North Pole Security

Endpoint Security also known as NPS

Market readinessHow well the company can compete in its security market, scored across eight dimensions against public evidence. Established: Market readiness of 25 to 30, the typical band where most analyzed companies land.
DefensibilityHow well the company holds its position if competitors catch up on features, scored across seven dimensions against public evidence. Contested: Defensibility of 13 to 14, the typical band, where a moat exists but is under pressure.
Founded 2024
Last updated 2026-09-22

All analysis was generated autonomously, without human review. Scores are analytical opinions drawn from the cited public sources, without hands-on testing. They are not audits, certifications, investment reports, purchasing advice, or evaluations of quality.

Executive Summary

Founded in 2024, North Pole Security sells Workshop, a console security teams use to decide which programs may run on company Macs. Workshop manages Santa, an open-source macOS security agent first built at Google that the company maintains. Google stopped maintaining Santa in 2025 and names the company’s fork as a maintained option. Its team includes Santa’s two original authors and the original author of Apple’s Endpoint Security interface, which all macOS security products must use. Andreessen Horowitz led its $4 million seed round in July 2025. It reported a six-person team in October 2025. Its named customers include Figma, Reddit, Canva, Atlassian and Datadog. A rival would find the team’s macOS expertise and the company’s role as Santa’s maintainer slow to match.

Sourced Details

Description North Pole Security builds Workshop, a console for managing the Santa agent across enterprise Mac fleets, and maintains Santa, the open-source macOS binary and file access authorization agent first built at Google. [f1]
Founded 2024 [f2]
HQ Brooklyn, New York, US [f3]
Latest funding Seed, $4M (July 2025) [f4]

Products

Product What it does
Workshop Enterprise management platform for Santa fleets that adds automated approval workflows, package rules, tag-based policy scoping, and centralized telemetry.
Santa Open-source macOS security agent providing binary authorization, file access authorization, removable media blocking, and system event logging.

Matrix Coverage

Cyber Defense Matrix

IdentifyProtectDetectRespondRecover
Devices Workstations, servers, phones, tablets, storage, network devices, IoT infrastructure, and similar hardware.
Applications Software, interactions, and application flows on the devices.
Networks Connections and traffic flowing among devices and apps, plus communication paths.
Data Content at rest, in transit, or in use across devices, apps, and networks.
Users The people using the devices, apps, networks, and data.

Workshop and Santa control what software runs on macOS endpoints and what files running code can touch. The company is mapped to the Cyber Defense Matrix. [f5]

Market Readiness

How well the company can compete in its security market, scored across eight dimensions against public evidence.

Established 26 /40 Established: Market readiness of 25 to 30, the typical band where most analyzed companies land.
Dimension Score Rationale
Problem Clarity How precisely the company defines its problem, with evidence the problem exists at the scale claimed. 3/5 Workshop’s product page describes a clear buyer, the security team running allowlisting on a Mac fleet, and the approval burden the company says made allowlisting too rigid for broad enterprise deployment. The pain stays in the vendor’s voice, because the macOS-share figure is the CEO’s own and Google’s archive notice and the Mac Admins Podcast corroborate an installed base without quantifying its pain. [s2, s5, s17, s20]
Capability Depth How specific the technical capabilities are, with evidence beyond marketing claims such as docs and third-party validation. 4/5 Documentation covers Workshop’s rules, approvals, telemetry and API, and the Santa agent Workshop manages is Apache-licensed code, and its public repository records 2,625 commits, 23 releases and 65 contributors. Google’s archived repository cites the company’s fork as a maintained migration option, and the company’s published security advisories document vulnerabilities found in the enforcement code. [s27, s16, s17, s22, s2]
Market Timing Whether the market is ready for this product, with evidence that buyers are actively seeking solutions. 3/5 Google stopped maintaining Santa in 2025 and encourages existing users to move to a maintained fork, naming the company’s repository as an example, which gives current Santa deployments a dated reason to evaluate the company. Other buyer-side demand is indirect, since the macOS-share figure is the CEO’s own and the reviewed sources contain no analyst note, RFP language or budget line. [s17, s5, s18]
Team Credibility Demonstrated domain expertise with public signals such as prior exits, publications, and industry recognition. 4/5 The about page credits Russell Hancox and Tom Burgin as Santa’s two original authors, Matt White as the original author of Apple’s Endpoint Security Framework, and Pete Markowsky with co-founding Capsule8, a plurality of named in-domain builds. Google’s archive notice citing the company’s fork and the Mac Admins Podcast’s interview with Russell and Pete are independent evidence of community standing, while the individual build histories stay in the company’s own voice. [s3, s17, s20]
GTM Proof Evidence of actual traction (customers, revenue signals, partnerships) beyond stated intentions. 3/5 The homepage publishes a “Trusted by teams at” list naming nine organizations, including Figma, Reddit, Canva, Atlassian and Datadog, which is named-customer evidence. The list is the company’s own publication, the reviewed sources contain no case study or independent report on those customers, and the Andreessen Horowitz seed lead is an indirect signal that does not supply the multiply sourced references a higher score needs. [s1, s4, s18]
Funding Efficiency Whether funding matches go-to-market ambition, with signs of capital-efficient growth. 3/5 The company raised a $4 million seed round led by Andreessen Horowitz in July 2025, and it has shipped paired Santa and Workshop releases through September 2026. That raise is proportional to an early enterprise sales motion with visible shipping. No revenue, margin or growth figure is disclosed, which leaves efficiency unconfirmed. [s18, s7, s1, s4]
Category Clarity Whether the company creates or fits a recognizable category that buyers can quickly place in their stack. 3/5 Binary allowlisting is a recognized endpoint control, and the Mac Admins Podcast devoted an episode to Santa’s move to the company, evidence that Mac administrators already know where Santa fits. Workshop’s placement beside EDR still needs the vendor’s explanation, which its homepage and Workshop page each supply in a question-and-answer section. [s20, s1, s2]
Incumbent Defensibility How vulnerable the core value proposition is to absorption as a feature by a platform vendor. 3/5 Maintaining the open-source agent that Google cites as a migration option, plus tags, approvals and telemetry wired into daily fleet operations, gives Workshop some friction to absorption. Santa’s public sync protocol and community servers such as Moroz, Rudolph and Zentral let a customer keep the agent without Workshop, so the cited record documents no structural moat that bundling could not eventually replicate. [s17, s2, s16, s8]
Business Risks North Pole Security contrasts Workshop with CrowdStrike, Jamf Protect and SentinelOne on its Workshop page…
  • North Pole Security contrasts Workshop with CrowdStrike, Jamf Protect and SentinelOne on its Workshop page. Any of those vendors could add comparable allowlisting approval workflows and give buyers a reason to skip a separate Workshop purchase.
  • Santa’s public sync protocol lets organizations run the agent with community servers, so if Workshop-only features on the private protocol fail to justify the price, Santa adoption could grow without Workshop revenue following it.
  • If the company moves more capability onto the private sync protocol and open-source users object, a community fork could weaken the maintainer position that Google’s archive notice currently points users toward.
  • The company has disclosed one $4 million seed round, from July 2025. If no follow-on round appears, capital could limit the enterprise push that round was raised to fund.
  • Santa decides whether each program on a Mac may run, so an enforcement bypass exploited before a fix ships would undercut the prevention case Workshop is sold on. The company published nine security advisories for Santa in August and September 2026, several describing binaries that escaped enforcement.
Problem & Market North Pole Security sells to enterprises that want to stop unapproved software from running on their Macs…

North Pole Security sells to enterprises that want to stop unapproved software from running on their Macs. Its funding announcement argues that detection tools act only after code executes, and that agentic AI workflows and AI-generated code make attackers faster at exploiting that gap. CEO Pete Markowsky frames the market in vendor terms, saying one in five business machines in the US now runs macOS while the industry lacks a security playbook for it.

The specific pain is operational. Allowlisting blocks anything not approved, and the company says it has traditionally been seen as too rigid for broad enterprise deployment. The company answers with delegated approval workflows and says they let teams settle requests in minutes, and its Workshop page says the same allowlisting approach protected more than 100,000 Macs at Google.

Sources outside the vendor describe an installed base that depends on this control. Google’s archived Santa repository asks existing users to migrate to an actively maintained fork, and the Mac Admins Podcast devoted an episode to Santa’s move to North Pole Security and what it means for the tool’s users. Neither source sizes the pain in incidents or dollars, so the vendor supplies every figure for the problem’s scale. [s2, s5, s18, s1, s20, s17]

Product Capabilities Santa is the enforcement layer, and its code is public…

Santa is the enforcement layer, and its code is public. The open-source agent controls which binaries can run, which processes can read or write protected files, and which removable devices can connect, and it logs system events. Its file access controls aim to stop infostealers from reading sensitive files. It runs standalone under an Apache 2.0 license, and its repository lists Workshop beside community sync servers as ways to manage it at fleet scale.

Workshop is the commercial console that makes allowlisting manageable across a fleet. The product page documents execution rules at five precedence levels, package rules for Homebrew, npm, Cargo and other developer ecosystems, tags mapped to identity-provider groups, telemetry queryable with SQL, and commands that kill running processes. Its risk engine screens every approval request through VirusTotal, ReversingLabs and customer plugins, and timeouts and errors fail closed.

The product has widened beyond allowlisting in 2026. The 2026.6 release, which the company calls its largest, added network rules and endpoint privilege management in beta plus Signals, which turn host telemetry into near-realtime detections. The 2026.8 release in September added time based rules that decide when a program may run and can quit it when the window closes. AI Chat answers plain-English questions about the fleet using the customer’s own Anthropic, OpenAI or Google keys.

A split sync protocol separates the open agent from the paid console. Santa 2025.10 introduced a private protocol whose features go only to Workshop customers, while the public protocol that community servers use stays maintained, and the company says the split funds continued investment in the open-source project. [s6, s1, s16, s2, s10, s9, s7, s12, s11, s8]

Competitive Positioning North Pole Security positions Workshop against detect-and-respond endpoint tools by name…

North Pole Security positions Workshop against detect-and-respond endpoint tools by name. Its Workshop page asks how Workshop differs from CrowdStrike, Jamf Protect or SentinelOne and answers that those tools are primarily reactive, while Workshop blocks unknown software before it runs. The same page says most customers run Workshop alongside their existing EDR, so the company pitches it as an added prevention layer.

Free alternatives to Workshop exist because Santa is open source. The company’s own Santa page says the agent works standalone, and that community servers such as Moroz, Rudolph and Zentral speak its open sync protocol for organizations that want fleet-wide rules without a vendor. On that page the company presents Workshop as the option for buyers who want approvals, risk intelligence and fleet-wide telemetry from the team that maintains Santa, so that bundle is what Workshop has to sell against community servers.

The company’s counterweight is its role as maintainer. Google archived its own repository in February 2025 and cites the company’s fork as an example of an actively maintained migration option. A rival console that manages Santa would depend on an agent this team maintains. [s2, s1, s6, s16, s17]

Go-to-Market & Traction North Pole Security now names customers on its homepage…

North Pole Security now names customers on its homepage. Under a “Trusted by teams at” heading it lists Figma, Reddit, Canva, Atlassian, Datadog, Push Security, Basis Theory, Phantom and Sempre Health. The company’s one-year retrospective, dated October 2025, recorded its first customer and said later Workshop releases incorporated feedback from customers, and its funding post describes Fortune 500 design partners.

Selling runs through a demo motion, and the founders front the company’s public appearances. Pete Markowsky and Russell Hancox appeared on the Mac Admins Podcast, the contact page routes pricing and rollout questions to a sales address, and the site’s own page index lists no pricing page. The #santa channel on the Mac Admins Slack, which the contact page counts at more than 1,000 members, is the visible community channel into existing Santa fleets.

Andreessen Horowitz led the company’s $4 million seed round, announced in July 2025 through GlobeNewswire and relayed by Pulse 2.0, and the release says the capital goes to go-to-market work and Workshop. The customer list and the design partners appear in the company’s own voice. The company does not disclose a customer count or revenue. [s1, s4, s5, s13, s18, s19, s20, s14]

Team & Credibility The founders came from Google’s Santa team and bring named builds in the same domain…

The founders came from Google’s Santa team and bring named builds in the same domain. The about page credits Russell Hancox and Tom Burgin as Santa’s two original authors and names Matt White as the original author and lead of Apple’s Endpoint Security Framework and the last Santa lead at Google. It describes Pete Markowsky as having led Google’s first-party security agent development after co-founding Capsule8, which it says was sold to Sophos.

Independent sources confirm the team’s standing in the Mac security community rather than each biography. Google’s archive notice cites the company’s fork as a maintained successor, and the Mac Admins Podcast hosted Pete and Russell to discuss Santa’s move. The Capsule8 sale and the individual authorship credits appear in the company’s own materials among the reviewed sources.

First-year hiring added operating roles around the engineers. The retrospective records Mark Shiozaki joining as director of sales engineering and customer success, Lauren Pearl as fractional CFO and Ian Langworth as principal engineer during its first year, and Royal Hansen as an advisor. The team had six people as of October 2025, and no later headcount appears in the reviewed sources. [s3, s4, s17, s20]

Trust Readiness Open source is the company’s main trust asset, and it now includes a public vulnerability record…

Open source is the company’s main trust asset, and it now includes a public vulnerability record. The agent’s code, license and release history are public, and the repository’s security advisories page lists nine advisories published in August and September 2026, one rated critical and two rated high. A security reviewer can read both the code that will run on every Mac and the advisories for issues found in it.

Formal assurance is displayed but gated. The homepage footer contains an AICPA SOC 2 Type II badge and the site’s navigation lists a Trust page for security and compliance information, while the Workshop page says security, compliance and SOC 2 details are available on request. A reviewer can request SOC 2 details from the company.

Company age will weigh in the counterparty review. North Pole Security is a 2024 company on one disclosed seed round, asking enterprises to put a system extension on every Mac. The Workshop page says Santa keeps enforcing its last-synced rules if Workshop is unreachable, and the agent’s Apache license lets its code outlive any single vendor, which softens part of that review. [s16, s22, s1, s2, s15, s11]

Competitors CrowdStrike, Jamf, SentinelOne, Microsoft, Iru…
Company Relationship Note Compare
CrowdStrike competes with North Pole Security names CrowdStrike on its Workshop page among the reactive endpoint tools it contrasts with Workshop’s prevention-first approach.
Jamf competes with North Pole Security contrasts Workshop with Jamf Protect on its Workshop page, and Workshop integrates with Jamf for rollout on the same Mac fleets.
SentinelOne competes with North Pole Security names SentinelOne on its Workshop page among the reactive endpoint tools it positions Workshop against.
Microsoft competes with Competes for the same enterprise Mac endpoint budget, and Workshop integrates with Microsoft Entra and Intune. N/AMicrosoft is scored by product line, not as a whole company, so there is no company-wide column to compare. Open its profile to compare a specific product.
Iru adjacent Listed among Workshop’s integrations, adjacent to the Mac-fleet buyer Workshop serves. N/AWe captured the evidence for these companies under different evidence-model versions (v1 vs v2), so the totals were scored under different conditions and are not directly comparable.

Add analyzed competitors to compare them side by side with North Pole Security.

Strategy Deep Dive

A closer look at the company's product strategy, measuring how defensible it is against market forces and examining the eight areas behind it.

Defensibility

Contested 13 /21 Contested: Defensibility of 13 to 14, the typical band, where a moat exists but is under pressure. reinforce or reposition

North Pole Security draws its durability mainly from its people and its position as Santa’s maintainer, and its one accumulated asset is a young library of rule packs it writes for subscribers. Customers buy Workshop as software their own teams operate, the agent is Apache licensed, and the risk engine relies on third-party threat intelligence. What a rival would find slow to match is the founders’ macOS systems experience and the maintained fork Google cites as a migration option. Workshop grows harder to replace as customers wire tags, approval workflows and telemetry into daily fleet operations.

Dimension Score Rationale
Value Delivery Does the product sell software as the product, or judgment, trust, or accountability with software as the delivery mechanism. 1/3 Customers buy Workshop as software their own security teams operate, through a demo and sales motion, and the customer’s team owns the approval decisions and outcomes. The reviewed sources describe no managed service or accountability layer sold alongside it.
Switching Cost How expensive leaving is for a customer: data portability, integrations, learned workflows, network effects, regulatory data residency. 2/3 Tags mapped to identity-provider groups, accumulated rules, approval workflows and telemetry history make leaving Workshop a re-plumbing project, which is meaningful friction. Santa’s public sync protocol and community servers give a departing customer a documented path that keeps the agent, and the cited record does not size a migration or document a mechanism that would make leaving expensive.
Compliance Moat Whether certifications, liability acceptance, or audit trails block an easy replacement. 1/3 The homepage footer contains an AICPA SOC 2 Type II badge and the Workshop page offers SOC 2 details on request, an attestation a funded competitor can obtain through ordinary enterprise preparation. No other attestation appears in the reviewed sources, and no regulation named in them requires this product class.
Problem Complexity Whether the product requires ML, optimization, real-time systems, or years of specialized expertise. 3/3 Santa is a macOS system extension that decides in real time whether each program may run, and the team behind it wrote Santa and Apple’s Endpoint Security Framework. The company’s 2026 advisories for Mach-O parsing and tamper-resistance issues document how much specialized platform expertise correct enforcement demands.
Buyer Profile Whether buyers are SMB operators, mid-market IT teams, or regulated enterprises and governments with procurement gates. 2/3 The customers the company names on its homepage, including Figma, Reddit, Canva, Atlassian and Datadog, are mostly technology companies with IT governance, and the list establishes no regulated-enterprise or government buyer class. The Fortune 500 design partners the company cites are unnamed, so the evidenced buyer class matches mid-market companies with IT governance.
Layer Whether the product is an end-user application, a platform with application features, or infrastructure other applications depend on. 2/3 Workshop is a management platform with an API, webhooks and plugin hooks around an OS-level agent, and independent sync servers operate against Santa’s protocol. The reviewed sources do not identify third-party applications built on Workshop itself, so it reads as a platform with application features.
Proprietary Data, Content, or IP Whether the product accumulates datasets, content licenses, or IP that a rival cannot recreate from scratch. 2/3 The company writes and maintains a library of rule packs for subscribers and says the packs are tested against real fleets and kept current. The library is a vendor-retained content asset the cited record does not show as public. The library dates from 2026 and the record does not size it, and no proprietary dataset or patent appears beside it. The agent is Apache licensed, and the risk engine uses VirusTotal, ReversingLabs and customer plugins.
Strategic Market Segmentation North Pole Security’s beachhead is the organizations that already run Santa or want the allowlisting discipline it enforces…

North Pole Security’s beachhead is the organizations that already run Santa or want the allowlisting discipline it enforces. Google archived its Santa repository in February 2025 and encourages existing users to migrate to an actively maintained fork, naming the company’s repository as an example. The contact page counts more than 1,000 members in the #santa channel on the Mac Admins Slack, a rough measure of the practitioner community the product addresses.

Its homepage lists Figma, Reddit, Canva, Atlassian, Datadog, Push Security, Basis Theory, Phantom and Sempre Health under a “Trusted by teams at” heading, and its funding post describes Fortune 500 design partners. Workshop ships SCIM directory sync and multi-party approval, controls that matter to a security or client-platform team managing many Macs.

Workshop includes package rules for developer software. It automates allowlisting for Homebrew, npm, Cargo, GitHub Releases, VS Code extensions and, since September 2026, Nix, which matters most where developers install new software constantly. The about page states a mission of serving organizations of any size, and the site routes buyers to demos and a sales address.

Geographic focus stays implicit. The company’s terms of use list a Brooklyn, New York mailing address. The macOS-share figure it uses to size the market is a US figure stated by its CEO, with no vertical packaging in the reviewed sources.

Product Capabilities & AI Advantages The company’s core capabilities are verifiable in public code…

The company’s core capabilities are verifiable in public code. Santa performs binary authorization, file access authorization, removable media blocking and system event logging, and its repository publishes the source under an Apache 2.0 license with 2,625 commits and 23 releases. A buyer can audit the enforcement software before deploying it rather than relying on a datasheet.

Workshop turns the agent into a fleet-scale control system. The product page documents five precedence levels of execution rules, package rules, file access rules, tags mapped to identity-provider groups, SQL-queryable telemetry and remote process kills. The risk engine screens every approval request through VirusTotal, ReversingLabs and customer plugins, disables approval when any check fails, and treats timeouts and errors as denials.

Releases in 2026 have added whole control categories. The 2026.6 release added network rules and endpoint privilege management, both in beta, and Signals for near-realtime detection on the host. The 2026.7 release extended rule packs, curated rule sets the company writes and maintains, to every rule type. The 2026.8 release added time based rules that can quit a program when its allowed window closes.

The company treats AI as a bring-your-own-model feature and as a threat to block. AI Chat answers plain-English questions about hosts, rules and events using customer-supplied Anthropic, OpenAI or Google keys, runs read-only by default, and writes every tool call to the audit log. The company also publishes a guide to blocking OpenClaw, an autonomous AI agent, with layered Santa rules, and a rule pack aimed at persistent AI agent gateways. The reviewed sources identify no proprietary detection model or cross-customer data asset.

Sales Engagement & Go-to-Market North Pole Security builds interest through its open-source community and closes deals through sales…

North Pole Security builds interest through its open-source community and closes deals through sales. The open-source agent is the entry point, the Santa repository calls Workshop the official sync server, and prospects reach the company through a demo form or a sales address. The company meets buyers where Santa users gather, in the Mac Admins community and on the project’s repository.

The founders front the public selling. Pete Markowsky and Russell Hancox appeared on the Mac Admins Podcast to explain Santa’s move, and the retrospective says the founders announced the company at a Mac Admins conference in Sweden and presented Workshop at MacDevOpsYVR. The company’s first employee was a director of sales engineering and customer success, and no dedicated sales leader appears in the reviewed sources.

Existing Santa fleets are the natural prospect list. Google’s archive notice cites the company’s repository as a maintained fork for existing users, and the contact page counts more than 1,000 members in the #santa Slack channel. Because the sync protocol is public and community servers exist, an organization can adopt Santa through those same channels without ever meeting the sales team.

Andreessen Horowitz led the seed round the company raised for go-to-market work. The July 2025 release says the capital will speed go-to-market efforts and improve Workshop for enterprise customers, and Pulse 2.0 relayed the round. The company now publishes the names of companies it counts among its customers.

Pricing Model Workshop’s pricing is not published…

Workshop’s pricing is not published. The site’s machine-readable page index lists no pricing page, and the contact page routes pricing questions to a sales address.

The charging unit is also unpublished. No reviewed page states whether Workshop charges per endpoint, per user or per fleet, so a prospect cannot estimate how cost scales with fleet size before talking to sales.

Workshop is priced against a free baseline. Santa runs standalone at no cost, and community servers such as Moroz, Rudolph and Zentral give an organization fleet-wide rules without a vendor, so Workshop has to earn its price through approvals, the risk engine and telemetry. The private sync protocol introduced with Santa 2025.10 reserves some capabilities for paying customers while leaving the free path working, and the company says that split sustains its open-source investment.

Product Delivery & Operations Workshop runs as a managed cloud service or self-hosted…

Workshop runs as a managed cloud service or self-hosted. The product page offers cloud hosting with managed updates and scaling alongside a self-hosted option, integrates with Jamf and Intune for rollout, and supports Okta, Azure AD, Google Workspace, OneLogin, JumpCloud or any SAML or OIDC provider. SCIM directory sync applies incremental updates every 60 seconds with hourly reconciliation, and the company says a user’s Mac picks up a new team’s policies within a minute.

Santa decides at every program launch, so an outage could block real work, and the design addresses that risk. The Workshop page says Santa keeps enforcing its last-synced rules when Workshop is unreachable, multi-party approval keeps one admin account from making destructive changes, and the risk engine fails closed. The site’s navigation also lists a Status page for live service status and incident history.

The company ships on a near-monthly cadence and documents each release. Its blog records paired Santa and Workshop releases on July 10, August 4 and September 10, 2026, each describing new capabilities in detail. The reviewed sources contain no published SLA or uptime commitment for the managed service.

Earning Customers' Trust Source transparency is the company’s strongest trust asset…

Source transparency is the company’s strongest trust asset. The agent’s code, license and release history are public, and the repository states that North Pole Security and its Santa are not affiliated with Google. A reviewer can audit the software that decides what runs on every Mac in the fleet.

The company publishes its vulnerability record. The repository’s security advisories page lists nine advisories from August and September 2026, one rated critical and two rated high, covering issues such as Mach-O parsing cases that escaped Lockdown enforcement and a tamper-resistance bypass. Publishing each advisory gives security reviewers a record to assess. The same record documents that the enforcement code has had exploitable gaps.

Formal assurance is displayed and gated. The homepage footer contains an AICPA SOC 2 Type II badge and the site lists a Trust page for security and compliance information, while the Workshop page says SOC 2 details are available on request. A reviewer therefore obtains the attestation report through the company. No other attestation appears in the reviewed sources.

The AI feature shipped with a conservative security model. AI Chat runs read-only until an admin explicitly enables writes, and it can keep provider keys in AWS or GCP secret managers rather than in Workshop’s database. AI Chat records every tool call with the user’s identity and conversation ID in the same audit log as UI and API actions.

Platform Strategy & Ecosystem Positioning Santa’s sync protocol is the platform surface, and an ecosystem already builds on it…

Santa’s sync protocol is the platform surface, and an ecosystem already builds on it. The protocol is a documented HTTP interface, and independent servers such as Moroz, Rudolph and Zentral operate against it. The company’s repository lists Workshop first among those options and calls it the official sync server, a label that comes from the project’s maintainer.

Workshop exposes extension points in both directions. Customers can add their own checks to the risk engine through webhook plugins and receive webhooks when audit events or Signals fire. AI Chat and the company’s MCP integration give AI tools a way into fleet data. The company positions Workshop beside Jamf, Intune, Entra and the customer’s identity provider rather than against them.

Rule packs add a content layer to the platform. Since 2026.7 the packs cover every rule type, and the company writes and maintains them so a subscriber adopts vetted policy for apps such as 1Password, Claude and Cursor instead of writing it. The reviewed sources do not identify third parties publishing packs or applications for Workshop itself.

The private sync protocol is where the company tests how much value to reserve for paying customers. Since the Santa 2025.10 release some capabilities reach only Workshop customers, while the public protocol stays maintained. If the company moves too much behind that boundary, users could fork the agent or stay on community servers.

Team & Execution Capability The founders’ fit to the problem is direct…

The founders’ fit to the problem is direct. The about page credits Russell Hancox and Tom Burgin as Santa’s two original authors and Matt White as the original author of Apple’s Endpoint Security Framework, which every macOS security product must use. Pete Markowsky led Google’s first-party security agent development and co-founded Capsule8, whose sale to Sophos appears in the company’s own bio among the reviewed sources.

Google’s archive notice cites the founders’ fork as a maintained migration option, and the Mac Admins Podcast hosted Pete and Russell to discuss Santa’s future.

First-year hiring filled operating gaps around the engineers. Mark Shiozaki joined from Capsule8, Sysdig and Red Hat as director of sales engineering and customer success, Ian Langworth as principal engineer, Lauren Pearl as fractional CFO with Trail of Bits experience. Royal Hansen joined as an advisor. The team had six people as of October 2025, and the reviewed sources give no later count.

The execution record is public and checkable. The retrospective counts 12 Santa releases and more than 470 merged pull requests in the company’s first year, the repository now records 23 releases and 65 contributors, and paired releases continued through September 2026.

Sources

Company Detail Sources (5)
Id Source Tier Accessed
f1 North Pole Security homepage official 2026-09-22
f2 North Pole Security: about page official 2026-09-22
f3 North Pole Security: terms of use official 2026-09-22
f4 GlobeNewswire: North Pole Security seed funding release of July 30, 2025 press 2026-09-22
f5 Workshop product page official 2026-09-22
Profile Analysis Sources (22)
Id Source Tier Accessed
s1 North Pole Security: homepage official 2026-09-22
s2 North Pole Security: Workshop product page official 2026-09-22
s3 North Pole Security: about page official 2026-09-22
s4 North Pole Security blog: One Year of North Pole Security official 2026-09-22
s5 North Pole Security blog: seed funding announcement official 2026-09-22
s6 North Pole Security: Santa product page official 2026-09-22
s7 North Pole Security: blog index official 2026-09-22
s8 North Pole Security blog: A Private Sync Protocol for Workshop official 2026-09-22
s9 North Pole Security blog: Santa and Workshop 2026.8 release post official 2026-09-22
s10 North Pole Security blog: Santa and Workshop 2026.6 release post official 2026-09-22
s11 North Pole Security: AI Chat feature page official 2026-09-22
s12 North Pole Security: risk engine feature page official 2026-09-22
s13 North Pole Security: contact page official 2026-09-22
s14 North Pole Security: site page index (llms.txt) official 2026-09-22
s15 North Pole Security trust-center probe (2026-09-22): two agent-browser renders of trust.northpole.security returned only the portal title official 2026-09-22
s16 GitHub: northpolesec/santa repository official 2026-09-22
s17 GitHub: Google's archived santa repository research 2026-09-22
s18 GlobeNewswire: North Pole Security seed funding release of July 30, 2025 press 2026-09-22
s19 Pulse 2.0: item on the North Pole Security seed round press 2026-09-22
s20 Mac Admins Podcast: episode 389 on North Pole Security and Santa press 2026-09-22
s22 GitHub: northpolesec/santa security advisories page official 2026-09-22
s27 North Pole Security: Workshop documentation introduction official 2026-09-22
Deep-Dive Sources (25)
Id Source Tier Accessed
s1 North Pole Security: homepage official 2026-09-22
s2 North Pole Security: Workshop product page official 2026-09-22
s3 North Pole Security: about page official 2026-09-22
s4 North Pole Security blog: One Year of North Pole Security official 2026-09-22
s5 North Pole Security blog: seed funding announcement official 2026-09-22
s6 North Pole Security: Santa product page official 2026-09-22
s7 North Pole Security: blog index official 2026-09-22
s8 North Pole Security blog: A Private Sync Protocol for Workshop official 2026-09-22
s9 North Pole Security blog: Santa and Workshop 2026.8 release post official 2026-09-22
s10 North Pole Security blog: Santa and Workshop 2026.6 release post official 2026-09-22
s11 North Pole Security: AI Chat feature page official 2026-09-22
s12 North Pole Security: risk engine feature page official 2026-09-22
s13 North Pole Security: contact page official 2026-09-22
s14 North Pole Security: site page index (llms.txt) official 2026-09-22
s15 North Pole Security trust-center probe (2026-09-22): two agent-browser renders of trust.northpole.security returned only the portal title official 2026-09-22
s16 GitHub: northpolesec/santa repository official 2026-09-22
s17 GitHub: Google's archived santa repository research 2026-09-22
s18 GlobeNewswire: North Pole Security seed funding release of July 30, 2025 press 2026-09-22
s19 Pulse 2.0: item on the North Pole Security seed round press 2026-09-22
s20 Mac Admins Podcast: episode 389 on North Pole Security and Santa press 2026-09-22
s21 North Pole Security: Santa sync server documentation official 2026-09-22
s22 GitHub: northpolesec/santa security advisories page official 2026-09-22
s23 North Pole Security blog: Blocking OpenClaw guide official 2026-09-22
s24 North Pole Security blog: Santa and Workshop 2026.7 release post official 2026-09-22
s29 North Pole Security blog: AI Chat for Workshop announcement official 2026-09-22

Disclaimer

This content is provided "as is" with no warranties.

This site is an experimental research aid created by Zeltser Security Corp. All its data gathering and analysis was performed autonomously without human review, and it can contain errors of fact, interpretation, and judgment that a human reviewer might catch.

The analyses are statements of opinion, not statements of fact. Machine analysis produced the scores, summaries, and matrix placements by weighing the public sources each page cites, and reasonable people can weigh the same sources differently. Where a page states a fact, it cites the public source and the date it was checked, and the statement is only as accurate as that source. Unless a profile expressly says otherwise, the analysis involves no hands-on testing and no independent validation of any company's products or services.

Nothing here is professional, security, legal, financial, investment, or purchasing advice, and nothing here is a recommendation to invest in, do business with, or avoid any company. Inclusion of a company is not an endorsement, and absence of a company is not a judgment about it. Reading this site creates no advisory or client relationship. Verify any detail you plan to act on against the vendor's current materials.

The content is provided "as is" and "as available," with all warranties disclaimed, express or implied, including merchantability, fitness for a particular purpose, accuracy, and non-infringement. No entry is warranted to be complete, current, or correct. Companies change, vendors update their claims, sources can be wrong, and automated analysis can misread them.

To the fullest extent permitted by law, the operator, Zeltser Security Corp, is not liable for any damages that arise from using this site or relying on its content, including direct, indirect, incidental, special, and consequential damages and lost profits, even if advised that such damages were possible. If you are dissatisfied with the site or disagree with these terms, your remedy is to stop using it.

Entries link to vendor pages, press coverage, and other external sites that Zeltser Security Corp does not control and is not responsible for. A link is not an affiliation with the destination or an endorsement of it. Product and company names and trademarks are the property of their owners, used here nominatively to identify the companies described. Short quotations from cited sources appear for identification and commentary.

Use, quotation, automated retrieval, and redistribution of the content are governed by the Terms of Use at cybercompanyprofiles.com/terms, which permit personal and internal business use with attribution and prohibit republication and resale.