Jamf has announced two significant product launches on the same day, each addressing a different dimension of the growing security challenge around enterprise Mac. The first is AI Governance for Mac, now generally available within Jamf for Mac, targeting the problem of unmanaged AI tools running across managed Apple fleets. The second is Beacon by Jamf Threat Labs, a premium threat hunting service that puts Jamf’s own detection engineers inside customer environments to look for macOS-specific attacks.
The timing is not coincidental. As Apple Silicon machines have become faster, more capable, and more central to how businesses operate, they have attracted two things in parallel: a surge of AI tools that IT teams have little visibility into, and a growing number of sophisticated threat actors who have noticed that Mac is now worth targeting.
AI Governance for Mac Addresses the Shadow AI Problem
The core problem AI Governance for Mac is designed to solve is one that has been building since AI desktop tools became mainstream. Employees install Claude Desktop, use command-line AI agents, or run background model processes directly on their MacBooks. Cloud reporting and network monitoring tools do not always surface these because the software runs locally, on-device, as a native macOS process rather than as web traffic. IT and security teams end up with an incomplete picture of what is actually running across their fleet.
Jamf’s AI Governance capability addresses this at the operating system level, using the same telemetry agent already deployed on managed machines. No additional software is required. At launch, it supports Claude Code, Claude Desktop, and OpenAI Codex, with the ability to govern model access, tenancy, network permissions, file system controls, and MCP server restrictions for each tool. Policies can be enforced offline and applied before a user first opens an AI agent, establishing a default baseline from the moment a device is active.
The three things it gives IT and security teams are visibility into which AI tools are running across a fleet (including unapproved ones), policy controls to define which tools are sanctioned and enforce those settings at scale, and compliance reporting that can feed into SIEM platforms or support audit requirements.
Jamf has also built in integrations with third-party AI identity and access tools. One example cited at launch is deploying Okta for AI Agents alongside Jamf, so that AI tools request access to company data through the same authentication layer as human users. Organisations can additionally set a preferred inference provider, such as AWS Bedrock, so that AI traffic is routed through approved cloud infrastructure rather than directly to external services.
The scale of the problem this addresses is not theoretical. Gartner projects global AI governance spending will reach $492 million in 2026 and exceed $1 billion by 2030, driven by regulatory pressure and the operational reality of tracking AI tools that are proliferating faster than policy can follow. Jamf’s own survey findings put this in more direct terms: organisations with deeply integrated AI use are 40% more likely to report a security incident than those still in the early stages of adoption.
Beth Tschida, Chief Executive Officer at Jamf, said the product is designed around how AI software actually behaves on Mac endpoints: “AI adoption across the enterprise is moving faster than existing technology policies can keep up. Organisations need governance that matches the way AI tools actually operate on Mac.”
Beacon Brings Dedicated macOS Threat Hunting to Enterprise Teams
Beacon by Jamf Threat Labs is a different type of product. Where AI Governance is a platform capability, Beacon is a human-led professional service that pairs Jamf’s research and detection engineers directly with customer environments to actively look for threats.
The service rests on three components. The first is dedicated macOS threat hunting, giving customers access to analysts with specialist knowledge of Apple security frameworks, threat actor techniques, and macOS-specific attack vectors. Those hunters are not generalists adapting Windows-centric approaches to a Mac environment; they work specifically within the Apple security model. The second component is Jamf’s native Mac telemetry, built on Apple’s Endpoint Security API, the same framework that underpins enterprise security tooling across macOS. This gives the Jamf team visibility into Apple-specific attack techniques and anomalous behaviour across a customer’s fleet. The third component is reporting and handoff: when a threat is found, Beacon produces a detailed report with remediation guidance, and decisions on containment and policy stay with the customer’s own IT and security teams.
The gap Beacon is pitching to fill is a real one. Mac has historically benefited from the assumption that it was not worth targeting. That assumption no longer holds. Enterprise Mac adoption has grown steadily, and threat actors have updated their approach accordingly. The pool of security professionals with macOS-native expertise, however, remains thin. Most organisations managing a Mac fleet do not have staff with the specialised knowledge to investigate macOS-specific attack techniques, and security tooling built primarily for Windows environments does not always surface what it should on Apple Silicon machines.
Beacon is available as an add-on for Jamf for Mac and Jamf for Mac Higher Education customers through a professional services engagement. Pricing has not been disclosed.
Dr Logic Perspective
Both of these launches are directly relevant to the businesses we support. AI Governance for Mac addresses something we have been watching closely since AI desktop tools became genuinely useful: the gap between what IT can see and what is actually running on managed machines. An employee using Claude Desktop or running a local model agent is not necessarily doing anything wrong, but if the IT team has no visibility into it, they cannot make informed decisions about data exposure, compliance, or access controls. Jamf’s approach here is practical precisely because it works within the existing management layer, and because it enforces policy at the device level rather than relying on network controls that local processes can bypass.
Beacon addresses the other side of the same shift. Mac is not a low-risk environment by default, and businesses that still operate on that assumption are carrying a gap that sophisticated threat actors are actively looking to exploit. The combination of macOS-native telemetry and dedicated human threat hunting is a meaningful step beyond endpoint detection tools that generate alerts but leave investigation to teams that may not have the Apple-specific expertise to act on them.
Jamf is one of the platforms Dr Logic actively deploys and manages for clients. If either of these capabilities is relevant to your environment, including questions about whether your current Jamf setup is positioned to support AI Governance or whether Beacon is sized appropriately for your fleet, speak to us.
Related Articles
- Apple’s Endpoint Security Framework: How to Secure macOS in the Enterprise
- One Company Spent $500 Million on Claude in a Month. Here Is How to Govern AI Costs Before They Govern You
- Jamf for Growing UK Businesses: What It Does, What It Costs, and When It’s Worth It
- The UK’s Cyber Chief Called It a “Warning Shot.” Are You Ready?
