Security alerts for small teams on Macs
One clear alert. Then you decide.
Protection is free on every Mac. Proof is CHFEURUSDGBP 9 per Mac a month.
When cybee stops a harmful program, you get one plain message in macOS, Slack, Teams or SMS. So when an insurer asks how you would know, you have the answer.
Start free. One command, no account.
Step by step, for your Mac. By AirDrop, message or email.
curl -sSf https://get.cybee.dev | shFrom get.cybee.dev, cybee’s install server. Read the script
Run it in Terminal, a chat, your IDE or a CLI. Keep working where you started.Press Command and C to copy.
Someone will ask how you would know. Usually before they sign.
Insurers, clients and auditors rarely ask whether something ever went wrong. They ask how you would find out, and who would act on it.
-
at renewal
Your insurer asks what watches your Macs.
“How do you detect harmful software?”
A yes is not enough. They want to hear what watches, and who hears about it.
-
before a deal
A client asks how you handle a security incident.
They want the first steps, and the name of the person who takes them.
-
on a Saturday
A program acts up while nobody is at the desk.
The Mac is on. The team is not. Someone should still hear about it.
-
on a review
An auditor asks who looked at an alert, and when.
A dated record answers it. Memory rarely does.
Why the question keeps coming
59%
of small and medium companies were attacked in the past 12 months. Being ready starts with knowing when it happens to you.
Source: Hiscox Cyber Readiness Report 2025
26,000+
new malware samples for Mac appeared in 2025. A Mac needs looking after too.
Source: Jamf Security 360, 2026
It stops the program. Then it tells you.
Protection runs on each Mac all day, whether anyone is at the desk or not. When cybee stops something, the alert is its report to you.
ReadFree
Start with the event. Then ask the person.
Each alert names the Mac, the time, what the program did and what cybee already did about it. In this example, a program began encrypting files in Documents, and cybee stopped it before it could go on.
The alert cannot tell you why it happened. Ask the person using that Mac what they were doing at that moment.
cybeeAPP14:07
A program was stopped on Ana’s MacBook Pro.
- Mac
- Ana’s MacBook Pro
- When
- Sat 26 Sep, 14:07
- What happened
- It began encrypting files in Documents.
- State
- Stopped and quarantined.
Ask cybeeMark reviewed
alert c-2029 · ask about it by id
AskFree
Ask about the id. In the chat you already use.
Type the id into the AI assistant where you set up cybee, such as Claude, ChatGPT or Cursor. Terminal works too. The answer comes from what was recorded on the Mac: which program, what it did, what cybee did about it, and what is still open.
Your AI assistant explains the record. It does not decide what is harmful. If its answer and the record differ, the record counts.
Explain alert c-2029. Which program was involved, what was recorded, and what do we still need to check?
Used cybee
Stopped and quarantined.
- Began encrypting files in Documents14:07Stopped
- The program file14:07Quarantined
Nobody has reviewed this alert yet.
Ask Ana if she started a program that encrypts files.
alert c-2029Show the record
DecideFree
A person decides what happens next. Not the alert, and not the chat.
cybee has already stopped the program. What comes after is a call for someone on your team, based on what you know.
An alert never approves a change on its own. Nothing from a chat changes a Mac until the person who uses it says yes.
alert c-202926.09.2026
- 14:07
cybee stops the program and quarantines it.On Ana’s MacBook Pro.
- 14:07
The alert reaches the team in Slack.Luca sees it first.
- 14:15
Luca asks Ana if she started it.Only a person can say if it was expected.
- 14:20
Ana does not recognise it. The file stays in quarantine.Luca marks alert c-2029 reviewed.
Choose the next step from what you know
-
it was expected
If it matches the work.
Write down what the person was doing. Then ask cybee what else the program did. Knowing the program does not make everything it did safe. If you need the program back, ask support and give them the alert id.
-
nobody recognises it
If the program is unfamiliar.
Keep the alert id, the Mac, the time and the description together. Ask support with that context instead of guessing. Then check what actually happened.
-
still unclear
If the result is still unclear.
Leave it open. An assistant’s explanation does not replace the recorded result.
ReachFree
macOS, Slack, Teams or SMS. Wherever your team works.
Send alerts where the people who can follow up will see them. The same message and the same id arrive in each place.
Name one person who reads every alert, asks the colleague what they were doing and writes down what was decided.
cybeenow
A program was stopped.
On Ana’s MacBook Pro. It was quarantined.
Get the next alert in plain words. One command per Mac.
Protection and alerts are free on every Mac. Run the line on each Mac your team works on, and the next alert names the Mac, the time and what cybee did.
Step by step, for your Mac. By AirDrop, message or email.
curl -sSf https://get.cybee.dev | shFrom get.cybee.dev, cybee’s install server. Read the script
Run it in Terminal, a chat, your IDE or a CLI. Keep working where you started.Press Command and C to copy.
Nobody buys security. Somebody else sets a date.
An agency of about ten people, all on Macs. Their insurer sent a security questionnaire.
- Found cybee.
- Installed.
- First record sealed.
- Sent to the insurer.
No demo. No call. The insurance policy was issued.
The first record shows what was true that night. Every day after adds history.
A real customer story, shared anonymously.
Alerts are free on every Mac. You pay when you need to prove it.
Protection and alerts cost nothing, for as many Macs and people as you have. The Proof plan adds an incident response plan, chat support and the sealed Trust Passport.
Free
Free
Forever. Unlimited Macs and people.
- Stops bad software while it runs
- Alerts in macOS, Slack, Teams and SMS
- 118 safety checks on each Mac
- Apps, extensions and AI agents listed
- “Am I safe?” answers in your AI assistant
- Google Workspace account activity
- Email support within one working day
Proof plan
CHFEURUSDGBP9per Mac per month, or 90 a year
Everything in Free, plus:
- Weak settings fixed and kept fixed
- The sealed Trust Passport
- Security training, completion recorded
- Incident response plan
- Chat support
The 14 day trial starts in your AI assistant, after cybee is installed. Ask for a Proof plan feature, such as the Trust Passport. The link arrives in the chat and leads to Stripe, the payment service.
Per Mac, excluding tax. The same number in CHF, EUR, USD and GBP. Runs on Macs with an Apple chip, M1 or newer. Macs with an Intel chip are not supported. To check a Mac, open the Apple menu and choose About This Mac.All plan details
Watches programs, not people. What is in your files never leaves your Mac.
Stays on your Mac
- The contents of your files
- Saved passwords and app tokens
- Detection, checks and fixes
Leaves your Mac
- Security events, such as a program that was stopped
- Which settings are on
- Which apps, extensions and AI agents are installed, and what the agents are connected to
- What AI tools did, as cybee recorded it. This can include commands and file paths
- What gets stopped is decided on your Mac, not by an AI model on our servers.
- If cybee disappeared, the app on your Macs would keep protecting them.
cybee AG, Zürich. A Swiss company, hosted in Europe.
A few practical questions.
What does cybee not do?
It is not a security team. There is no operations centre behind cybee that watches your alerts or steps in for you: the alert comes to you, and someone on your team decides. It is not a certification or an audit. It runs on Macs with an Apple chip, M1 or newer. Windows and Linux are not supported today. They are being built. A daily or weekly summary is not ready yet.
Is it really free?
Yes, the protection is. Stopping bad software and alerts in macOS, Slack, Teams or SMS cost nothing on every Mac, with no limit on Macs or people, and so does email support within one working day. You pay only for proof: the Proof plan is CHFEURUSDGBP 9 per Mac a month, or 90 a year, excluding tax. It adds chat support, an incident response plan and the Trust Passport. To try it for 14 days, ask your AI assistant for a Trust Passport and use the Stripe link it sends.
Does every alert mean an attack?
No. An alert records behaviour that needs context. Review what was observed, keep what you do not know clear, and check the result of any response.
What leaves my Mac when an alert fires?
The security event: which program, what it did, when, and on which Mac. Never the contents of your files, and never passwords or tokens. cybee watches programs, not people.
What does it change on my Mac?
The install adds the cybee app, one icon in the menu bar and the protection that runs in the background. macOS asks you to switch on Full Disk Access for it, and cybee connects to the AI assistants it finds on that Mac. Settings stay as they are until the person who uses the Mac says yes to a change. To remove it, type sudo cybee uninstall in Terminal.
What does my insurer or client see?
Only what you send. With the Proof plan you can send a Trust Passport: a dated record of how your Macs are protected, since when, and the days cybee could not see. It is sealed: it carries a fingerprint, so the reader can see that nothing was changed afterwards. It does not check the facts a second time. Your insurer or client decides what evidence is enough.
Does this replace SOC 2 or ISO 27001?
No. SOC 2 and ISO 27001 are audits of how a whole company works, done by an outside auditor. cybee covers your Macs: it stops bad software, sends the alert and keeps a dated record. That record can answer the questions about your Macs in an insurer’s or a client’s form. If someone asks for SOC 2 or ISO 27001, the Trust Passport does not replace it.
Where to go next.
Set it up before the next alert. One command.
curl -sSf https://get.cybee.dev | shPress Command and C to copy.
Run it in Terminal, a chat, your IDE or a CLI. Keep working where you started.