Deploy, patch, and govern software on every Mac.
Start free, with no device or user limits. Turn on Vulnerability Patching and Governance as your security posture calls for them, or switch everything on from day one with Business.
Team
Visibility and software delivery for teams standardizing their fleet.
- Visibility
- Software Delivery
- Software Updates
- Integrations
- Compliance & Audit
- No device or user limits
Upgrade as your needs grow:
Business
Groups, roles, and automation for organizations with structure.
- Visibility
- Software Delivery
- Software Updates
- Integrations
- Compliance & Audit
- Vulnerability Patching
- Governance
- Software Publishing
- Identity & Access
Enterprise
Advanced security features to meet strict compliance standards.
- Visibility
- Software Delivery
- Software Updates
- Integrations
- Compliance & Audit
- Vulnerability Patching
- Governance
- Software Publishing
- Identity & Access, with SSO
- Custom terms & security reviews
- SLA guarantees
- Volume pricing
- Dedicated Solutions Architect
Every feature, mapped
Every feature, grouped by what it helps you do — and the plan or upgrade that unlocks it.
Visibility
Workbrew also inventories npm packages, macOS apps, and IDE extensions installed on each device.
- Team
- Business
- Enterprise
See which npm and Homebrew dependencies a package pulled in and how they are related.
- Team
- Business
- Enterprise
Find every device running a given package or version across the fleet.
- Team
- Business
- Enterprise
Drill into any device to see which users it has and exactly what is installed on it.
- Team
- Business
- Enterprise
Vulnerability detectionKnown vulnerabilities in installed packages are detected and surfaced automatically.
- Team
- Business
- Enterprise
View devices and their associated data by device group.
- Team
- Business
- Enterprise
Software Delivery
Deploy and manage HomebrewInstall managed Homebrew on every device via your MDM.
- Team
- Business
- Enterprise
A browsable catalog of 4.5 million+ software titlesBrowse and deliver software from a catalog of more than 4.5 million open source and commercial titles.
- Team
- Business
- Enterprise
Self-installs brought out of the shadowsSoftware people installed themselves shows up in your inventory.
- Team
- Business
- Enterprise
Users install software from the command line or a graphical interface, whichever they prefer.
- Team
- Business
- Enterprise
New devices automatically get your default set of software the moment they enroll.
- Team
- Business
- Enterprise
Bootstrapping per teamGive each team or device group its own default software set.
- Team
- Business
- Enterprise
Software Updates
Simple self-updating with fewer sudo blocksStandard users can run managed `brew` safely, without requiring root access.
- Team
- Business
- Enterprise
Users are notified when their software is out of date. Upgrading is made easy.
- Team
- Business
- Enterprise
Updates to outdated software apply automatically on the schedule you set, with no user action needed.
- Team
- Business
- Enterprise
Integrations
Connect any major MDMPull device records from any of Jamf, Iru, Microsoft Intune, Fleet, JumpCloud, Mosyle, Hexnode and SimpleMDM.
- Team
- Business
- Enterprise
API accessWork with your Workbrew data programmatically through the API.
- Team
- Business
- Enterprise
Choose which events you're notified about, and where they're sent.
- Team
- Business
- Enterprise
A weekly summary of your fleet's activity, delivered to your inbox.
- Team
- Business
- Enterprise
Sync device groups from your MDMDevice groups sync from your MDM automatically, so Workbrew always mirrors your source of truth.
- Team
- Business
- Enterprise
Send Workbrew events to your own endpoint — be that a SIEM or internal service.
- Team
- Business
- Enterprise
Compliance & Audit
Device command analyticsThe Analytics page shows which `brew` commands ran on each device, and when.
- Team
- Business
- Enterprise
An audit trail of who did what in your workspace, and when.
- Team
- Business
- Enterprise
Export your data as CSV or JSON for audits, reporting, and compliance.
- Team
- Business
- Enterprise
Vulnerability Patching
The CVE identifiers, severity level, latest available versions, and affected devices for any package in your fleet.
- Team
- Business
- Enterprise
Severity settingsChoose the vulnerability severity threshold at which patching kicks in.
- Team
- Business
- Enterprise
Automated patching across every devicePackages at or above your threshold are upgraded when a device checks in, not on a fixed schedule.
- Team
- Business
- Enterprise
Track open and resolved vulnerabilities over time.
- Team
- Business
- Enterprise
Give each device group its own patching policy and its own severity thresholds.
- Team
- Business
- Enterprise
Reports of every patch applied, for audits and change management.
- Team
- Business
- Enterprise
Governance
Define a list of software your company allows. Anything outside it isn't installable.
- Team
- Business
- Enterprise
Forbid by title or licenseExplicitly forbid risky command-line tools, apps or licenses.
- Team
- Business
- Enterprise
Users request software from the app or CLI; admins approve or reject the requests in the console.
- Team
- Business
- Enterprise
Software that is forbidden can be removed from devices automatically on detection.
- Team
- Business
- Enterprise
Install, upgrade, or remove software on any device remotely from the console.
- Team
- Business
- Enterprise
Fine-grained policies per groupTarget policies at specific device groups, with clear rules for devices in more than one group.
- Team
- Business
- Enterprise
Software Publishing
Distribute internal tools with Private TapsDistribute internal tools to your fleet from Homebrew taps hosted in private GitHub or GitLab repositories.
- Team
- Business
- Enterprise
Advanced credential managementSecret Brew Configurations hold tokens that are masked in the console and never written to disk.
- Team
- Business
- Enterprise
Identity & Access
Allowed domainsRestrict workspace membership to a single verified email domain.
- Team
- Business
- Enterprise
Control who can view and manage what in your workspace with granular roles.
- Team
- Business
- Enterprise
SSOSign in through your identity provider, with enforcement options for your whole workspace.
- Team
- Business
- Enterprise
| Capability | Team | Business | Enterprise |
|---|---|---|---|
Visibility | |||
| Workbrew also inventories npm packages, macOS apps, and IDE extensions installed on each device. | |||
| See which npm and Homebrew dependencies a package pulled in and how they are related. | |||
| Find every device running a given package or version across the fleet. | |||
| Drill into any device to see which users it has and exactly what is installed on it. | |||
| Vulnerability detectionKnown vulnerabilities in installed packages are detected and surfaced automatically. | |||
| View devices and their associated data by device group. | |||
Software Delivery | |||
| Deploy and manage HomebrewInstall managed Homebrew on every device via your MDM. | |||
| A browsable catalog of 4.5 million+ software titlesBrowse and deliver software from a catalog of more than 4.5 million open source and commercial titles. | |||
| Self-installs brought out of the shadowsSoftware people installed themselves shows up in your inventory. | |||
| Users install software from the command line or a graphical interface, whichever they prefer. | |||
| New devices automatically get your default set of software the moment they enroll. | |||
| Bootstrapping per teamGive each team or device group its own default software set. | |||
Software Updates | |||
| Simple self-updating with fewer sudo blocksStandard users can run managed `brew` safely, without requiring root access. | |||
| Users are notified when their software is out of date. Upgrading is made easy. | |||
| Updates to outdated software apply automatically on the schedule you set, with no user action needed. | |||
Integrations | |||
| Connect any major MDMPull device records from any of Jamf, Iru, Microsoft Intune, Fleet, JumpCloud, Mosyle, Hexnode and SimpleMDM. | |||
| API accessWork with your Workbrew data programmatically through the API. | |||
| Choose which events you're notified about, and where they're sent. | |||
| A weekly summary of your fleet's activity, delivered to your inbox. | |||
| Sync device groups from your MDMDevice groups sync from your MDM automatically, so Workbrew always mirrors your source of truth. | |||
| Send Workbrew events to your own endpoint — be that a SIEM or internal service. | |||
Compliance & Audit | |||
| Device command analyticsThe Analytics page shows which `brew` commands ran on each device, and when. | |||
| An audit trail of who did what in your workspace, and when. | |||
| Export your data as CSV or JSON for audits, reporting, and compliance. | |||
Vulnerability Patching | + | Included | Included |
| The CVE identifiers, severity level, latest available versions, and affected devices for any package in your fleet. | |||
| Severity settingsChoose the vulnerability severity threshold at which patching kicks in. | |||
| Automated patching across every devicePackages at or above your threshold are upgraded when a device checks in, not on a fixed schedule. | |||
| Track open and resolved vulnerabilities over time. | |||
| Give each device group its own patching policy and its own severity thresholds. | |||
| Reports of every patch applied, for audits and change management. | |||
Governance | + | Included | Included |
| Define a list of software your company allows. Anything outside it isn't installable. | |||
| Forbid by title or licenseExplicitly forbid risky command-line tools, apps or licenses. | |||
| Users request software from the app or CLI; admins approve or reject the requests in the console. | |||
| Software that is forbidden can be removed from devices automatically on detection. | |||
| Install, upgrade, or remove software on any device remotely from the console. | |||
| Fine-grained policies per groupTarget policies at specific device groups, with clear rules for devices in more than one group. | |||
Software Publishing | |||
| Distribute internal tools with Private TapsDistribute internal tools to your fleet from Homebrew taps hosted in private GitHub or GitLab repositories. | |||
| Advanced credential managementSecret Brew Configurations hold tokens that are masked in the console and never written to disk. | |||
Identity & Access | |||
| Allowed domainsRestrict workspace membership to a single verified email domain. | |||
| Control who can view and manage what in your workspace with granular roles. | |||
| SSOSign in through your identity provider, with enforcement options for your whole workspace. | |||
| Get started | Start free | Start free 14-day trial | Contact us |
Frequently Asked Questions
No. Create a workspace and you're on Team, which is free with no device or user limits. You can enroll your whole fleet without giving us a card. You add one when you turn on an upgrade or move to Business.
Plans are how you buy, and you're on exactly one of Team, Business or Enterprise. Upgrades switch on inside the free Team plan when a specific need shows up, priced per device. There are two, Vulnerability Patching and Governance, and Governance includes everything in Vulnerability Patching, so you never buy them separately. Business and Enterprise include both.
Every device enrolled in your workspace, which is the count on your Devices page. That includes read-only devices, where Workbrew reports what is installed without managing Homebrew. A device leaves the count when you remove it in the console, and one that has stopped checking in still counts until you do. There's no charge for people, only devices, so adding more admins costs nothing.
No. Upgrades apply to your whole workspace, so the price covers every device you have enrolled, read-only devices included. What you can vary is how the capability behaves. On Team you target a policy at your whole fleet or at a single device, and Business adds device groups, so patching thresholds and policies can differ from one team to the next.
We reconcile your device count with your subscription twice a day, so your bill tracks your fleet without you doing anything. Adding devices charges a pro-rated amount for the rest of the billing period, so a device that joins halfway through costs half a month. Removing devices lowers your count from the next invoice onward, without a refund for the part of the period you have already paid for.
Pay for a year up front and save 10% on every paid plan and upgrade. With the toggle set to annual, the prices on this page show the effective monthly rate.
Upgrades on Team and the Business plan are card only, through self-serve checkout. Enterprise is invoiced, with the terms and purchase order your finance team needs.
Business comes with a 14-day trial with everything switched on. You enter a card to start it, and it converts to a paid subscription automatically when the trial ends. Each workspace can use the trial once.
Yes. The workspace owner can turn upgrades on, move up to Business, or move back down from inside Workbrew. When you downgrade, features from the higher plan are paused and their settings are kept, so they resume unchanged if you upgrade again. Brew Configurations and Commands are the exception, because they have to be removed before the downgrade goes through.
Only the name. Free is now Team and Pro is now Team + Governance, at the same price and on the same billing date. Pro workspaces keep the device-group targeting they had on Pro, and gain app allowlist policies.
Your whole fleet, deployed today
Free, with no device or user limits. Pay only when you switch something on.