Altiward
Get early access
Early access · works with SAP Privileges

Temporary Mac admin that actually ends. And the record to prove it.

Altiward works with the SAP Privileges you already deploy. It checks on each Mac that temporary admin rights end, removes them when they don't, flags admin rights nobody granted, and gives your security team a record of every session.

Request early access See how it works
Fits the stack you run SAP Privileges Jamf Microsoft Intune Other Mac MDMs Splunk Microsoft Sentinel Syslog
What Altiward does

Oversight for temporary admin on macOS.

It checks the Mac itself

Altiward's agent reads the Mac's admin group directly, so the record says what was true, not what was claimed.

Expiry is enforced

Rights that outlive their expiry are removed within minutes, whatever happened to SAP Privileges' timer. Stopping either agent raises an alert.

Detects an admin account made on the side

While they hold approved admin, someone can create a second admin account that outlives the session. Altiward flags it, notes the new account on the session, and sends your SIEM a finding.

Revoke from the console

See who holds admin right now and remove it from any session, granted or not. The Mac drops the rights, and the revoke is on record.

Every session is on record

Who, on which Mac, the reason they gave, and when and how it ended, with what changed while they were admin. Evidence you can use for the CAF-aligned DSPT.

Sent to your SIEM

Splunk, Microsoft Sentinel or any syslog receiver, so admin sessions sit next to the rest of your security data.

How it works

Up and running beside SAP Privileges.

01

Deploy the agent beside SAP Privileges

Push it through your MDM, such as Jamf or Intune, with the profiles you already manage. SAP Privileges keeps doing the elevating. Using macOS LAPS too? Here's how it fits.

02

Run the server on your infrastructure

An example Docker Compose deployment with Postgres comes with it. Nothing leaves your network unless you send it.

03

Watch, revoke, export the record

See who holds admin right now, revoke it from the console when you need to, and send every session to your SIEM.

See how it works

Your data

Your data stays with you.

You run the Altiward server on your own infrastructure. It sends nothing to us.

Self-hosted
The server, database and console run where you put them.
Nothing phones home
Events go from your Macs to your server and on to your SIEM. Not to us.
Verified, and says so
Each session says what the agent checked against the admin group, and when.
Questions

What Mac and security teams ask.

Is there a hosted version?

Not right now. Self-hosted is the only version: you run Altiward on your own infrastructure, your record of who had admin on which Mac stays with you, and nothing phones home. If you'd rather someone hosted it for you, tell us.

SAP Privileges is free. Doesn't it already do this?

It grants and times the rights. Altiward checks that they actually ended, and ends them if they didn't. The two work together, and you keep your SAP Privileges rollout.

Our MDM already has elevation.

Elevation is the easy part. Ask what your security team gets from it today: whether rights really ended, who holds admin right now, and a record in your SIEM.

Can't an admin just stop Altiward too?

Not easily. Altiward's protection blocks attempts to stop or remove the agent, and your MDM keeps it installed. Anything it can't block, it puts on record. Found a way past it? Tell us how.

Altiward is in early access.

Early access is for Mac teams who already deploy SAP Privileges through an MDM such as Jamf or Intune.

Request early access