Open source · macOS · v0.1.0

One command.
Every Mac.
SOC 2 ready.

fort audits your Mac's security settings, fixes what it finds, and produces a timestamped compliance report — no MDM, no signup, no agent.

zsh — fort
brew install djadmin/tap/fort
Requires Homebrew
View on GitHub Join waitlist for teams →
Audit. Fix. Prove.

Three commands cover the entire compliance workflow. No dashboard to learn, no agent to manage.

Step 01
$ fort

See what's failing

Audits all 15 security controls in under 3 seconds. Score, current state, expected state — no interpretation needed.

Step 02
$ fort --fix

Fix it automatically

Remediates every fixable setting. Use --dry-run first to see exactly what changes before it runs.

Step 03
$ fort --report

Evidence for auditors

Writes a timestamped HTML report with machine identity, per-check results, and SOC 2 control references. Print to PDF in one click.

15 controls. Zero guesswork.

Every check uses stable, documented macOS APIs. No private frameworks. Works on macOS 12 Monterey through the latest release.

🔐
Password manager CC6.1
Detects 1Password, Bitwarden, LastPass, and 9 other managers in /Applications.
💾
Disk encryption (FileVault) CC6.1
Verified via fdesetup status. High confidence, no guessing.
🔒
Screen lock CC6.1 ⚡ auto-fix
Password required on sleep, delay set to immediate. Fixable without sudo.
🛡️
Antivirus / EDR CC6.8
Detects CrowdStrike Falcon, SentinelOne, Malwarebytes, and 14 others by app and process.
🔥
Application firewall CC6.6 ⚡ auto-fix
macOS built-in application-layer firewall via socketfilterfw.
🚪
Gatekeeper CC6.8 ⚡ auto-fix
Blocks unsigned and unnotarized apps from running on the system.
🌐
Remote login (SSH) CC6.6 ⚡ auto-fix
Inbound SSH should be off on employee laptops. Detected via launchctl without sudo.
🔄
Automatic OS updates CC6.8 ⚡ auto-fix
Ensures security patches are automatically checked. Required for most compliance frameworks.
🛡
System integrity (SIP) CC6.8
Prevents root-level system file modification. Required for Gatekeeper and XProtect to function.
👤
Local admin rights CC6.3
Verifies the current user is not running as a local administrator. Most commonly cited audit finding.
🚫
Guest account CC6.1 ⚡ auto-fix
Verifies the guest account is disabled. Guest access bypasses all logical access controls.
🔑
Automatic login CC6.1 ⚡ auto-fix
Verifies auto-login is disabled. Physical access to an auto-login Mac bypasses all authentication.
📡
Sharing services CC6.6
Checks file sharing, screen sharing, remote management, and internet sharing are all off.
📶
AirDrop CC6.6 ⚡ auto-fix
Verifies AirDrop is set to Contacts Only or Off. "Everyone" is a data exfiltration risk.
📦
OS patch status CC6.8
Checks pending update count from cached Software Update prefs — no network call needed.
Auditor-ready in seconds.

Run fort --report and hand the file to your auditor. No portal, no upload, no waiting.

Machine identity included

Hostname, serial number, OS version, and timestamp — everything an auditor needs to verify the evidence is real.

📄

Print to PDF in one click

Self-contained HTML file. Open in any browser, hit Cmd+P. No external dependencies, no server required.

🗺️

SOC 2 control references

Each check maps to the relevant SOC 2 Trust Services Criteria (CC6.x, CC7.x). Shows auditors exactly what's covered.

fort
Endpoint Security Assessment
15/15
15 pass · 0 fail · 0 warn
alice-mbp
15.5
C02XF2K...
May 21, 2026
CheckStatusFound
Password managerpass1Password
Disk encryptionpasson
Screen lockpassimmediate
Antivirus / EDRwarnXProtect only
Application firewallpasson
Built for teams that move fast.
🚀

Startups doing SOC 2

Get every Mac green before your first audit. No MDM enrollment, no IT department needed. One command per machine.

🧑‍💼

vCISOs & consultants

Run fort across your client's fleet, collect the HTML reports, and hand a before/after to the auditor. Repeatable, professional, fast.

💼

BYOD & contractor teams

Contractors can self-attest without enrolling in MDM. Transparent, local, open-source — they can read every line before running it.

Team dashboard.

Fleet view, drift alerts, policy files, and auditor exports — across every Mac in your org. Join the waitlist and we'll reach out first.

✓ You're on the list — we'll be in touch.

No spam. Unsubscribe anytime. The CLI is always free.