When a company sends a Mac home, it also sends home the part of its network perimeter that used to be someone else’s job. The office had a managed firewall, a switch nobody could plug into without a badge, and a person whose role was to notice odd traffic. The home office has a router from the internet provider, a Wi-Fi password shared with the neighbours’ kids two summers ago, and the same Mac used for the quarterly report and for the family’s streaming. None of that is a disaster. It just means the work Mac has to carry more of its own defence. This checklist goes through the layers in the order they matter, with the guidance each one rests on.
1. The router: the thing nobody has looked at since installation
CISA’s guidance on securing wireless networks is short and specific: change the default password on the router, use WPA3 because it is currently the strongest encryption available, and keep the access point’s software patched by checking the manufacturer’s site. Apple’s own recommended settings for Wi-Fi routers say the same about encryption, advising WPA3 Personal, or WPA2/WPA3 Transitional where older devices need it. To that, add three settings that cost nothing: turn off remote administration over the internet so the router’s admin page is only reachable from inside the home, turn off WPS, and rename the network to something that does not identify you or your provider. If the router supports a guest network, put the television, the speakers and the visitors on it, and keep the work Mac on the main one. A smart bulb with a known flaw on the same network segment as a work laptop is a problem that a guest network makes disappear for free.
2. A VPN: one layer, with clear limits
NIST’s Guide to Enterprise Telework, Remote Access, and BYOD Security (SP 800-46 Revision 2) treats the VPN tunnel as the standard way to bring a remote device into the organisation’s network, and it is right to. A VPN encrypts everything between your Mac and the VPN server, which hides your traffic from the home router, the internet provider, and anyone on a café network. That is exactly what it is for, and it is enough reason to use the one your employer provides.
What it does not do is worth listing, because the marketing around consumer VPNs implies far more. A VPN does not decide which apps on your Mac may talk to the internet; it carries all of them, including the one you would rather it did not. It does not stop a phishing page from working, because the page arrives through the tunnel like everything else. It does not protect you from the network on the far end, and with split tunnelling, which many corporate configurations use, only company traffic goes through the tunnel while everything else takes the normal route. FireAI is not a VPN and does not replace one. It does the thing a VPN leaves open: it looks at each application separately and decides, by code signature, whether that app may connect at all and to which hosts, domains, IPs or ports.
3. Away from home: Coffee shop mode
ANSSI, the French national cybersecurity agency, publishes recommendations on digital nomadism that cover the situation of a work device on networks the organisation does not control, and the underlying advice is to assume those networks are hostile. A shared Wi-Fi network at a café, a hotel or a co-working space puts your Mac on the same segment as strangers’ devices. FireAI’s security modes exist for this change of context: Home is the permissive setting for a network you trust, and Coffee shop tightens the rules for a network you do not, with stricter modes blocking telemetry, trackers and unsigned apps. Two things to pair with it. First, disable AirDrop, or set it to Contacts Only, before you sit down. Second, if the situation ever feels wrong, the kill switch cuts internet access while keeping the local network, which lets you finish a local task without exposing anything further.
4. Meeting software: check what it may see and hear
Video-conferencing apps ask for three sensitive permissions, and macOS lets you audit all three. Apple’s guides describe the controls in System Settings under Privacy & Security for the camera, the microphone and screen recording, each listing the apps that have been granted access. Go through those three lists once. An app you no longer use should not keep screen-recording permission; a browser extension for meetings should not have the microphone by default. Leave the camera indicator light in your peripheral vision: macOS shows it whenever the camera is active, and it is the simplest tamper-evident signal you have. Keep the meeting client updated, since these apps handle untrusted input from every participant, and join links from a calendar entry you recognise rather than from an email that arrived ten minutes before the meeting.
5. Credentials: a manager, not a memory
NIST SP 800-63B, the digital identity guideline that most password policies now cite, says memorised secrets chosen by the user must be at least eight characters, and that verifiers should not require them to be changed arbitrarily, for example on a schedule, unless there is evidence of compromise. The practical translation for a remote worker is that the goal is one long, unique password per service, not one clever password rotated every quarter. That is a job for a password manager. Apple’s Passwords app, documented in the Passwords User Guide for Mac, stores passwords, passkeys and verification codes and syncs them across your Apple devices; a company may prefer a shared team manager instead. Either is fine. Turn on two-factor authentication for email, the VPN, the identity provider and any service that holds customer data, and use passkeys where a service offers them, because they cannot be phished the way a password can.
6. File sharing: off unless you are using it
macOS can share folders over the network, and on an office LAN that is convenient. On a home network it is usually forgotten and on a café network it is an open door. Apple’s guide to setting up file sharing shows where the setting lives, under General and then Sharing in System Settings; the useful move is to go there and turn off everything you are not actively using: File Sharing, Screen Sharing, Remote Login and Remote Management. Cloud storage has the same property in a different shape. Check which folders your sync client is publishing and whether a shared link was ever set to “anyone with the link”. FireAI adds a network-side control here: a per-app rule can allow your approved sync client to reach its own hosts and refuse any other application that tries to reach storage domains, so a stray utility does not become an exfiltration path.
7. The per-app firewall on the work Mac
CISA’s Telework Essentials Toolkit is aimed at three audiences, leaders, IT staff and workers, and its message to workers is that the device at home is part of the organisation’s security. On a Mac that means knowing what leaves it. The built-in macOS firewall only filters incoming connections; nothing that ships with the system will tell you that a productivity app you installed last month sends data to an advertising network, or that a helper process contacts a server in a country you have never done business with. FireAI shows every connection on a live world map, asks before an unknown app connects for the first time with the on-device model’s reason for its verdict, applies threat-intelligence feeds and IP blocklists locally, and stops card numbers, passwords and API keys from leaving over plain HTTP. Everything the AI decides becomes a visible rule you can undo, and rules can be exported as a text file, so an IT team can hand new remote staff a starting policy instead of a blank slate.
And to be exact about the limits: FireAI does not encrypt your disk, back up your files, scan for hostile software or manage the Mac remotely. FileVault and Time Machine cover the first two and are built into macOS; the third is a different product category; the fourth is what your company’s device management is for. A firewall is one layer, and this checklist is the rest of them.
The checklist, in one place
- Router: default admin password changed, WPA3 (or WPA2/WPA3 Transitional), firmware updated, remote administration and WPS off, work Mac on the main network and everything else on the guest network.
- VPN: the one your employer provides, on whenever you handle company data, with a clear understanding that it hides traffic but does not choose which apps may send it.
- Mode: Home at home, Coffee shop anywhere else; AirDrop off or Contacts Only when out.
- Meetings: camera, microphone and screen-recording permission lists reviewed; meeting client updated; join from the calendar, not from surprise emails.
- Credentials: a password manager, one unique password per service, two-factor authentication on email, VPN and identity provider, passkeys where offered.
- Sharing: File Sharing, Screen Sharing, Remote Login and Remote Management off unless in use; cloud links checked.
- Firewall: a per-app firewall with prompts on first connection, threat feeds applied locally, and an exported rule file shared with the team.
- Disk and backups: FileVault on, Time Machine to a drive that is not permanently connected.
Most of this takes an afternoon once and a few minutes a month afterwards. The work Mac in a home office is not less secure than the one in the building; it is only less watched, and this list is how you watch it yourself.
How FireAI and HisnLabs fit in
A home office has no IT department watching the wire, so the work Mac has to watch itself: FireAI’s Coffee shop mode for the days you are not at home, and per-app rules for the apps that carry company data, are the two settings that do most of that work.
FireAI is HisnLabs’ own product: an on-device AI firewall for Mac. It shows every connection your apps make, in plain language, and lets you decide what leaves your Mac — its AI runs locally, so your traffic is never sent to us or anyone else. HisnLabs’ security research team is the group that keeps that decision-making accurate: cataloguing which domains are ordinary telemetry versus a real product, tracking the country and network behind a connection, and training the on-device model (its Autopilot feature) on real traffic patterns, all without any of it leaving your Mac.
You can read the technical decisions behind it, or try FireAI for 17 days, at FireAI, by HisnLabs.