Forged at Google. Sharpened here.

Santa is a high-performance, open-source security agent for macOS. It provides binary authorization (controlling what software can execute), file access authorization (controlling what processes can read or write specific files), USB/SD blocking, and system event logging. Originally created at Google in 2014 to protect their Mac fleet, Santa is now maintained by North Pole Security, which was founded by Santa's original creators.

No. Santa is engineered for performance and uses minimal system resources. On a typical fleet, it normally uses well under 0.5% CPU and under 150 MB of RAM, even on developer machines doing frequent builds and executions. Most users never notice it's installed.

Santa is the free, open-source security agent that runs on each Mac. It handles binary authorization, file access control, USB blocking, and event logging. Workshop is the management platform for running Santa across a fleet. You don't need Workshop to use Santa, but most organizations managing more than a handful of Macs find it valuable for approval workflows, automated risk assessment, and centralized visibility. Workshop is built and maintained by the same team that maintains Santa.

Yes. Santa is fully open source under Apache 2.0 and works standalone with no central server. Configure it with a standard MDM configuration profile and manage rules locally with santactl. If you outgrow that pattern but don't want a vendor, community sync servers like Moroz, Rudolph, and Zentral speak Santa's open sync protocol. Workshop is the option for when you want approvals, risk intelligence, and fleet-wide telemetry from the team that maintains Santa.

When any binary attempts to execute on a Mac running Santa, the system extension intercepts the request before it runs. Santa checks the binary against its rule database using five rule types in strict precedence order: CDHash, Binary hash, Signing ID, Certificate, and Team ID. If a matching rule exists, Santa applies the policy (allow, block, or evaluate a CEL expression). If no rule matches, the behavior depends on the operating mode: Monitor allows it and logs it, Lockdown blocks it, and Standalone prompts the user.

Yes. File Access Authorization lets you control which processes can read sensitive files like browser cookies, SSH keys, and credentials stored in keychains. Even if an infostealer bypasses binary authorization, it cannot access the files it targets. You define policies specifying which apps (by signing identity) are allowed to read which paths, and Santa enforces these at the system extension level.

Santa was built at Google, where tens of thousands of engineers compile and run code every day. Transitive Allowlisting solves this: mark your trusted compilers with the Allow Compiler policy, and Santa automatically approves binaries they produce for six months. Standalone mode lets developers approve executions locally with TouchID. These features let you run Lockdown mode without slowing down your engineering teams.

CEL (Common Expression Language) rules let you write custom security policies that go beyond simple allow or deny. CEL expressions can evaluate signing metadata, command-line arguments, environment variables, effective user IDs, and working directories. Examples include blocking binaries signed before a compliance date, preventing changes to Gatekeeper, requiring TouchID for admin tools, and detecting timestomping techniques.

No. Santa works fully standalone via MDM configuration profiles, with rules managed locally through santactl. When you do want a sync server, you have options. Moroz, Rudolph, and Zentral are community-maintained open-source sync servers that speak Santa's v1 sync protocol. Workshop is the option built by the team behind Santa, for organizations that want approvals, risk intelligence, and fleet-wide telemetry on top.

Santa logs all binary execution attempts (allowed, denied, and unknown), file modification events (writes, renames, deletions, hard links), disk mounts and unmounts, login and logout events, screen sharing sessions, SSH access, and authentication attempts. On macOS 15+, Santa also captures Gatekeeper override attempts, XProtect malware detections, and TCC database modifications. Events can be exported as protobuf, JSON, syslog, or flat files.

Yes. Santa is fully open source under the Apache 2.0 license. The source code is available on GitHub at github.com/northpolesec/santa. Google officially redirected their original Santa repository to the North Pole Security fork in 2025.