Two-thirds of IT teams don’t have an enforceable AI policy in place. That was the single most striking data point from our April SudoTalks session — and in a room of almost 100 Apple admins, it lined up almost perfectly with what we heard in the chat. People know the AI threat landscape is changing fast. Most aren’t yet set up to do anything about it at the endpoint.

If you missed the live webinar, here’s the short version of what our product and security experts –Joel Cedano, Principal Product Manager and Nicolas Ponce, VP Security & Operations – discussed and why it matters for Apple-first environments. Plus, keep reading for the things you can do this quarter to close the gap.

Why Apple hardening looks different in 2026

Apple devices ship with a strong baseline — SIP, Gatekeeper, TCC, XProtect, notarization. That baseline is built for personal computing, not enterprise risk. And the risk profile has shifted sharply:

• macOS infostealers jumped 101% in a single quarter at the end of 2024, and the trend has continued.
• Attackers are abusing valid Apple developer IDs to notarize malicious apps, quietly bypassing Gatekeeper.
• Nine zero-days were exploited in the wild last year, with another early one this year affecting devices dating back to the original iPhone.
• As Macs take more share in the enterprise — accelerated by lower-cost hardware — attackers are following.

Hardening, in plain terms, means shrinking your attack surface. Lock the doors, shut the windows, close the gates. That framing matters more than ever because AI has changed three things at once: the economics of an attack, the speed of exploitation, and the kinds of attacks that are now possible.

Three ways AI is reshaping the threat landscape

1. Attacks are dramatically cheaper

AI has collapsed the cost of running serious attacks. Phishing-as-a-service kits that bypass MFA at scale — like Tycoon 2FA — now cost around $120. Microsoft has attributed 62% of phishing attempts to tools in that category. Atomic Stealer (AMOS), currently the most prevalent malware on macOS, is sold as-a-service for roughly $1,000 a month — and it comes with support.

The most sobering case study came from Anthropic itself: a single operator jailbroke Claude Code with a few thousand prompts and, over about a month, breached ten Mexican government agencies and exfiltrated 195 million taxpayer records — roughly 150 GB of data. One person. One AI tool. IBM research cited during the session noted that building a sophisticated phishing campaign used to take 16 hours; with AI, it takes about five minutes.

2. Attacks are faster

University of California, Santa Barbara researchers showed that AI agents can take a new CVE, design an exploit, and execute it within 15 minutes — for roughly a dollar of compute, with no prior knowledge in the model’s training data. The practical implication for Apple admins: patch windows measured in weeks are no longer defensible.

Spear phishing has also gotten eerily precise. AI-crafted campaigns are seeing click-through rates around 54%, versus ~12% for traditional phishing. An estimated 82% of phishing emails now involve AI in some part of the workflow.

3. New attack types that didn’t exist a few years ago

• Deepfakes built from as little as three seconds of audio or video. One organization lost $25 million after employees joined a live video call populated entirely by AI-generated executives.
• Polymorphic malware that rewrites itself every ~15 seconds — rotating names, processes, and variables to evade static EDR signatures. Behavioral detection is no longer optional.
• Malicious AI “skills” and agent packages — more than 2,200 have been found on GitHub — designed to hijack the permissions your AI agents already hold, including anything an MCP server has been granted.

“Hackers aren’t hacking in — they’re logging in.” That’s why identity, device compliance, and conditional access belong in the same conversation as EDR.

What to do about it — inside the Addigy Security Suite

Nicolas spent the second half of the session in the console. A few highlights worth pulling out for anyone evaluating their current setup:

SentinelOne EDR, MDR, and (soon) XDR

The SentinelOne integration is point-and-click from the Addigy policy tree — enable it at the parent policy and it inherits down. Threats and CVEs surface directly in the Addigy console, with one-click pivots into SentinelOne for deeper investigation or direct remediation from Addigy. Behavioral detection is the key reason it stays effective against polymorphic malware: even if the binary is new, the behavior (say, a strange curl-out) still trips the alert.

MDR adds a 24/7 SentinelOne triage team that can kill, quarantine, remediate, or whitelist on your behalf — useful for the hours when your team isn’t online. XDR is on the roadmap to extend that coverage beyond endpoints to cloud and network events.

Compliance benchmarks out of the box

A brand-new macOS 26.4 device fails 62 of the 94 controls in CIS Level 1, and 164 controls in CMMC Level 2 — a useful slide to show auditors or executives who still believe “Macs are secure by default.” 

Addigy ships CIS, NIST, CMMC, and DISA benchmarks you can deploy in minutes. Nicolas’ practical advice: clone the benchmark, prune the rules that will disrupt your users (AirDrop, webcam, iCloud controls in stricter frameworks), and be especially careful with password rules if you’re already enforcing them via another MDM profile or identity provider.

Each rule links to its test, its expected response, and the underlying framework mapping — and you can export the whole compliance posture to CSV for auditors or pipe it into a custom dashboard.

A live look at an AI compliance benchmark

This was the part of the session the audience reacted to most strongly. Nicolas demoed a custom benchmark the team built in-house: two rules, one for Claude and one for OpenAI, that detect whether those tools are installed and whether they’re running under a managed settings JSON file. If Claude Code is present but unmanaged, the rule remediates by deploying a managed settings file that restricts what the agent can do on the device — denying destructive actions by default, or prompting the user instead of silently allowing them.

It’s a template, not a shipping feature yet. But it makes the point that you don’t have to wait for a vendor roadmap to start governing AI at the endpoint — you can build it against the benchmark engine you already have.

Conditional access and the zero-trust backstop

Compliance benchmarks are only half the story. Conditional access is what stops a stolen credential from becoming a breach: if the device isn’t compliant and managed, the login fails, full stop. Addigy’s macOS conditional access integrates with Intune today, and Joel previewed iOS conditional access coming later this year. One caveat worth repeating from the session: roll out benchmarks gradually, and prune or write exceptions for any rule that’s producing false-positive failures — otherwise you risk locking out legitimate users.

What the audience told us they want next

The Q&A and chat surfaced three consistent themes worth naming, because they’re almost certainly true in your environment too:

• AI tool detectors were the single most-requested capability — multiple attendees asked whether we’d ship a first-party way to inventory and control AI apps across the fleet.
• An “alert but do not fail” compliance mode came up more than once — a lighter-touch option for rules where you want visibility before you flip on enforcement.
• Mac remediation parity with Windows inside SentinelOne was another ask we’ve taken back to the partner team.

If any of these sound like your list, [email protected] is the right place to send feedback — that inbox is staffed by the team building this roadmap.

Shipping later this year

• CVE auto-remediation for third-party software and systems — aimed squarely at the 15-minute AI exploit window. Not dependent on SentinelOne.
• iOS conditional access, extending the zero-trust posture from Mac to iPhone and iPad.

Watch the full recording

This recap covers the essentials, but the live demo of the AI compliance script — and the full Q&A on Intune conditional access, SentinelOne MDR response times, and custom benchmark thresholds — is worth the hour.

Watch the SudoTalks recording

And if you’re running Apple devices without an enforceable AI policy, you’re in the majority — but you don’t have to stay there. See Addigy in action.