Apple enterprise management firm Jamf Holding Corp. today launched Beacon by Jamf Threat Labs, a premium threat hunting service that puts the company’s research and detection engineers directly inside customer environments to hunt for attacks targeting Apple’s macOS.

Now generally available, Beacon is aimed at a gap Jamf said many security teams face as their Apple footprint grows. Mac devices have become a bigger target for sophisticated threat actors, but few organizations have staff with the specialized knowledge to monitor and investigate macOS-specific threats. The service is delivered by Jamf Threat Labs, the company’s in-house research and detection team.

Beacon rests on three components. The first is dedicated macOS threat hunting, giving customers access to hunters versed in Apple’s security frameworks, threat actor techniques and macOS-specific attack vectors. Combined with Jamf telemetry, that produces investigation and reporting built for Apple environments rather than adapted from Windows-centric tooling.

Underpinning the service is Jamf’s Mac telemetry, which is built on Apple’s Endpoint Security application programming interface. That data lets analysts hunt for Apple-specific attack techniques and other suspicious behavior across a customer’s Mac fleet. Jamf said it prioritizes those investigations to cut the time an attacker goes undetected.

The third component leaves remediation with the customer. When the team finds a threat, it hands over a report laying out what happened and what to do about it. Decisions on containment and policy stay with the customer’s own information technology and security teams.

“Enterprise Mac adoption has grown at a rapid pace and threat actors have taken notice,” said Jaron Bradley, director of Threat Labs at Jamf. He said Beacon extends Apple-focused threat hunting directly to customers and helps them better understand activity across their Mac environments

The launch extends a strategy Jamf has pursued for years, pairing its core Apple device management with security tooling and research aimed at enterprise Mac deployments. The company’s threat research arm has steadily raised its profile through published analysis of macOS malware and attacker techniques and Beacon turns that work into a paid engagement.

Beacon is sold as an add-on for Jamf for Mac and Jamf for Mac Hi-Ed customers through a professional services engagement.

Pricing for the add-on was not disclosed. The launch comes as enterprise Mac fleets keep growing and the pool of macOS-native security talent stays thin, the gap Jamf is pitching Beacon to fill.

Image: Jamf