# One clear alert. Then you decide. > When cybee stops a harmful program on a Mac, one plain alert arrives in macOS, Slack, Teams or SMS, free on every Mac. Ask about it, then a person decides. Page: https://cybee.ai/use-cases/security-alerts/ (Review a Mac security alert before taking action) Security alerts for small teams on Macs Protection is free on every Mac. Proof is CHF 9 per Mac a month. When cybee stops a harmful program, you get one plain message in macOS, Slack, Teams or SMS. So when an insurer asks how you would know, you have the answer. Start free. One command, no account. `curl -sSf https://get.cybee.dev | sh` From get.cybee.dev, cybee’s install server. [Read the script](https://get.cybee.dev) Run it in Terminal, a chat, your IDE or a CLI. Keep working where you started. - Asks before it changes your Mac - Apple notarized - No sign up Figure: Illustration: on Saturday at 14:07 a notification says cybee stopped a program on Ana’s MacBook Pro and quarantined it, while the other three Macs stay protected. You ask cybee about alert c-2029, the alert reaches your team, and a person decides what happens next. With the Proof plan a sealed Trust Passport shows how your Macs were protected, 89 of 90 days observed, for the insurer who asks how you would know. ## Someone will ask how you would know. Usually before they sign. Insurers, clients and auditors rarely ask whether something ever went wrong. They ask how you would find out, and who would act on it. at renewal ### Your insurer asks what watches your Macs. “How do you detect harmful software?” A yes is not enough. They want to hear what watches, and who hears about it. before a deal ### A client asks how you handle a security incident. They want the first steps, and the name of the person who takes them. on a Saturday ### A program acts up while nobody is at the desk. The Mac is on. The team is not. Someone should still hear about it. on a review ### An auditor asks who looked at an alert, and when. A dated record answers it. Memory rarely does. Why the question keeps coming 59% of small and medium companies were attacked in the past 12 months. Being ready starts with knowing when it happens to you. Source: Hiscox Cyber Readiness Report 2025 26,000+ new malware samples for Mac appeared in 2025. A Mac needs looking after too. Source: Jamf Security 360, 2026 ## It stops the program. Then it tells you. Protection runs on each Mac all day, whether anyone is at the desk or not. When cybee stops something, the alert is its report to you. Read Free ### Start with the event. Then ask the person. Each alert names the Mac, the time, what the program did and what cybee already did about it. In this example, a program began encrypting files in Documents, and cybee stopped it before it could go on. The alert cannot tell you why it happened. Ask the person using that Mac what they were doing at that moment. [How protection works](https://cybee.ai/docs/protection/) Figure: What happened, on which Mac, and what cybee did. One id to ask about. Ask Free ### Ask about the id. In the chat you already use. Type the id into the AI assistant where you set up cybee, such as Claude, ChatGPT or Cursor. Terminal works too. The answer comes from what was recorded on the Mac: which program, what it did, what cybee did about it, and what is still open. Your AI assistant explains the record. It does not decide what is harmful. If its answer and the record differ, the record counts. [Ask your first question](https://cybee.ai/docs/assistant/#first-question) Figure: The verdict, what was recorded, what is open, and one next step. Decide Free ### A person decides what happens next. Not the alert, and not the chat. cybee has already stopped the program. What comes after is a call for someone on your team, based on what you know. An alert never approves a change on its own. Nothing from a chat changes a Mac until the person who uses it says yes. 14:07 14:15 14:20 Figure: cybee acts at once. People decide what it means. Choose the next step from what you know it was expected #### If it matches the work. Write down what the person was doing. Then ask cybee what else the program did. Knowing the program does not make everything it did safe. If you need the program back, ask support and give them the alert id. nobody recognises it #### If the program is unfamiliar. Keep the alert id, the Mac, the time and the description together. Ask support with that context instead of guessing. Then check what actually happened. still unclear #### If the result is still unclear. Leave it open. An assistant’s explanation does not replace the recorded result. Reach Free ### macOS, Slack, Teams or SMS. Wherever your team works. Send alerts where the people who can follow up will see them. The same message and the same id arrive in each place. Name one person who reads every alert, asks the colleague what they were doing and writes down what was decided. [Explain the work to a client](https://cybee.ai/use-cases/security-questionnaires/) Figure: On the Mac itself, while the team sits at the kitchen table. The same alert goes to Slack, Teams or SMS. ## Get the next alert in plain words. One command per Mac. Protection and alerts are free on every Mac. Run the line on each Mac your team works on, and the next alert names the Mac, the time and what cybee did. `curl -sSf https://get.cybee.dev | sh` From get.cybee.dev, cybee’s install server. [Read the script](https://get.cybee.dev) Run it in Terminal, a chat, your IDE or a CLI. Keep working where you started. - Asks before it changes your Mac - Apple notarized - No sign up ## Nobody buys security. Somebody else sets a date. An agency of about ten people, all on Macs. Their insurer sent a security questionnaire. - 23:41 Found cybee. - 23:44 Installed. - 23:47 First record sealed. - 08:00 Sent to the insurer. No demo. No call. The insurance policy was issued. The first record shows what was true that night. Every day after adds history. A real customer story, shared anonymously. ## Alerts are free on every Mac. You pay when you need to prove it. Protection and alerts cost nothing, for as many Macs and people as you have. The Proof plan adds an incident response plan, chat support and the sealed Trust Passport. ### Free Free Forever. Unlimited Macs and people. - Stops bad software while it runs - Alerts in macOS, Slack, Teams and SMS - 118 safety checks on each Mac - Apps, extensions and AI agents listed - “Am I safe?” answers in your AI assistant - Google Workspace account activity - Email support within one working day [Start free](https://cybee.ai/docs/install/) ### Proof plan CHF 9 per Mac per month, or 90 a year Everything in Free, plus: - Weak settings fixed and kept fixed - The sealed Trust Passport - Security training, completion recorded - Incident response plan - Chat support [Install, then start the 14 day trial](https://cybee.ai/docs/install/) The 14 day trial starts in your AI assistant, after cybee is installed. Ask for a Proof plan feature, such as the Trust Passport. The link arrives in the chat and leads to Stripe, the payment service. Per Mac, excluding tax. The same number in CHF, EUR, USD and GBP. Runs on Macs with an Apple chip, M1 or newer. Macs with an Intel chip are not supported. To check a Mac, open the Apple menu and choose About This Mac. [All plan details](https://cybee.ai/pricing/) ## Watches programs, not people. What is in your files never leaves your Mac. ### Stays on your Mac - The contents of your files - Saved passwords and app tokens - Detection, checks and fixes ### Leaves your Mac - Security events, such as a program that was stopped - Which settings are on - Which apps, extensions and AI agents are installed, and what the agents are connected to - What AI tools did, as cybee recorded it. This can include commands and file paths - What gets stopped is decided on your Mac, not by an AI model on our servers. - If cybee disappeared, the app on your Macs would keep protecting them. cybee AG, Zürich. A Swiss company, hosted in Europe. [Security and privacy details](https://cybee.ai/security/) Figure: Your team sees one icon. Nobody has to learn security. ## A few practical questions. **Q:** What does cybee not do? It is not a security team. There is no operations centre behind cybee that watches your alerts or steps in for you: the alert comes to you, and someone on your team decides. It is not a certification or an audit. It runs on Macs with an Apple chip, M1 or newer. Windows and Linux are not supported today. They are being built. A daily or weekly summary is not ready yet. **Q:** Is it really free? Yes, the protection is. Stopping bad software and alerts in macOS, Slack, Teams or SMS cost nothing on every Mac, with no limit on Macs or people, and so does email support within one working day. You pay only for proof: the Proof plan is CHF 9 per Mac a month, or 90 a year, excluding tax. It adds chat support, an incident response plan and the Trust Passport. To try it for 14 days, ask your AI assistant for a Trust Passport and use the Stripe link it sends. **Q:** Does every alert mean an attack? No. An alert records behaviour that needs context. Review what was observed, keep what you do not know clear, and check the result of any response. **Q:** What leaves my Mac when an alert fires? The security event: which program, what it did, when, and on which Mac. Never the contents of your files, and never passwords or tokens. cybee watches programs, not people. **Q:** What does it change on my Mac? The install adds the cybee app, one icon in the menu bar and the protection that runs in the background. macOS asks you to switch on Full Disk Access for it, and cybee connects to the AI assistants it finds on that Mac. Settings stay as they are until the person who uses the Mac says yes to a change. To remove it, type `sudo cybee uninstall` in Terminal. **Q:** What does my insurer or client see? Only what you send. With the Proof plan you can send a Trust Passport: a dated record of how your Macs are protected, since when, and the days cybee could not see. It is sealed: it carries a fingerprint, so the reader can see that nothing was changed afterwards. It does not check the facts a second time. Your insurer or client decides what evidence is enough. **Q:** Does this replace SOC 2 or ISO 27001? No. SOC 2 and ISO 27001 are audits of how a whole company works, done by an outside auditor. cybee covers your Macs: it stops bad software, sends the alert and keeps a dated record. That record can answer the questions about your Macs in an insurer’s or a client’s form. If someone asks for SOC 2 or ISO 27001, the Trust Passport does not replace it. ## Where to go next. [How protection works What cybee watches on each Mac, and what an alert means.](https://cybee.ai/docs/protection/) [Your AI assistant Set up /cybee and ask about an alert by its id.](https://cybee.ai/docs/assistant/) [Client questionnaires Turn dated findings into a precise answer.](https://cybee.ai/use-cases/security-questionnaires/) [Product overview Protect, fix and prove, with alerts along the way.](https://cybee.ai/product/#alerts) [Security What leaves your Mac, where it goes and who is behind cybee.](https://cybee.ai/security/) [Pricing and the trial Every plan detail, and how the 14 day trial starts.](https://cybee.ai/pricing/#trial) ## Set it up before the next alert. One command. `curl -sSf https://get.cybee.dev | sh` Run it in Terminal, a chat, your IDE or a CLI. Keep working where you started. Free for every Mac with an Apple chip · Asks before it changes your Mac [What it installs](https://cybee.ai/docs/install/#see) [Read the install script](https://get.cybee.dev)