The first tool I run on new Macs is osxlockdown[1] (use [2] if you want a UI). It disables a bunch of features and enables things like the firewall. Make sure y

The first tool I run on new Macs is osxlockdown[1] (use [2] if you want a UI). It disables a bunch of features and enables things like the firewall. Make sure you don't disable things you're actually using, though. I don't run any AV, but I use OpenDNS Umbrella, a DNS-level malware blocking service with the capability to switch to "active" traffic filtering (basically a MitM proxy, though that part is completely optional). It's a neat tool with a nice dashboard, and the pricing is okay with $20/year. OSSEC is a great tool for servers, but not the kind of "Let's just throw some AV at it so we can tick that compliance box" tool many are looking for. [1]: https://github.com/SummitRoute/osxlockdown https://github.com/SummitRoute/osxlockdown [2]: https://objective-see.com/products/lockdown.html https://objective-see.com/products/lockdown.html