Your people are your weakness

The data tells its own story. OC explains: Employees account for 57% of all security incidents and 45% of these incidents come when workers bypass or ignore security policies by, for example, using unapproved tools. 

Attackers are actively searching for and exploiting those kinds of policy workarounds, seeking weaknesses in commonly used, but unapproved, tools. Users really should educate themselves.

While companies can put some mitigations in place using device management and policy controls to constrain app use and downloads across their endpoints, Apple is also working to keep systems secure with a focus on the Terminal app. 

Terminal’s early warning system

In this case, it will introduce new malware warnings and protections to help prevent people from using Terminal to override system security to install malware-laden scripts. That’s the attack vector currently being used in the ClickFix series of attacks, which use fake macOS utilities to trick Mac users into doing just that.

It’s yet another example of how attackers rely on complex social engineering attacks to fool targets into undermining their own security. These attacks often begin with an attempt to get users to install infostealer malware on their own machines, and run them, bypassing Mac’s native malware defence.

Apple already has many, many protections to help combat attacks like these; now, we’ll see warnings in macOS Tahoe 26.4 whenever a relatively novice user pastes anything into the Terminal. Apple’s XProtect continues to block known malicious scripts. 

Helping people make better decisions

These warnings don’t appear in the first 24 hours after setting up a Mac, nor do they appear if a user has developer tools such as Xcode installed. That’s because Apple assumes developers are savvy enough to avoid falling for such tricks, while many users setting up their Macs may have legitimate need to use Terminal for legitimate purposes. (Apple will always warn when you try to paste code from sources known to be malicious.)

To an extent, Apple’s new protection reflects its belief that users should have choice while ensuring they are informed. Figuring out when to warn a user of the dangers they take has always been a challenge, as you don’t want to interfere in the user experience too heavily. But the prevalence of the kinds of threats OC warns about pushed Apple to put a new gate in place. 

FileVault keys come to the Passwords app

This isn’t the only new protection Apple has planned for macOS 26.4. The update does something many have long wanted. Ever since Apple’s first M-series chips arrived, we’ve had situations in which users forget their FileVault key, which can lead to Macs getting bricked when sold. Apple has now moved the macOS FileVault recovery key into users’ end-to-end encrypted Passwords app.

That’s good in two ways: it removes the threat Apple could lose or leak the key and makes it easier for a user to recover that key using the Passwords app on anther device. When you protect the data on your Mac with FileVault, you get a recovery key during set-up. If you forget the password for your Mac, you can reset the password by entering the recovery key.

Finally, IT admins seeking to ensure compliance with security policies will appreciate that Apple began rolling out Background Security Improvements in iOS 26.3.1, iPadOS 26.3.1 and macOS 26.3.1 to deliver incremental fixes and additional protections in between normal software updates. Still, as the OC data shows, the best and most effective security (beyond moving to a Mac) is to ensure employees fully understand the implications and significance of your company’s current security policies.

Please follow me on social media! Join me on BlueSky,  LinkedIn, and Mastodon.