For those of you who also use macOS devices, we thought you might find the following interesting.
We’re blown away by the performance of Apple’s M4 Max! Our Standalone Analyzer tool for macOS processes sysdiagnose files from iOS and iPadOS devices looking for signs of spyware & other cybersecurity threats. We expected a 4x boost over the M1—but instead we’re seeing 10.13x the performance!
We use a fleet of M1 and M2 powered Mac minis to analyze incoming sysdiagnose files for anomalies that are submitted via our Am I Secure? app. We also use an M1 based MacBook Pro if a new client requests assistance with initial onboarding for our Standalone Analyzer product. During the optional onboarding process we often process hundreds if not thousands of sysdiagnose files all at once that a client has begun collecting over the past few weeks to see if they have a historical security issue before they go on to daily scanning of future samples using their own systems. Based on pure CPU specs we expected a 4 times increase in performance for the M4 versus the M1, so processing a fixed amount of files in a quarter of the time. A 4 times expected increase due to a mix of higher per CPU core performance and from doubling the number of cores.
Turns out the M4 Max’s incredible SSD speed and memory bandwidth are game-changers, eliminating bottlenecks we saw on the M1. This test was on a 16” MacBook Pro M4 Max with 16 cores.
When benchmarking Standalone Analyzer, we observe that on the M1, CPU cores are often idle—likely waiting for the SSD to load large amounts of data from the sysdiagnose archive into memory. Once loaded, the data undergoes processing followed by comparison against our baseline data and analysis by our AI/ML module to detect anomalies, which are then categorized and forwarded to our team of mobile cyber security experts for manual review.
On the M4 Max, the significantly improved SSD performance and memory bandwidth appear to eliminate these bottlenecks and keep the CPU cores busy, delivering the remarkable 10x overall performance boost. Additionally, it’s possible that Xcode’s compiler is leveraging the GPU cores, even though our code isn’t explicitly GPU-related.
This combination of hardware and potential software optimizations is a game-changer for our workload.
A client gave us permission to retain a sample of 1K of their sysdiagnose files to use for benchmarking, so the data being assessed doesn’t change, just the hardware we’re benchmarking. We will use this in the future to provide performance benchmarks as we purchase newer hardware that Apple releases.
We can’t wait to see what a maxed-out Mac Studio with M4 offers!
