Catching Mac Ransomware With Math Instead of AI: Patrick Wardle at VB2026
Nearly every ransomware strain does the same thing. It rapidly turns a user's files into encrypted data, and that behavior can be measured.
Macs keep spreading through the enterprise, and ransomware authors have noticed. Signature-based tools miss new strains, while machine learning can be opaque and heavy.
Patrick Wardle argued for a third path that is lightweight and explainable.
In his VB2026 talk, "Practical ransomware detection on macOS (via maths, not AI)", on Friday, October 16, Patrick Wardle showed how to catch ransomware generically with math.
Speaker: Patrick Wardle, Cofounder, Objective-See Foundation
The approach uses Apple's Endpoint Security framework to watch file activity. Entropy analysis then separates ordinary file writes from encryption.
Simple heuristics tell encrypted data apart from compressed data, which is the classic source of false positives.
The talk walked through the implementation in a free, open-source tool. It included real-world testing and a demo against macOS ransomware samples.
Wardle also covered the method's limits and possible evasions. Slow or dormant encryption remains the hardest case.
For defenders, the takeaway is that behavior-based detection does not need a black box. A few well-chosen measurements can stop ransomware before most files are lost.
Patrick Wardle founded the nonprofit Objective-See Foundation, which publishes free macOS security tools, and the Objective by the Sea conference. He is also CEO and cofounder of DoubleYou, as well as author of The Art of Mac Malware.
He previously worked at NASA and the NSA. He later served as a principal security researcher at Jamf and chief security researcher at Synack.
To go deeper on the topic, start here:
- Video: Wardle at #OBTS v8.0, "Dylib Hijacking on macOS: Dead or Alive?", on related macOS detection work.
- Podcast: MacAdmins Podcast, "Patrick Wardle on iOS Security".
- Tool: RansomWhere?, Objective-See's free entropy-based ransomware blocker, with source on GitHub.
- Coverage: SecurityWeek on the original 2016 release of the generic Mac ransomware detector, tested against KeRanger.
- Research: Objective-See on Apple adding TCC events to Endpoint Security, background on the framework the tool builds on.
Mac admins and detection engineers who want ransomware protection they can actually explain should look at this approach.
Would you trust an entropy-based detector to suspend processes on your Mac fleet?
3 points · 1 comment
Mentions
Catching Mac Ransomware With Math Instead of AI: Patrick Wardle at VB2026 Nearly every ransomware strain does the same thing. It rapidly turns a user's files into encrypted data, and that behavior can be measured. Macs keep spreading through the enterprise, and ransomware authors have noticed. Signature-based tools miss new strains, while machine learning can be opaque and heavy. Patrick Wardle argued for a third path that is lightweight and explainable. In his VB2026 talk, "Practical ransomware detection on macOS (via maths, not AI)", on Friday, October 16, Patrick Wardle showed how to catch ransomware generically with math. Speaker: Patrick Wardle, Cofounder, Objective-See Foundation The approach uses Apple's Endpoint Security framework to watch file activity. Entropy analysis then separates ordinary file writes from encryption. Simple heuristics tell encrypted data apart from compressed data, which is the classic source of false positives. The talk walked through the implementation in a free, open-source tool. It included real-world testing and a demo against macOS ransomware samples. Wardle also covered the method's limits and possible evasions. Slow or dormant encryption remains the hardest case. For defenders, the takeaway is that behavior-based detection does not need a black box. A few well-chosen measurements can stop ransomware before most files are lost. Patrick Wardle founded the nonprofit Objective-See Foundation, which publishes free macOS security tools, and the Objective by the Sea conference. He is also CEO and cofounder of DoubleYou, as well as author of The Art of Mac Malware. He previously worked at NASA and the NSA. He later served as a principal security researcher at Jamf and chief security researcher at Synack. To go deeper on the topic, start here: - Video: Wardle at #OBTS v8.0, "Dylib Hijacking on macOS: Dead or Alive?", on related macOS detection work. - Podcast: MacAdmins Podcast, "Patrick Wardle on iOS Security". - Tool: RansomWhere?, Objective-See's free entropy-based ransomware blocker, with source on GitHub. - Coverage: SecurityWeek on the original 2016 release of the generic Mac ransomware detector, tested against KeRanger. - Research: Objective-See on Apple adding TCC events to Endpoint Security, background on the framework the tool builds on. Mac admins and detection engineers who want ransomware protection they can actually explain should look at this approach. Would you trust an entropy-based detector to suspend processes on your Mac fleet?