03 · Hardening area
App Execution Control
Most Mac malware still needs a user to run it. Gatekeeper, the quarantine flag, Developer ID signing, notarization and XProtect form layered checks at launch time; binary authorization tools such as Santa add an allowlist on top.
GatekeeperNotarizationXProtect
- Gatekeeper, XProtect and Notarization on macOS
How Gatekeeper, quarantine, code signing, notarization and XProtect decide what runs on a Mac, how to verify them, and how to manage them with MDM and Santa.