
1. BlockBlockTop pick
Best for: Mac users and admins who want to approve anything that sets itself to run at login or boot
66.5
score / 100
Why switch from KnockKnock
Same developer; watches persistence locations continuously and alerts as new items are added.
Pros
- Catches persistence attempts as they happen instead of after a scheduled scan
- Alerts show the responsible process, signing details and VirusTotal results
- Free and open source, made by a non-profit with a long Mac security track record
Cons
- Does not detect or remove known malware the way a scanner does
- Alerts for legitimate installers need judgement from the user
- macOS only, and requires Full Disk Access and system privileges
How this score is calculated
0 counted reviews, 0 up and 0 down votes. Full formula
Verified facts
5 of 5 verified- What it monitors
- Persistence locations
- Checked Oct 29, 2026objective-see.org(opens source in a new tab)
- Monitoring engine
- Apple Endpoint Security Framework
- Checked Oct 29, 2026objective-see.org(opens source in a new tab)
- Owner
- Objective-See Foundation (non-profit)
- Checked Oct 29, 2026objective-see.org(opens source in a new tab)

