Mac security.
Clear explanations.
Local by design.
Nick 5.1 opens in Simple mode with clear protection status, one-minute Quick Check, and a single Activity timeline. Advanced detail is there when you need it.
Requires macOS 26+ · Apple Silicon or Intel · Free · AGPL-3.0
Simple mode first
Your first five minutes
Nick starts with five plain-language destinations: Home, Scan, Activity, Protection, and Storage. Advanced mode is there when you need process, network, persistence, rule, or diagnostic detail.
The approval prompts are owned by macOS and can vary slightly by system version. Nick cannot grant them silently; it explains each request, opens the correct pane, and waits for verified component health.
- 01
Install Nick
Open the signed, notarized package and launch Nick from Applications.
- 02
Approve the security extension
macOS asks before Nick's Endpoint Security extension can observe process and file activity.
- 03
Allow Full Disk Access
Nick opens the correct System Settings pane so protected system and mail locations can be checked.
- 04
Choose network monitoring
The Network Extension is optional, observation-only in 5.1, and fails open if it is unavailable.
- 05
Run Quick Check
Simple mode checks common settings, startup items, running apps, and connections in about a minute.
Privacy, without fine print
What stays local. What can connect.
Nick has no hosted detection service and does not automatically upload browsing history, file contents, process activity, or security telemetry.
| Function | Default | What leaves your Mac | Your control |
|---|---|---|---|
| Detection and analysis | Local | Nothing. Process, file, persistence, capture-device, and connection evidence is analyzed on the Mac. | Always local |
| Protection and app updates | On | Explicit signed update requests. Nick does not attach browsing history, file contents, or security telemetry. | Visible in Settings |
| Webhook alerts | Off | Only the alert delivery the user explicitly configures. | Optional |
| Links | On demand | A web request is made only when the user opens a link. | User initiated |
| Reports and support exports | Local file | Nothing automatically. Sanitized exports leave the Mac only if the user chooses to share them. | Preview and share manually |
Version 5.1.1 · Build 5101 · Released November 7, 2026
Broader evidence. Quieter operation. Explicit control.
Nick 5.1.1 reduces maintenance and updater false alerts, fixes delayed reporting, and improves everyday controls. Enforcement remains visible and user controlled, with six synthetic prevention cases verified on the installed release build.
- Scoped maintenance and updater checks reduce false alerts without blanket trust exemptions
- Validated own-store reads and Git/SSH signing keep normal developer activity quieter
- Durable reporting fixes keep actionable findings from waiting for another event
- Opt-in Strict Mode with an emergency stop that preserves detection and reporting
- Clearer blocked-event review, menu-bar activation, and history confirmation
- Six synthetic prevention cases verified on installed build 5101; no overall effectiveness rating claimed
Strict Mode remains off by default. Network findings appear in Network Activity only and do not block traffic. No security tool can promise complete malware coverage, and Nick keeps observed, blocked, quarantined, and reviewed states distinct.
Upgrading from 5.0 preserves existing settings and incident history. Review Automatic protection updates and Strict Mode after installation. MDM management is not supported, and an independent external security review is still pending.
Protection across your Mac.
Five core workflows cover system health, local scanning, activity context, network observation, and reviewed recovery. Advanced architecture details remain available in the open-source documentation.
System health, in plain language
Nick checks FileVault, Gatekeeper, System Integrity Protection, the firewall, automatic updates, XProtect, Remote Login, and stealth mode. Simple mode explains the result; Advanced mode exposes the supporting detail.
Processes and persistence, connected
Process, signing, parent-app, path, and startup evidence is shown together. Nick can flag suspicious chains while keeping ordinary developer and system activity in context.
Local scans with explainable results
Quick, full, targeted, email-attachment, and external-volume scans use exact hashes, YARA rules, and bounded heuristics. Findings retain source and confidence instead of presenting every unusual file as malware.
Network activity without hidden blocking
Nick maps observed destinations to responsible apps when evidence is available. In 5.1, suspected and known dangerous destinations remain observation-only: no alert, notification, or traffic block.
Ransomware evidence and reviewed recovery
Sentinel files and suspicious high-volume changes provide evidence. Quarantine is offered only for actionable file findings and re-checks the current file before moving it; file volume or entropy alone is not treated as proof.
Protection Controls
Detection stays on. Prevention stays in your control.
Nick 5.1 makes enforcement boundaries visible instead of implying that every finding was blocked. Detection, review, and prevention remain distinct states.
Strict Mode is opt-in
Supported prevention is available when you explicitly enable Strict Mode. It remains off by default.
Known hashes stay protected
Known-malware exact-hash protection remains active independently of Strict Mode within its bounded pre-launch check.
Emergency stop keeps visibility
The emergency control pauses supported blocking while local detection and reporting continue.
Network traffic stays available
Scam Guardian is observation-only in 5.1. Findings stay in Network Activity and do not block traffic.
Questions
Frequently asked questions
Does Nick replace an antivirus?
Nick combines Apple Endpoint Security monitoring, observation-only network threat reporting, YARA scanning, behavioral correlation, ransomware defense, Email Guard, and Scam Guardian. No single security tool can guarantee detection of every threat.
Will Nick slow down my Mac?
Nick 5.1 moves longer work off Endpoint Security callback paths, coalesces incident and settings writes, and keeps its Network Filter observation-only. Resource limits bound scan time, concurrency, retention, and monitored locations.
What macOS versions does Nick support?
Nick 5.1 requires macOS 26 or later and supports Apple Silicon and Intel Macs.
Is Nick on the App Store?
No. Full Disk Access and the Endpoint Security system extension are incompatible with App Store sandboxing. Nick 5.1 is distributed as a signed, notarized installer package through GitHub Releases. Sparkle handles verified application updates.
What does AGPL-3.0 mean for me?
You can freely use, modify, and distribute Nick. If you run a modified version as a network service, you must publish your source code. This keeps the detection logic open to the security community permanently.
How does behavioral correlation work?
Nick 5.1 uses transparent deterministic rules to combine process, persistence, network, file, and privacy signals. No production Core ML scoring model is active. Foundation Models can provide private, on-device explanations after deterministic code creates an alert, but generated text cannot change severity or enforcement.
The Differentiator
Behavioral Threat Correlation
Individual signals are noisy. A new process in /tmp could be a developer build. An unsigned binary could be your own tool. A new outbound connection could be a software update.
Correlated signals are actionable. Nick’s ThreatCorrelator combines process, persistence, network, file, and privacy activity through transparent rules, surfacing higher-confidence patterns without depending on a production Core ML scoring model.
On macOS 26, alert explanations are generated on-device via Foundation Models — plain English, no cloud call.
Signals Nick Correlates
Detection and analysis stay local. Network access is limited to explicit updates, optional webhooks, links, and exports you choose.
Dropper Sequence Example
curl downloads binary to /tmp
MEDIUMUnsigned binary executes 2 seconds later
HIGHOutbound connection to raw IP on :443
CRITICAL
Nick Lab · Illustrative Demo
Explore correlated signals
Toggle example signals or pick a scenario to see why combined context matters. This illustrative front-end model is not Nick's live detector, a prevention test, or an effectiveness benchmark.
Nick Lab
Behavioral Threat Scorer
Toggle example signals to explore an illustrative correlation model
Scenario Presets
Manual Signal Selection
Threat Score
Logged silently — no notification
Active signals
0
Monitor types
0
How it works
No signals active. Toggle signals above or select a preset scenario to see the behavioral scoring engine in action.
Alert thresholds
Illustrative demo only. This simplified front-end model is not Nick's live detector, a prevention test, or an effectiveness benchmark.
Improve the real model on GitHub →Open Source
Nick is community-powered
Security tools ask for deep trust. Nick uses Full Disk Access for protected system and mail locations, and an optional Network Extension for destination monitoring. It does not request permission to record through your camera or microphone; it observes capture-device state changes when macOS exposes them. Every line is open for review.
Free · Open Source · macOS 26+
Download Nick 5.1.1
Free. Open source. No hosted analysis. Local security monitoring, scanning, explainable evidence, and private on-device explanations — in one native macOS app.
Requires macOS 26+ · Apple Silicon or Intel · AGPL-3.0
Updates automatically via Sparkle — no re-download needed for future versions.