The short answer. KnockKnock answers the question that matters first: what is persistently installed and set to run. KextViewer answers the next one: which modules are loaded into the kernel. Dylib Hijack Scanner looks for applications vulnerable to library substitution. Suspicious Package inspects an installer before you run it, which is the only tool here that prevents rather than detects. Santa is the binary authorisation system, which is policy rather than audit. stronghold configures security settings from the terminal, LockDown audits and remediates configuration, Mana Security is vulnerability management for individuals, and Vulert monitors dependencies for known issues. The dividing question is whether you are trying to find out what is there, decide what is allowed, or check what is known to be broken — three jobs that are sold as one word, security.
This guide covers 9 security audit tools for macOS. Every fact below is drawn from the same verified records that back each app’s own page. The recommendations are our editorial judgment, not payment.
Quick comparison
| App | What it is | Pricing | Licence | Version |
|---|---|---|---|---|
| Dylib Hijack Scanner | security tool | Open source | GPL-3.0 | 1.6.0 |
| KextViewer | security tool | Open source | not published | 2.0.0 |
| KnockKnock | security tool | Open source | GPL-3.0 | 4.1.0 |
| LockDown | security tool | Open source | not published | 1.0.0 |
| Mana Security | security tool | Open source | not published | 2.4.2 |
| Santa | security tool | Open source | Apache-2.0 | 2026.8 |
| stronghold | security tool | Open source | MIT | 1.5 |
| Suspicious Package | security tool | Free | not published | 4.8 |
| Vulert | security tool | not published | not published | — |
What actually decides this
- Inventory, policy or vulnerability. An inventory lists what exists. A policy decides what may run. A vulnerability feed tells you what is known to be wrong. A tool in one group does not do the others, and the reports look similar enough that the difference is easy to miss.
- Whether it acts or reports. Santa blocks. stronghold changes settings. The rest observe. A tool that changes state is a commitment; one that reports is a reading, and readings can be taken repeatedly without consequence.
- What it needs in privileges. Kernel modules, launch daemons and authorisation decisions all require elevated access. A security tool that asks for nothing is looking at something small. The permission request is a fair proxy for the depth of the inspection.
- Whether the database is maintained. A vulnerability feed is only as good as its updates. A scanner with a stale list reports a clean machine with confidence, which is worse than reporting nothing.
- What it does about a finding. Some tools explain the path and let you decide. Some offer a remediation button. Some do neither and produce a red dot. The third kind is the most common and the least useful.
- Whether the tool itself is auditable. Most of these are open source, which matters here more than elsewhere: a security tool is asking to inspect everything, and the ability to read what it does is the only check on that request.
Our picks
- KnockKnock — Its record describes seeing what is persistently installed, which is the inventory case. Choose it when you want to know what is set to run on the machine.
- KextViewer — Its record describes viewing all modules loaded in the OS kernel, which is the kernel case. Choose it when you need to see what is loaded into the kernel.
- Suspicious Package — Its record describes inspecting macOS installer packages, which is the prevent case. Choose it when you are about to run an installer you did not build.
- Santa — Its record describes a binary and file access authorisation system, which is the policy case. Choose it when you want to decide what binaries are allowed to run.
- stronghold — Its record describes configuring macOS security settings from the terminal, which is the configuration case. Choose it when you want to configure security settings reproducibly from the terminal.
- Mana Security — Its record describes vulnerability management for individuals, which is the vulnerability case. Choose it when you want a vulnerability view aimed at an individual.
The apps
Dylib Hijack Scanner
Dylib Hijack Scanner is a security tool for macOS. Utility for scanning apps vulnerable to dylib hijacking. It is released under GPL-3.0.
What it does. a simple utility that will scan your computer for applications that are either susceptible to dylib hijacking or have been hijacked.
Dylib Hijack Scanner is listed with current version 1.6.0.
Full profile and verified facts for Dylib Hijack Scanner →
KextViewer
KextViewer is a security tool for macOS. View all modules on that are loaded in the OS kernel. It is open source.
What it does. View loaded kernel modules.
KextViewer is listed with current version 2.0.0.
Full profile and verified facts for KextViewer →
KnockKnock
KnockKnock is a security tool for macOS. See what’s persistently installed on your Mac. It is released under GPL-3.0.
What it does. Like AutoRuns …but for macOS!
KnockKnock is listed with current version 4.1.0.
Full profile and verified facts for KnockKnock →
LockDown
LockDown is a security tool for macOS. Open-source tool for El Capitan that audits and remediates security configuration settings. It is open source.
What it does. Lockdown audits and remediate security configuration settings on OS X.
LockDown is listed with current version 1.0.0.
Full profile and verified facts for LockDown →
Mana Security
Mana Security is a security tool for macOS. vulnerability management app for individuals. It is open source.
What it does. Continious monitoring of 100+ apps against known and potential vulnerabilities. Instant detection of a new vulnerabilities as soon as they appear in public databases (e.g. CVE). Tracks patching velocity and compares it against Mana’s community and other benchmarks.
Mana Security is listed with current version 2.4.2.
Full profile and verified facts for Mana Security →
Santa
Santa is a security tool for macOS. Binary and file access authorization system. It is released under Apache-2.0.
What it does. North Pole Security builds proactive endpoint protection for macOS. Workshop is the control plane for Santa, the open source allowlisting tool from Google.
Santa is listed with current version 2026.8.
Full profile and verified facts for Santa →
stronghold
stronghold is a security tool for macOS. Easily configure MacOS security settings from the terminal. It is released under MIT.
What it does. Easily configure macOS security settings from the terminal.
stronghold is listed with current version 1.5.
Full profile and verified facts for stronghold →
Suspicious Package
Suspicious Package is a security tool for macOS. An application for inspecting macOS installer packages. It is free.
Suspicious Package is listed with current version 4.8.
Full profile and verified facts for Suspicious Package →
Vulert
Vulert is a security tool for macOS. Dependency vulnerability monitoring service for open-source packages. Its pricing is not published.
What it does. Vulert provides software composition analysis with no install, using manifest files. Get real-time vulnerability alerts. Try Vulert today.
Full profile and verified facts for Vulert →
How to choose
- Free of charge. Suspicious Package — no payment is required.
- No licence fee, source available. Dylib Hijack Scanner, KextViewer, KnockKnock, LockDown, Mana Security, Santa and stronghold — the source can be read and, under the terms of each licence, reused.
- Pricing not published in our data. Vulert — check the developer’s own site before assuming anything about cost.
Open source: Dylib Hijack Scanner, KextViewer, KnockKnock, LockDown, Mana Security, Santa and stronghold (7 of 9).
Common mistakes
- Running a scanner once and treating the result as a permanent state.
- Blocking binaries with an authorisation system before writing down how to unblock them.
- Reading a clean vulnerability report as evidence that nothing is wrong. It means nothing on the list matched.
- Installing a security tool from a source you did not verify, which is the exact problem it was meant to find.
How this guide was put together
Each app’s facts come from its own record: the developer’s own pages and repository, the App Store listing where one exists, and the documentation, each with a source grade and an access date. Where a fact rests on the developer’s own statement rather than on something we verified independently, the sentence says so. Where our data has no value for something, the guide says “not published” instead of guessing.
A price appears here only where the record carries one from a stated source; the guide never estimates one, and it records the pricing model alongside so the two can be read together. Prices change and vary by region, so each app links to its own page for the current detail.
The facts and the recommendations are kept apart on purpose. Everything in the app entries, the comparison table and the answers above is composed from the records. The short answer, the criteria and the picks are our editorial judgment: they reflect what we would choose and why, and they are not paid for. Where we make a recommendation we name the condition it applies under, because we do not call anything “the best” without explaining the criteria.
Frequently Asked Questions
How do I choose between these security audit tools?
There is no single answer — it depends on what you need. This guide covers 9 security audit tools: Dylib Hijack Scanner, KextViewer, KnockKnock, LockDown, Mana Security, Santa, stronghold, Suspicious Package and Vulert. They differ mainly in pricing model, licence and the trade-offs each one carries. Pick by the trade-off you care about rather than by rank.
Are these security audit tools free?
Pricing across this group: open source (Dylib Hijack Scanner, KextViewer, KnockKnock, LockDown, Mana Security, Santa and stronghold), free (Suspicious Package) and not published (Vulert). Where we list pricing as not published, the developer does not state a model we could verify — check their own site before assuming anything about cost. We quote a price only where the record carries one from a stated source, and we never estimate one. Prices change and vary by region and by store, so always check the developer’s own page for the current figure.
Which of these security audit tools are open source?
Dylib Hijack Scanner (GPL-3.0), KextViewer (not published), KnockKnock (GPL-3.0), LockDown (not published), Mana Security (not published), Santa (Apache-2.0) and stronghold (MIT) are open source.
Do these security audit tools support Apple Silicon?
Our data does not carry an explicit Apple Silicon statement for any app in this group, so we do not claim one. The absence of a statement is not the same as the absence of support.
How do I choose between them?
Start with how you pay: the guide groups these apps by pricing model, because the budget is the constraint most people actually have. Then check the trade-offs listed for each app: the limitations are the part that decides most people’s choice, because they describe what the app will not do for you.
