PhantomSecure is continuing its development for macOS, with major progress in two areas: a new native foundation for PhantomVault, and the reliability work preparing PhantomProtect for launch.
This is development progress, not a release announcement. We will only describe a capability as available once it has completed the validation behind it.
PhantomVault is moving beyond disk images
Earlier PhantomVault prototypes used macOS’s disk-image tooling to create and attach Vaults. That helped us explore the product, but it was not the long-term experience we wanted to deliver.
We have now upgraded PhantomVault to use Apple’s FSKit framework: a native file-system extension approach designed for macOS. New Vaults can be created and mounted through a filesystem built for PhantomVault, rather than through a separate virtual-disk workflow.
FSKit itself arrived before macOS 27, but Apple has continued to evolve it. The newer macOS 27 beta API replaces an earlier model with a Handler-based design. Updating PhantomVault to that current architecture is what allowed us to complete the native FSKit path.
That gives us a clearer foundation for Vault capacity, file operations, mounting, and orderly shutdowns. We retain limited recovery handling for an older disk-image session that needs to be detached safely, but new Vault creation and mounting are now built around FSKit.
A Vault that can remain an actual movie
PhantomVault is designed to offer something more than simply giving an encrypted container a movie filename.
When a person chooses a movie carrier, PhantomVault keeps a genuine playable movie alongside the protected Vault data. The result is intended to behave like a normal movie file in everyday use: Finder can identify it as a movie, Quick Look can preview it, and it can be opened normally to play the film.
We recently validated this with a real PhantomVault carrier based on 300. macOS identifies it as an MPEG-4 movie with a normal duration, video resolution, and audio/video codecs. Quick Look generates the movie artwork shown in Finder, and the file can be previewed with the Space bar or opened to play the movie.
This is the practical goal behind the feature: when you are traveling or simply do not want a sensitive file to attract unnecessary attention, the carrier is meant to remain a usable, ordinary-looking movie—not a file that immediately fails when someone previews it.
The system also checks the relationship between the movie’s duration, resolution, and final file size. It does not falsify media statistics. A user can choose a better-suited movie or a smaller Vault if the combination would look implausible.
We call this plausible deniability in the everyday sense: reducing suspicion during ordinary visual inspection. It is not a promise that a movie carrier defeats every form of forensic analysis, device history, backup record, or compelled access. Security claims have to be specific about the situation they cover.
Making PhantomProtect dependable through updates
A security product has to be dependable not only when it first installs, but after an update, restart, or macOS component replacement.
Recent PhantomProtect work has focused on the connection between the app, the always-running protection agent, and the macOS extensions that provide selected protection capabilities. That includes work to:
- Verify that installed protection components match the version expected by the app.
- Replace outdated system extensions safely.
- Show a clear “needs attention” state when live protection health cannot be confirmed.
- Use authenticated health signals from the Endpoint Security component.
- Make communication between protection components more resilient across updates.
- Continue hardening detection, quarantine, restoration, and remediation paths.
The goal is straightforward: when PhantomProtect says protection is active, that should reflect the protection actually running on the Mac—not an assumption based on a previous installation.
Preparing PhantomProtect for launch
PhantomProtect is being prepared for macOS 26.5 or later, rather than the macOS 27 requirement of the future PhantomVault work.
We are nearing the final launch path. Apple’s approval for the URL Filter entitlement is the remaining external approval gate for the full privacy-preserving URL-filtering design. After that, we will complete final production enablement and end-to-end release validation before announcing availability.
That URL-filtering work is designed to use Apple’s supported privacy-preserving architecture: a local prefilter, private lookups when needed, and the macOS URL Filter framework. We will not describe it as active for customers until those final steps are complete.
What comes next
PhantomProtect remains the immediate launch focus. PhantomVault’s native FSKit foundation and movie-carrier work are building toward its own future release.
The direction remains the same: use supported macOS technologies, make the product’s status understandable, and tie public claims to behavior we can test and verify.