Endpoint security that doesn't get in the way

Security teams often default to stricter controls, assuming that more restrictions equal better protection. But that logic breaks down in practice: when policies create friction, people find workarounds that introduce new risks. Forced password rotations, for instance, push users toward sticky notes and password reuse. Figma's security team takes the opposite approach, designing corporate endpoint protections around the employee experience. The goal is to keep company devices—laptops, for example—safe from threats like malware and unauthorized access without turning security into a productivity bottleneck.

Quarantine, then self-service recovery

Endpoint security has a reputation for locking users out of their own machines and forcing them to wait on IT tickets. Figma's Endpoint Security Baseline (ESB) tries to avoid that pattern. ESB enforces a set of controls on corporate devices: keeping browsers patched, disabling remote login, and preventing unauthorized kernel extensions from loading. Kernel extensions are particularly dangerous because they run code directly inside the macOS kernel, where they can exfiltrate data, disable protections, or steal credentials.

ESB uses OSQuery, a SQL-like tool for system-level data, to detect risks like a malicious kernel extension the moment it appears. The device is then quarantined and cut off from privileged systems including AWS, GitHub, and GSuite. But instead of handing the problem to IT, the system first attempts to fix the issue automatically. If that fails, the user gets a Slack message with self-service remediation steps. Once the device returns to a safe state, access is restored immediately. The result: devices never touch sensitive data while vulnerable, and employees spend less time blocked.

A data-driven rollout for binary allowlisting

Santa, an open-source binary allowlisting tool for macOS, is gaining traction in the security community. It restricts device fleets to approved applications, blocking malware at the execution layer. Since it runs as a protected system extension, it is also tamper-resistant. Figma wanted those benefits but was wary of disrupting how engineers work, so the rollout started with Santa's Monitor Mode, which observes binaries in use without blocking anything.

The data from that observation period shaped the entire deployment:

  • Engineering produced the vast majority of binaries; most other departments ran standard apps like Slack and Chrome, making a short allowlist easy to compile.
  • Compiling and running code generates a new binary each time, so Figma built automation to allowlist binaries created by its own engineers.
  • Engineers rely on a wide range of productivity tools, each of which was reviewed for security before being added to the allowlist.

When the allowlist was ready and Lockdown Mode was enabled, the numbers looked good: 90% of devices wouldn't have a single program blocked. For the remaining long tail of applications, Figma built a self-service approval workflow in Slack. Santa was then rolled out gradually, starting with engineers who had been at the company for over six months. Most employees never noticed the change.

Just-in-time access with Opal

Access control often falls into one of two extremes. The "Wild West" approach has few guardrails, so anyone can reach production—fast, but risky. The other extreme is process-heavy access requests that slow engineers down and push them toward shadow IT, which accounts for 11% of all security incidents, or running production services out of dev environments.

Figma avoids both by using Opal for just-in-time (JIT) role-based access. Employees request access when they need it; if their role pre-approves them, they get it automatically with an expiration window, say one hour. This reduces the number of privileged credentials lingering on devices where malware could scoop them up, while also cutting the process overhead of traditional access requests.

Access policies in Opal are written as Config as Code (CAC), which keeps them version-controlled, auditable, and easy to update. For example, engineers might always have GitHub access, data science teams get pre-approved JIT access, and other roles require VP-level approval.

module "app_users" {
  source      = "modules/group"
  name        = "#GitHub"
  description = "Access to Github"
  approvals = [{ type="PREAPPROVE", val=module.rbac.roles["Dept-DataScience"]}]
  autoadd = [ module.rbac.roles["Dept-Engineering"] ]
  review_settings = {
    review_stages = [{ type="VP_ENGINEERING_REVIEW" }]
  }
}

Lessons for building security people actually use

Figma's experience points to a few repeatable principles for endpoint security:

  • Prioritize usable security: Build controls into existing workflows rather than adding new hurdles.
  • Automate remediation: Fix issues in the background before interrupting the user.
  • Offer self-service tools: Let employees resolve problems on their own to speed up recovery and improve compliance.
  • Roll out gradually: Introduce sweeping changes incrementally to minimize disruption and resistance.