Celebrating a year of safeguarding the digital world
It's been a full year since we started North Pole Security, and what a year it's been! Both Santa, our open-source binary and file access authorization system, and Workshop, our flagship enterprise-grade endpoint protection platform, have grown considerably. We've shipped 12 releases of Santa, three releases of Workshop, presented at two conferences, been featured on two podcasts, and grown the team to six people.
The community around Santa has also grown larger. Only a few years ago, the #santa channel on the Mac Admins Slack workspace was a mere few hundred people. Now there's almost a thousand people — people who recognize the power and utility of binary allowlisting over traditional EDR (Endpoint Detection and Response) solutions.
Our elves have been busy. In the last year, we've merged over 470 GitHub pull requests. That's a lot! When we were at Google, it took over ten years to merge twice that number, which means that our team is moving shockingly faster than before.
Let's take a look back over the last year and revisit the highlights for each month.
October 2024
All four founders from the original Santa team (Pete, Russell, Tom, Matt) joined to form North Pole Security. We kicked off the year by announcing the company's formation at the Mac Admins conference in Sweden and let the world know that we had forked Santa to help it better serve the community and reach its full potential.
November 2024
The Santa open-source project celebrated its official 10-year anniversary. Russell and Pete were featured on the Mac Admins Podcast, and we released the first version of NPS Santa which added anti-tamper protection.
December 2024
We added standalone mode to Santa, which lets end users self-approve new software and reduces the approval load on IT administrators.
January 2025
We hired our first employee, Mark Shiozaki (formerly of Capsule8, Sysdig and Red Hat), as Director of Sales Engineering and Customer Success.
Lauren Pearl joined us as a fractional CFO, bringing invaluable experience from her time at Trail of Bits, where she gained expertise in Santa and Osquery.
We also added application signing entitlement support to the Santa synchronization protocol, which allows entire classes of applications to be blocked such as VPNs or hypervisors.
February 2025
We hired Ian Langworth as Principal Engineer and released our open-source Santa statistics collection service. Google archived their Santa repository on GitHub and officially redirected to ours as the de facto Santa repo.
March 2025
We've enhanced File Access Authorization (FAA) rules to include wildcard support for signing IDs. This improvement enables policies to address scenarios such as XProtect remediators, where new binaries (e.g., those with a com.apple.XProtectFramework.plugins.* signing ID prefix) are added to disk without necessitating a policy update.
April 2025
We added TCC (Transparency, Consent and Control) provisions to Santa as well as a “doctor” command to assist with setup.
Our CTO, Russell, gave a presentation at MacDevOpsYVR and announced our new and upcoming Santa features as well as the benefits of Workshop, our enterprise-grade platform for controlling thousands of hosts. This was also the first time the entire NPS team all met each other in person!
May 2025
Specter-Ops discussed Santa at SO-CON 2025 during their Modern macOS Red Teaming Tactics presentation, coinciding with the release of Santa 2025.5, which brought significant UI improvements such as drag-and-drop and UI sync.
Royal Hansen joined as an advisor. His experience at Google gives him insight into the power of our work, and his broader expertise is invaluable. Having someone of his caliber and perspective is a tremendous asset.
Also, the company acquired its first customer!
June 2025
We added Common Expression Language (CEL) rules to Santa, which allows rule creators to create advanced policies that can make use of arguments, environment variables and binary properties like secure timestamp. CEL is extremely powerful and this was our most popular release of the year!
July 2025
We officially launched Workshop on July 28, 2025 and featured it on our site. We also made Santa officially ready for macOS 26 Tahoe, over a month before the official release of Apple’s new operating system!
August 2025
As part of our goal in making Santa and Workshop a leading EDR solution, we added telemetry export to Workshop, which makes investigations easier by letting admins query billions of host event records in seconds. We also added CEL string macros and improved anti-tamper signal protection.
September 2025
We released new versions of Workshop with dozens of new features and bug fixes that incorporated valuable feedback and suggestions from customers, which continued our mission of making Workshop the most powerful platform for Santa.
We were also mentioned at BSides Columbus and BSides Canberra. Thank you, Lamarr Henry and Kristin Smith, for your excellent presentations and telling thousands of people about the power and usefulness of Santa.
Looking Forward
We’re incredibly proud of everything North Pole Security has accomplished in our first year. From the continued evolution of Santa to the successful launch of Workshop and the expansion of our dedicated team, each milestone reflects our unwavering commitment to empowering organizations with robust cybersecurity solutions. As we look ahead, we remain dedicated to innovating, collaborating with our community, and delivering some of the most effective tools to safeguard the digital world. Thank you for being a part of our journey!