A New macOS Update Policy: Faster Patching, Less Waiting on Users

We’ve made a quiet but meaningful change to how we manage macOS updates across the fleets we support, and it’s worth explaining why.

Why now

Security research has always been a race between attackers and defenders, but the pace of that race has changed. Vulnerabilities that once took skilled people weeks to find and weaponize can now be surfaced and acted on by AI tools in a fraction of the time. That shift doesn’t change what we do, but it does change how quickly we need to do it.

What we’re changing

Macktez has always championed fleet stability. Historically, that meant facilitating whatever operating system Apple currently supported, on the theory that if Apple was still patching it, it was safe to run. We’re narrowing that window. Going forward, we’re encouraging, and where appropriate enforcing, a move to the latest macOS release across managed devices, rather than letting machines linger a version or two behind.

To be clear, this isn’t a statement that older, still-supported versions of macOS are insecure. It’s a deliberate decision to shrink the attack surface available to an adversary who has more tools working in their favor than before.

The tool that makes this practical

Apple gave us a better lever to work with. Covering macOS 14 Sonoma and later, devices can be managed through Declarative Device Management (DDM)Apple's deadline-driven device management model — a device receives a declaration of the desired end state and works toward it locally, rather than depending on a constant connection to a management server., a newer approach to distributing updates. Instead of a management platform having to stay connected to a device to babysit a multi-gigabyte installer through every step of a major upgrade, DDM hands the device a declaration, essentially a goal and a deadline, and the device’s own operating system handles getting there.

That distinction matters. Update systems that depend entirely on a device staying reachable, or a user clicking “restart now,” are only as strong as their weakest link. DDM lets us set real deadlines that don’t depend on either.

What this means for your day-to-day

You’ll still see the same update notifications you always have, and you’ll still have some room to finish what you’re doing before restarting. What’s different is what happens after that window closes. Rather than an update sitting available but ignored indefinitely, unattended machines and machines past their deadline will update and restart automatically, on our schedule, whether or not anyone clicked anything.

We’re aiming to balance those two things deliberately: giving people the ability to interact with updates on their own terms, without letting that turn into permanent deferral for a device we’re responsible for keeping current.

Not just a Mac thing

This mirrors a change we already made on the Windows side, where our management tooling enforces reboot cadence in a similar way. Different platform, same underlying philosophy: we facilitate the technology you use, but part of facilitating it responsibly is making sure critical updates don’t sit open indefinitely.

If you’re behind, this is a good time to catch up

Apple typically keeps security patches flowing to the two most recent major releases. With a new annual release on the horizon, macOS Sonoma is close to falling out of that window entirely. If your Mac is still running Sonoma, now is a good time to plan the jump, not to macOS 15 Sequoia, but straight to the current release.

The takeaway

None of this changes what Macktez does for your fleet day to day. It changes how fast “we facilitate the patching” turns into “the patching happened.” In a threat landscape that’s moving faster than it used to, that speed is the point.