Blog

Insights and research from the Phorion team

Subscribe via RSS

September 30, 2026

Phorion achieves SOC 2 Type II compliance

Phorion has completed a SOC 2 Type II audit conducted by Insight Assurance. The report gives customers independent assurance over how we secure the infrastructure, access, and data behind our macOS EDR platform.

Compliance SOC 2 Security Company News

Detecting and Preventing npm Supply Chain Attacks with Phorion Protections

Tracking an npm package install through each stage of its lifecycle allows for precise, context-aware protections that safeguard credentials, block second-stage payload execution, and prevent worm propagation.

Protections npm Supply Chain File Access Controls Research

Beyond Detection: Proactive Process and File Controls for macOS

Phorion Protections brings file access authorization, process execution controls, and EDR telemetry into a single macOS endpoint security solution. Layered defences, scoped to your environment, with the analytics to deploy them confidently.

EDR Protections Feature Release macOS Endpoint Hardening File Access Controls

Introducing Clipboard Protection: Stopping ClickFix Attacks on macOS

ClickFix-style paste attacks are one of the most effective social engineering techniques targeting macOS. Today we’re releasing Clipboard Monitoring, a fully configurable capability that detects and blocks malicious pastes in real time.

Clipboard Protection ClickFix Pastejacking Feature Release

#1 in the EDR Telemetry Project: The Visibility Advantage

Phorion ranked #1 in the EDR Telemetry Project, scoring more than twice the points of the next closest vendor. This post breaks down our approach to visibility and the critical detection coverage it enables.

EDR Telemetry macOS

Reverse Engineering macOS 26.4's Undocumented Socket Bind Events

Apple’s macOS 26.4 introduced several undocumented Endpoint Security events. We reverse engineered ES_EVENT_TYPE_RESERVED_3 and _4 to reveal new socket bind visibility for security tools.

ESF Endpoint Security Framework macOS Internals Research

November 27, 2025

macOS Paradox Stealer used in Solidity Open VSX Extension Attack

Threat actors used a malicious Cursor extension to push Paradox Stealer into developer workflows. The blog traces the attack step by step and highlights the detections that prevented data theft.

Cursor Open VSX Paradox Stealer SleepyDuck Infostealer Threat Report

Let's Talk

See how Phorion protects your macOS fleet

Purpose-built by macOS security researchers. One lightweight agent delivering detection, prevention, and visibility.

Ready to see it in action? Book a demo and we'll show you how Phorion can protect your fleet.

Book a Demo

Expect a personal email from our team.