Ctrlk
Changelog NotificationsAPIAikido login
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Device Protection & Netskope for Mac

This guide explains how to configure your Netskope Steering Configuration so that Aikido Device Protection works reliably alongside Netskope.

These instructions are for macOS only! Applying these for Windows can cause issues.

Why This Is Needed

Device Protection inspects and protects software supply chain traffic, the connections your developers make to package registries (npm, PyPI, Maven, NuGet, Go) and developer tool marketplaces (Visual Studio, Cursor, Chrome Web Store), as well as Aikido's own protection services.

When both a corporate VPN/ZTNA and Aikido Device Protection attempt to steer or inspect the same traffic, the two can conflict, leading to unreliable behavior. To avoid this, you should configure VPN/ZTNA to bypass (exclude) the domains that Device Protection handles.

Steps

  1. Log in to the Netskope Admin Console.

  2. Navigate to Settings → Security Cloud Platform → Steering Configuration.

  3. Click New Steering Configuration (do not edit the Default tenant config) and assign a new name e.g. "macOS tenant config".

  4. Under Match Criteria, set OS Family = macOS. Leave User Group/OU set to Any, or scope it to the same group your Default config covers. This is what restricts the bypass to Macs.

    If you don't see Match Criteria, your tenant is on a release older than 124.0.0. Scope the configuration to a User Group or Organizational Unit (OU) instead. This scoping applies per user, not per device, so the group must only contain users whose devices are all Macs. Otherwise their Windows devices get the bypass too. To create a new group, add it in your identity provider and sync it to Netskope (SCIM or Directory Importer) before selecting it here.

  5. Under Steered Traffic, mirror your Default config so Mac steering is unchanged. This typically includes All Traffic (HTTP/HTTPS and Non-web) and All Private App Segments.

  6. Click the 3 dots for settings on the relevant Steering Configuration (Config) profile you want to modify. Open Edit Configuration → Traffic Steering and make sure "Bypass exception traffic at:" is set to Client.

  7. After you've checked this, enter the profile.

  8. Open the Exceptions tab.

  9. Click New Exception → Domains.

  10. Enter the domains listed below (one per line, or as supported by your version of the interface).

  11. Save the configuration. Changes typically propagate in 1 hour.

If you want to do a quick test, go to the local Netskope client, click Configuration, then check for "Configuration update available." If it's there, click Update so it fetches the latest policies.

Domains to Exclude

These are the domains Aikido Device Protection intercepts. Package registries and developer tool marketplaces are always intercepted. AI provider domains are only intercepted when AI Usage monitoring is enabled.

Only intercepted when AI Usage monitoring is enabled.

Last updated

Was this helpful?