Mac Agent Upgrade – Troubleshooting Guide

Last updated: October 23, 2026

Since the September 9 platform release, the dashboard only counts agents that have been upgraded to the Next Generation Agent. That number should rise until it matches the number of machines you've migrated. If it has stalled or is close to zero, your agents are not upgrading automatically. Use this guide to find and fix the cause.

Each scenario below explains what to check and how to move endpoints that didn't upgrade to the new agent. If you have questions, contact support@cyrisma.com or open a support ticket.

Changes in Agent Operation

The September release changes how the agent works. Agents no longer run scans on a schedule that an operator or security professional has to maintain. Vulnerability management and baseline comparisons now run continuously. As soon as the Next Generation Agent is installed or upgraded, it begins collecting vulnerability and baseline data continuously.

What This Means for You

No scan schedules: You don't need to schedule or maintain vulnerability or baseline scans anymore.
Better visibility: Vulnerability details are easier to review and show more information.
Clearer remediation: The actions needed to reduce or remove a vulnerability are spelled out more clearly.
New install location: The agent is no longer installed in /Applications/Cyrisma/. It's now installed as /Applications/Cyrisma Agent.app, for consistency and compatibility with the rest of the operating system.
EDR updates likely needed: Because the agent's location and name changed, you will likely need to update EDR rules and policies to point to the new location.
Lighter footprint: The agent no longer has large Java memory requirements or large scan output files on disk.
Lightweight data collection: Data is collected in the background, so scheduled scans no longer cause temporary spikes in resource use.
Less network traffic: Agents only send changes to vulnerability data or machine configurations.
Additional allow-list rules: Agents still report to each tenant's own Tenant URL, but they are now centrally managed. That means you need additional network allow-list rules (see below).

Troubleshooting

Agent state	How to resolve
Next Generation Agent cannot be installed with a script	1. Run the script from a Terminal window, putting `sudo` before the script name, and watch the script output for errors. 2. Add `dl.cyrisma.com` to your allow list.
Next Generation Agent is installed but blocked or not working correctly	1. Update EDR rules or policies to allow the new agent location: `/Applications/Cyrisma Agent.app`. 2. Update network allow lists so the agent can reach `dl.cyrisma.com`. 3. Allow the central management endpoint for the agent's region (see the table below).

Central Management Endpoints

In addition to dl.cyrisma.com, allow the management endpoint for the region where the agent is located.

Region	Management endpoint
United States	`auth.production-north-virginia.cyrisma.com`
Australia	`auth.production-sydney.cyrisma.com`
European Union	`auth.production-ireland.cyrisma.com`
United Kingdom	`auth.production-london.cyrisma.com`
Africa	`auth.production-africa.cyrisma.com`

For the full list of network and system requirements, see Global Agent Requirements. For EDR guidance, see Whitelisting the Cyrisma Agent in Common Endpoint Protection Platforms.

Uninstalling the Legacy Agent

Note: Legacy Mac Agents (version 1.2.x.x) cannot migrate to the Next Generation Agent on their own.

If you're installing the Next Generation Mac Agent manually (see Installing the Latest Agent), uninstall the Legacy Mac Agent first. Use one of the methods below.

Option A: Use the uninstall script

Check the /Applications/Cyrisma/Install/ folder for a script named cy_uninst.sh.

If the script is there, run it from Terminal:

sudo /Applications/Cyrisma/Install/cy_uninst.sh

Option B: Uninstall manually

Run these commands from Terminal.

Stop the daemon:
```
sudo launchctl stop com.cyrisma.cybroker
```
You may also need to run the following command, where 501 is the user ID of the logged-in user:
```
sudo launchctl bootout gui/501 com.cyrisma.cybroker
```

Remove the daemon configuration file:

sudo rm /Library/LaunchDaemons/com.cyrisma.cybroker.plist

Remove the Legacy Agent folder. Make sure your Terminal session is not in /Applications/Cyrisma or any of its subfolders before running:
```
sudo rm -rf /Applications/Cyrisma
```

Installing the Latest Agent

The Next Generation Agent installs as /Applications/Cyrisma Agent.app.

Prepare for installation

Update EDR rules or policies to allow the new agent location.
Confirm that the endpoint can reach dl.cyrisma.com to download the agent.
Confirm that the endpoint can reach the central management endpoint for its region (see Central Management Endpoints).

Install the agent

In the Cyrisma tenant web interface, go to Agent Setup.
Select the operating system for the endpoint.
Download and install the latest agent using the Tenant URL and Installation Key shown on the page.

For detailed installation steps, see Deploying the Cyrisma Agent on macOS.

Agent Setup also provides sample deployment scripts. Use them as a starting point for your own scripts and add any changes or functions your environment needs for the agent to run.

EDR Compatibility

EDR tools often use DLL injection to watch programs for suspicious activity. Malware can use the same technique for malicious purposes. To guard against that, the Cyrisma agent only allows legitimate EDR suites to perform DLL injection and monitoring.

If your EDR uses DLL injection for monitoring and is blocked from monitoring the Cyrisma agent, contact Cyrisma Support with the details of your EDR suite.

Send Logs to Cyrisma Support

If the installation didn't complete, collect whichever of these agent logs are available:

Agent	Log location
Legacy Agent	`/Applications/Cyrisma/Logs`
Next Generation Agent (if present)	`/var/log/cyrisma-agent/logs`

Put the logs in a ZIP file and send it to Cyrisma Support.

If you have questions, contact support@cyrisma.com or open a support ticket.