NovaCove / Endpoint security
Endpoint security that speaks Mac.
NovaCove Endpoint watches each Mac from inside — process, file, and network activity through Apple's Endpoint Security and a network content filter. It catches attacker behaviour the built-in tools miss, blocks malicious npm installs, and lets you respond in one click. Built macOS-first, not ported to it.
- Content feed
- ECDSA verified
- Telemetry destination
- On-device or yours
- History
- 7 days
Schematic — sample values from one Mac, last 24 h. The real report renders from your sensors.
Detections
What it catches
Six detection families, shipped today and updated over a signed feed — no app update needed.
Attacker execution
Unsigned binaries from Downloads or /tmp, curl-piped-to-shell, document apps spawning shells, fake osascript password prompts.
Persistence
Launch agents & daemons, Background Task Management items, cron/at, periodic, emond, sudoers, PAM, SSH authorized_keys, and login hooks.
Supply chain
A package firewall inspects npm installs in cleartext and blocks install-time script abuse before it lands.
Known-bad & reputation
Threat-intel indicators, file-hash blocklists, and VirusTotal reputation on executed binaries.
Credentials & injection
Access to credential files (~/.ssh, ~/.aws, …), task-port access used for code injection, and XProtect/Gatekeeper ground-truth.
Network
Flow telemetry, new-destination anomalies, IOC-domain matches, and full host isolation as a response.
How it holds up
Verifiable by design
What the agent reports, it also proves: content is signed, detection runs on the Mac, and coverage is measured in a lab.
Signed content
Rules, IOCs, and even fleet commands are ECDSA-signed and verified against a key pinned at enrollment — a compromised backend can't push to your agents.
On-device & self-hostable
Detection runs on the Mac. Managed deployments send OCSF telemetry to a backend you can run yourself, including air-gapped.
Measured, not claimed
Detections are validated against an ATT&CK scorecard in a disposable macOS lab, and coverage is trended over time.
Private beta
Try it on one Mac.
Free through the private beta. Bring the fleet when you're ready.