings right now. |
| Needs you | Something waits for a yes, such as a setting to turn on. Nothing changes until the person agrees. |
| Threat stopped | cybee stopped a program. The card names the alert id. |
| Training due | A security training is waiting. Part of the Proof plan. |
| Not observed | cybee has not heard from this Mac for a while, for example because it was switched off. |
What stays on your Mac
Detection, checks and fixes run on the Mac. Only security facts leave it, so cybee can answer your questions and send alerts.
| Stays on your Mac | Leaves your Mac |
|---|---|
| The contents of your files | Security events and alerts |
| Saved passwords and app tokens | Which settings are on |
| Spotting and stopping bad software | Which apps, extensions and AI agents are installed, and what cybee recorded the agents doing |
cybee watches programs, not people. It checks security, not how anyone works. An alert can still name an everyday action, such as a screenshot, and the Mac it happened on. Tell your team that before you add their Macs. Security and privacy details
Check the AI tools too
An AI agent is a program that acts on its own on someone’s Mac. When an alert lands, ask cybee which agents are on that Mac, what each one is connected to, and what cybee recorded them doing.
Keep your current protection while you try cybee
If your Macs already run security software or device management, keep it running while you try cybee. Write down what is installed, with names and versions, and ask us whether they work side by side before you change anything.
Device management, protection and evidence are different jobs. Work through an alert, step by step
If something looks wrong
Find the moment that matches yours.
An alert names a program you use for work
Ask your AI assistant about the alert by its id before you do anything else. If you still think cybee got it wrong, email [email protected] with the id.
No alert arrives in Slack, Teams or by SMS
Ask your AI assistant to set up the channel you want. Alerts also appear as a notification on the Mac itself.
The menu bar says Not observed
cybee has not heard from this Mac. Check that it is switched on and online. The record shows the missing time as not observed.
You want to check that protection is on
In Terminal, type cybee status and press Return. Or ask your AI assistant “Is every Mac protected?”