Modern clients inspect DNS queries before they hit the tunnel.
Use Per-App VPN for BYOD. Use Full Tunnel + Split-Exclude (e.g., route *.local and 17.0.0.0/8 for Apple services) for corporate-owned devices.
| Vendor | Client Architecture | Unique macOS Security Feature | Compliance Pain Point | | :--- | :--- | :--- | :--- | | | Network Extension + SSO | Conditional Access based on Microsoft Defender for Endpoint risk score | Requires Company Portal for user context | | Palo Alto GlobalProtect | HIP (Host Info Profile) | Real-time HIP checks for Firewall, Patch, and AV | App Telemetry (user consent required for device data) | | Cisco Secure Client (AnyConnect) | Umbrella Roaming Security Module | DNS-layer encryption & local malicious IP blocking | The legacy "AMP Enabler" causes battery drain on M3 | | Twingate | Zero Trust + Connector | No inbound ports; device posture checks via Jamf or Intune | Requires a local relay for air-printed documents | | Tailscale (with ACLs) | WireGuard®-based | Uses macOS Keychain for mTLS; integrates with MDM for revocation | Lacks native on-device malware scanning (requires companion EDR) |
Local detection of malicious activity on the client's current network (e.g., coffee shop Wi-Fi):
Apple officially deprecated Kernel Extensions (KEXTs). The only supported way to build a modern VPN or security client on macOS is via the (System Extensions).
If you are deploying these clients on the latest macOS versions, you must be aware of the and Privacy & Security permissions: