iiinova — where your digital self keeps evolving

North Pole Security @northpolesec.bsky.social · 17/09/2026

Santa and Workshop 2026.8 are out. Santa has always answered "what is allowed to run." This release adds "when." One rule can allow an app during working hours and block it the rest of the week, with an optional kill when the window closes. northpole.security/blog/release...

northpole.security

Announcing Santa and Workshop 2026.8 | North Pole Security

Santa and Workshop 2026.8 add time based rules, a top-level Tags section, file access process overrides, sequence signals, and Nix package rules

000

North Pole Security @northpolesec.bsky.social · 21/05/2026

Santa v2026.4 is out 🎅 🎄 Strengthened anti-tamper protections 🎄 Clean syncs now replace all sync-managed settings (not just rules) 🎄Per-device silencing of blocked media alerts Read more: northpole.security/blog/santa-2... Release Notes: github.com/northpolesec...

northpole.security

Announcing Santa 2026.4 | North Pole Security

Santa v2026.4 introduces several significant features, including expanded anti-tamper protections, new clean sync semantics, silenceable device notifications, and continued investment in security hard...

110

North Pole Security @northpolesec.bsky.social · 13/05/2026

Happy to report we got our SOC 2 Type II in April of 2026. We've been so busy getting the next versions of Santa and Workshop together we forgot to share the good news.

001

North Pole Security @northpolesec.bsky.social · 15/04/2026

📣 We've just released version 2026.3 of Workshop. northpole.security/blog/worksho... This release adds: 🎄 CEL Fallback Rules 🎄 Risk Engine Plugin filter expressions 🎄 Encrypted removable media enforcement .. and an assortment of performance and usability improvements. Check it out.

010

North Pole Security @northpolesec.bsky.social · 17/02/2026

In the next version of Santa, when paired with Workshop you'll be able to specify process tree relationships in a CEL rule. This lets you mark executables as not usable by processes or require TouchID from the user e.g. here's an example of us preventing Claude Code from running curl w/o TouchID.

010

North Pole Security @northpolesec.bsky.social · 24/12/2025

Day 24 of our FAAdvent Calendar: Code injection is a major threat to binary allowlisting, especially when Electron/Chromium offer easy scripting/debugging northpole.security/blog/2025-ad... Workshop and Santa's CEL rules can prevent attackers from using debugging options to inject malicious code.

000

North Pole Security @northpolesec.bsky.social · 23/12/2025

Day 23 of our FAAdvent Calendar: Learn how to use Workshop's Risk Engine with entitlements to flag unauthorized VPN and remote access software, preventing data exfiltration and enforcing compliance. northpole.security/blog/2025-ad...

000

North Pole Security @northpolesec.bsky.social · 22/12/2025

Day 22 of our FAAdvent Calendar: macOS audio plugins are an old often overlooked persistence trick. northpole.security/blog/2025-ad... Malicious .component or .driver bundles dropped in well-known directories can execute code, sometimes as root. Lock them down!

010

North Pole Security @northpolesec.bsky.social · 21/12/2025

Day 21 of our FAAdvent Calendar: macOS's built-in security command can be used for nasty actions like dumping Keychain contents or adding rogue certificates. Stop these attacks using Workshop and Santa CEL rules: northpole.security/blog/2025-ad...

000

North Pole Security @northpolesec.bsky.social · 20/12/2025

Day 20 of our FAAdvent Calendar: Living off the land (LoTL) is a common attack technique. Learn how to use CEL rules to block potentially malicious subactions of legitimate tools like systemsetup, instead of blocking the tool entirely. northpole.security/blog/2025-ad...

000

North Pole Security @northpolesec.bsky.social · 20/12/2025

Day 19 of our FAAdvent Calendar: SSH private keys are master keys for your systems. 🔑 northpole.security/blog/2025-ad... Infostealers like Atomic, Banshee, and Cthulhu target your ~/.ssh/ folder! Learn how to lock them down with Workshop and Santa’s file access Rules.

000

North Pole Security @northpolesec.bsky.social · 20/12/2025

📢 We’ve just released version 2025.1010 of Workshop This release adds: 🎄 on-demand monitor mode 🎄 optional automatic updates 🎄 event export to S3/GCS 🎄 near-realtime directory syncing 🎄 local user/group management 🎄 added cwd & euid fields to CEL rules 🎄 live online status on the host details page

000

North Pole Security @northpolesec.bsky.social · 20/12/2025

Day 18 of our FAAdvent Calendar: Don't let "Sploitlight" (CVE-2025-31199) leak your sensitive macOS data! northpole.security/blog/2025-ad... Attacks bypass TCC to exfiltrate files like Apple Intelligence databases. See how to prevent this persistence trick and data theft with Workshop and Santa:

000

North Pole Security @northpolesec.bsky.social · 20/12/2025

Day 17 of our FAAdvent Calendar: Enhance your password manager security! 🛡️🔐 northpole.security/blog/2025-ad... Beyond the account password, using file access rules can prevent other apps from reading your database, protecting you even if encryption is compromised.

000

North Pole Security @northpolesec.bsky.social · 20/12/2025

Day 16 of our FAAdvent: Attackers are using Docker on macOS to hide from security tools! They run containers in a Linux VM, bypassing Endpoint Security Framework & can still steal credentials by mounting host volumes. See how Santa and Workshop can prevent this: northpole.security/blog/2025-ad...

000

North Pole Security @northpolesec.bsky.social · 20/12/2025

Day 15 of our FAAdvent Calendar: Apple changed macOS's dynamic loader to write temp files to disk, but stealthy attackers adapt. Learn how to use Workshop & Santa’s file access rules to block this basic technique: northpole.security/blog/2025-ad...

000

North Pole Security @northpolesec.bsky.social · 14/12/2025

Day 14 of our FAAdvent Calendar: Learn how attackers can bypass macOS Gatekeeper by stripping the quarantine attribute with xattr, and see how to block this technique using Workshop and Santa's CEL rules. northpole.security/blog/2025-ad...

000

North Pole Security @northpolesec.bsky.social · 14/12/2025

Day 13 of our FAAdvent Calendar: Workshop and Santa's file access rules can lock down cron and at job persistence before attackers even get a chance to set their alarms. northpole.security/blog/2025-ad...

000

North Pole Security @northpolesec.bsky.social · 12/12/2025

Day 12 of our FAAdvent Calendar: Launch Agents and Daemons are a convenient way for programs to run in the background, but they’re also a great way for malware to gain persistence on a device. northpole.security/blog/2025-ad...

000

North Pole Security @northpolesec.bsky.social · 11/12/2025

Day 11 of our FAAdvent Calendar: Prevent persistence by securing /etc/pam.d with a Santa file access rule. Block write attempts even from root! northpole.security/blog/2025-ad...

000

North Pole Security @northpolesec.bsky.social · 10/12/2025

Day 10 of our FAAdvent Calendar: A one-liner command is all you need to see if a password is legit, but Santa's CEL rules can stop this common post exploitation behavior. northpole.security/blog/2025-ad...

000

North Pole Security @northpolesec.bsky.social · 08/12/2025

Day 8 of our FAAdvent Calendar: Hide your macOS password hashes! A one-liner command can expose the hash and salt, but Workshop & Santa's file access rules & CEL rules can protect these crown jewel files. northpole.security/blog/2025-ad...

Number eight behind a title card saying Hide Your Hashes.

000

North Pole Security @northpolesec.bsky.social · 07/12/2025

Day 7 of our FAAdvent Calendar : Prevent macOS Gatekeeper from being disabled on your fleet by creating a Santa CEL rule! northpole.security/blog/2025-ad...

010

North Pole Security @northpolesec.bsky.social · 06/12/2025

Day 6 of our FAAdvent Calendar: Protect your browser cookies from infostealers with Santa's File Access Rules—limit access so only the browser can read its own cookies! northpole.security/blog/2025-ad...

000

North Pole Security @northpolesec.bsky.social · 01/12/2025

'Tis the season for new features. 🎁 Introducing On-Demand Monitor Mode in Workshop & Santa—monitor mode access only when you need it, only when you prove you're at the keyboard. Check out the Loom ⬇️ www.loom.com/share/0c09ed...

loom.com

Introducing On-Demand Monitor Mode in Santa and Workshop 🚀🎅

In this video, I introduced a new feature called on-demand monitor mode that will be available in the next versions of Santa and Workshop. This feature allows users to temporarily switch from lockdown...

000

North Pole Security @northpolesec.bsky.social · 09/10/2025

Join us in celebrating North Pole Security's first anniversary! 🎉 Reflect on a year of innovation, growth, & unwavering commitment to livable security with Santa and Workshop. Read about our journey and what's next! #FirstAnniversary #Santa #Workshop northpole.security/blog/one-yea...

001

North Pole Security @northpolesec.bsky.social · 29/08/2025

Yesterday we released Santa v2025.8 on GitHub. github.com/northpolesec... This release includes a handful of new features. Some highlights include: - Support for CEL string extensions to enable writing more powerful policies. This lets you do things like args.join(" ").contains("-flag option")

github.com

Release v2025.8 · northpolesec/santa

Notes Announcements 🎉 Santa has a new Workshop! North Pole Security is excited to announce the release of Workshop, an official sync service specifically designed to deeply integrate with Santa. It...

100

North Pole Security @northpolesec.bsky.social · 14/08/2025

Incredibly humbled by the amazing feedback from our community! Thank you for growing with us - here's to continuing to build something great together! 🚀

000

North Pole Security @northpolesec.bsky.social · 31/07/2025

Keeping with our Christmas in July🎄, we just released Santa 2025.7 on GitHub github.com/northpolesec... This release includes: - A new icon that matches the company's branding - Ready for Tahoe! - Bug fixes and more

github.com

Release v2025.7 · northpolesec/santa

000

North Pole Security @northpolesec.bsky.social · 30/07/2025

🎉 It's Christmas in July! We raised $4M to make proactive macOS security scalable for everyone. Workshop is the first commercial platform built for Santa. Finally making allowlisting usable at scale. Thanks to A16Z & everyone's who's believed in our mission.

161

North Pole Security @northpolesec.bsky.social · 08/05/2025

Very exciting to see Santa called out as a tool that works in the @specterops.io SO-Con talk on Modern macOS Red Teaming Tactics by Lance Cain and @werdhaihai.bsky.social www.youtube.com/watch?v=t_L2...

youtube.com

Modern macOS Red Teaming Tactics | SO-CON 2025

YouTube video by SpecterOps

021

North Pole Security @northpolesec.bsky.social · 05/03/2025

We agree with CISA and think you should use Santa too www.cisa.gov/sites/defaul...

Snippet of the CISA guide recommending that you use Santa to stop living off the land attacks on macOS

001

North Pole Security @northpolesec.bsky.social · 28/02/2025

📣 We’ve just released Santa v2025.2 on GitHub. github.com/northpolesec... Some highlights include: - Process-centric File Access Authorization rules are now in Beta! This means FAA rules can now target all access from a given process without knowing the files that will be accessed ahead of time.

github.com

Release v2025.2 · northpolesec/santa

Notes If you're migrating from Google Santa, please see the Migration Guide for details on how to upgrade. Santa documentation can be found at northpole.dev. Announcements 📣 Opt-In Stats Collection...

111

North Pole Security @northpolesec.bsky.social · 28/01/2025

Last night we released Santa 2025.1 github.com/northpolesec... Notable features include: Entitlements in the Sync Protocol This allows you to avoid authorizing or see which applications are disabling code signing on libraries.

github.com

Release v2025.1 · northpolesec/santa

Notes If you're migrating from Google Santa, please see the Migration Guide for details on how to upgrade. Santa documentation can be found at northpole.dev. Fixed ❗ Fixed an issue where santactl c...

111

North Pole Security @northpolesec.bsky.social · 12/12/2024

We've released v2024.12 of Santa. github.com/northpolesec... This addresses an upgrade issue when running in lockdown mode and also a minor issue where a root user is able to inject rules when it is configured to use a sync service is configured.

github.com

Release v2024.12 · northpolesec/santa

Notes If you're migrating from Google Santa, please see the Migration Guide for details on how to upgrade. This release fixes an issue that could affect users that upgraded to v2024.11 from v2024.1...

010

North Pole Security @northpolesec.bsky.social · 10/12/2024

Today we're excited to release Santa v2024.11! github.com/northpolesec... Highlights: 1. Our initial beta for standalone mode: This lets you authorize binaries using TouchID. So you can live in lockdown mode. www.youtube.com/watch?v=Hd4t...

youtube.com

Santa Standalone Mode w/Swift UI

YouTube video by Pete Markowsky

112

North Pole Security @northpolesec.bsky.social · 20/11/2024

Today is Santa's 10th Birthday 🎂🎉. The first commit was from Russell Hancox at 4:23 PM

011

North Pole Security @northpolesec.bsky.social · 11/11/2024

Last week we made our first Open Source release of Santa version 2024.10 github.com/northpolesec... Highlights: 1. Streamlined UI with silencing options and added a button to copy relevant data to the clipboard to help users report issues / blocks to security

102