Jamf launches Beacon threat-hunting service for Mac

Jamf has launched Beacon, a premium threat-hunting service for macOS environments. The service is now generally available to customers using Jamf for Mac and Jamf for Mac Hi-Ed.

Beacon is designed to give security teams access to dedicated threat hunting and investigation focused on Apple devices, as more organisations expand their use of Macs at work.

Delivered by Jamf Threat Labs, the company's internal threat research and detection team, the service is aimed at organisations that lack in-house specialist resources to monitor and investigate threats targeting macOS.

The offering centres on proactive detection, investigation and reporting for threats affecting Mac estates. It also provides remediation recommendations, while leaving containment and policy decisions to customers' IT and security teams.

Mac focus

Security products have often focused on Windows-heavy corporate environments, but Apple devices now account for a larger share of workplace fleets in many sectors, including education and knowledge-based industries. That shift has created a bigger target for attackers seeking to exploit Apple systems.

Beacon uses telemetry from Jamf's Mac security tooling, built on Apple's Endpoint Security API. Jamf says this gives its analysts visibility into Apple-specific attack techniques, anomalous activity and suspicious behaviour across customer environments.

The service is sold as an add-on through a professional services engagement. It is available to customers of Jamf for Mac and Jamf for Mac Hi-Ed, extending the work of Jamf Threat Labs into day-to-day customer operations.

Jaron Bradley, Director of Threat Labs at Jamf, said the service responds to changing risk patterns around Apple devices in the workplace.

"Enterprise Mac adoption has grown at a rapid pace, and threat actors have taken notice," Bradley said.

"Beacon extends Apple-focused threat hunting directly to customers, helping them strengthen security operations and better understand activity across their Mac environments," he added.

Service model

Jamf has structured Beacon around three main elements: dedicated macOS threat hunting, investigation based on Apple-native telemetry, and guidance on remediation steps. Customers retain operational control rather than handing direct response authority to Jamf.

That model places the service between software tooling and a managed detection support function. Rather than acting as a fully outsourced security operations centre, Beacon is intended to help internal teams identify and examine potential threats with specialist, Apple-focused input.

Jamf has built its business around Apple device management and security and says it now serves more than 78,000 organisations across 100 countries, covering more than 35 million devices. The launch of Beacon adds a higher-touch security service to that product set, as vendors seek to deepen customer relationships beyond endpoint management software alone.

Jamf says Beacon will deliver prioritised investigations and reporting intended to reduce the time attackers remain undetected in macOS environments.