Device Agent

Endpoint compliance agent for macOS — runs native security checks every hour and matches installed software against the NVD CVE database.

Device Agent

The Matproof Device Agent is a lightweight tray application that runs on each user’s machine and reports endpoint compliance evidence to your Matproof organization. It produces evidence for ISO 27001 (A.8.8), SOC 2 (CC7.1), HIPAA (164.308), NIS 2 (Art. 21), DORA (Art. 9), and PCI DSS (6.3.1) — without needing a separate MDM product.

What the Agent Checks

Every hour, the agent runs 10 native compliance checks on the host machine:

Check	What it verifies
Disk encryption	FileVault is enabled on the boot volume
Antivirus	XProtect / built-in malware protection is active
Password policy	Minimum length and complexity meet your policy
Screen lock	Screen lock is enabled with an acceptable timeout
Firewall	Application Firewall is enabled
OS patch freshness	macOS version is supported and current
Antivirus signature freshness	XProtect definitions are recent
Backup	A backup destination is configured and recent
MDM enrollment	Device is enrolled in MDM (if your org requires it)
Idle-lock verified	The screen actually locks after the configured timeout (not just configured to)

Every 6 hours, the agent additionally captures a software inventory of installed applications via system_profiler. The inventory feeds CVE matching (see below).

CVE Matching (Tier 3A)

The agent’s installed-app inventory is joined against the NVD CVE database by Matproof’s API. For around 30 high-impact applications (browsers, communication tools, dev runtimes, IDEs, containerization), Matproof maintains a curated CPE map that converts each installed version into a precise CPE identifier and queries the NVD for known vulnerabilities affecting that version.

The result:

• A vulnerableAppsCount per device on the device list
• Evidence rows automatically created on the relevant control (installed_apps evidence)
• Findings raised for high or critical CVEs affecting devices in your fleet
• 24-hour cache to stay within NVD’s rate limits

This satisfies the “vulnerability management on endpoints” requirements in ISO 27001 A.8.8, SOC 2 CC7.1, NIS 2 Art. 21, DORA Art. 9, and PCI DSS 6.3.1.

Platform Support

OS	Status	Architecture
macOS 12+ (Monterey, Ventura, Sonoma, Sequoia)	Generally available	Intel x64, Apple Silicon arm64
Windows 10 / 11	Beta	x64
Linux	Roadmap	—

Builds are code-signed and notarized with the Matproof Apple Developer ID and stapled before distribution.

System Requirements

Requirement	Minimum
macOS	12 (Monterey)
Windows	10
Memory	256 MB RAM available
Disk	200 MB
Network	Outbound HTTPS to agents.matproof.com and api.matproof.com

Installation

1. Download the installer

   From your Matproof portal, navigate to People > [Your User] > Devices and click Install Device Agent. The portal serves the right DMG (Intel or Apple Silicon) automatically.

   Direct DMG link: https://agents.matproof.com/installers/Matproof-Device-Agent-{version}-{arch}.dmg

2. Run the installer

   On macOS, open the DMG and drag Matproof Device Agent to Applications. Launch it once from Applications to register the tray icon.

3. Pair the agent with your account

   The agent opens your default browser to the Matproof portal pairing page. Sign in (if you aren’t already), and the portal returns a one-shot code to the agent over localhost. The agent registers with your organization automatically.

4. First check-in

   Within 60 seconds the first compliance check runs and the device appears in your organization’s device list under People > Devices.

Updates

The agent supports auto-updates via electron-updater. Matproof publishes signed builds to agents.matproof.com/installers/ and the agent checks for new versions on launch and periodically.

Privacy and Data Minimization

The agent reports only the compliance signals listed above and the installed-app inventory. It does not:

• Read user files, documents, browsing history, or chat content
• Capture screenshots
• Run keystroke logging
• Track location
• Send raw command output — only the boolean result of each check
• Send installed-app inventory to anywhere other than your Matproof organization

The full list of check methods and their data minimization is in packages/device-agent/SPEC.md in the Matproof source repository (Enterprise customers under NDA can request access).

What Admins See

In the Matproof app under People > Devices:

• One row per registered device with owner, OS, last check-in, and overall pass/fail
• Drilldown to the individual checks and their last-known state
• vulnerableAppsCount column reflecting CVE matches
• Evidence tied to the relevant controls (e.g. encryption evidence on the “Endpoint Disk Encryption” control)
• Findings raised automatically for failed checks or critical CVEs

Manual Evidence Collection (Devices Without the Agent)

For devices where the agent can’t be installed (Linux until GA, BYOD without consent, vendor-managed machines), Matproof supports manual evidence upload. The required evidence types and how to obtain them on each OS are described below.

macOS — Manual Evidence

macOS (Monterey, Ventura, Sonoma, Sequoia)

Enable FileVault

1. Open System Settings → Privacy & Security → FileVault
2. Click Turn On FileVault, enter your password, and record the recovery key
3. Screenshot the FileVault settings page showing “FileVault is enabled for the disk”

Screen Auto-lock

1. System Settings → Lock Screen
2. Set Start Screen Saver when inactive to ≤ 5 minutes
3. Set Require password after sleep or screen saver begins to Immediately
4. Screenshot showing both settings

Automatic Security Updates

1. System Settings → General → Software Update → Automatic Updates
2. Enable all toggles
3. Screenshot the page showing updates enabled

Antivirus (XProtect)

XProtect is built into macOS and runs by default. Verify macOS is fully updated and screenshot the Software Update page.

Firewall

1. System Settings → Network → Firewall
2. Turn on the firewall
3. Screenshot the firewall settings page showing it enabled

Windows — Manual Evidence

Windows 10 and 11

Enable BitLocker

1. Press Start, type Manage BitLocker, open it
2. Select the system drive (usually C:) and click Turn on BitLocker
3. Save the recovery key to a Microsoft Account, USB drive, or your secure store
4. Screenshot the BitLocker Drive Encryption window showing “On” for C:

Screen Lock after 5 Minutes

1. Start → Settings → Personalization → Lock screen → Screen timeout settings
2. Set Screen turns off to 5 minutes
3. Settings → Accounts → Sign-in options → Require sign-in: When PC wakes up
4. Screenshot both settings

Minimum Password Length (Local Policy)

1. Press Win + R, type secpol.msc
2. Navigate to Account Policies → Password Policy
3. Set Minimum password length to 8 or more
4. Screenshot the Password Policy window

Automatic Updates

1. Settings → Update and Security → Windows Update → Advanced options
2. Enable Automatic updates
3. Screenshot showing updates enabled

Antivirus (Windows Defender)

1. Settings → Update and Security → Windows Security → Virus and threat protection
2. Verify Real-time protection is on
3. Screenshot the Windows Security window

Manual evidence is uploaded as a comment plus attachment on the relevant device task. Tag the upload with the user’s email so it ties back to the right person in your team.

Frameworks Covered

Framework	Mapped Requirement
ISO 27001	A.8.1, A.8.2, A.8.7, A.8.8, A.8.20
SOC 2	CC6.1, CC6.6, CC6.7, CC7.1
HIPAA	164.308(a)(5), 164.310(d)(1), 164.312(a)(1)
NIS 2	Article 21(2)(d), 21(2)(g)
DORA	Article 9(2), 9(3), 9(4)(g)
PCI DSS	6.3.1, 8.6.3, 9.5

Findings

See how device-agent findings flow into your unified findings view

Cloud Tests

Cloud-side configuration checks that pair with endpoint checks