Part one explained TCC. Part two goes deeper into the tccd binary, the database it manages, and what's actually happening under the hood when macOS enforces privacy controls.

Apple's TCC framework controls which apps can access sensitive data on macOS. Huntress explains what it is, how it works, and why it's one of the most important security mechanisms Mac defenders should understand.

macOS malware is evolving fast. Huntress and Patrick Wardle from Objective-See cover the BTM database, current Mac malware trends, and what every defender working in a mixed environment needs to know.

Two ways to deploy and manage macOS at scale: MDM and RMM. They're not the same thing, and choosing wrong creates gaps. Huntress breaks down the differences and when each one makes sense.

Apple's Endpoint Security Framework changed what's possible for macOS security tooling. Huntress digs into ESF, what it enables, and how it informs the way modern Mac security tools are built.

Apple has been building a security stack into macOS for years. From the 2006 "I'm a Mac" era to Apple Silicon, here's what is actually built in and how security teams can leverage it.