SEB 3.7 stops VPN-Connection

[marcgei]

Unlike earlier versions of the Safe Exam Browser (where the network connection was controlled via the menu bar of the Mac), our VPN connection (Ivanti) is disconnected when SEB 3.7 is launched. As certain functions require the use of a VPN, we are restricted in our use of these functions.

Steps to reproduce the behavior:

1. Establish a VPN Connection (in our case via the Ivanti Secure Access Client)
2. Login to an assessment platform with a local account (VPN required) -> works
3. Start SEB 3.7
   -> start of SEB is very slow, sometimes runs into a timeout
4. Login to an assessment platform with a local account (if SEB is eventually started)
   -> does not work (missing VPN connection)
5. Close SEB -> VPN connection gets re-established

Expected behavior
As with previous versions of SEB, I expect that SEB will have no effect on the network connection. When I disconnect VPN the loading time to start up SEB is ok and I never ran into a timeout.

Version Information
Please complete the following information:

• OS: macOS 26.5.2
• SEB Version 3.7

org.safeexambrowser.SafeExamBrowser 2026-08-21--14-44-40-532.log
org.safeexambrowser.SafeExamBrowser 2026-08-21--14-41-22-490.log

[danschlet]

This is caused by AAC Assessment Mode, which prevents internet access for all processes running on the Mac. This is one reason, why AAC provides superior security over the classic SEB kiosk mode. Tools communicating over the network are effectively stopped by AAC. This is one reason, why SEB starting with SEB 3.7 is using AAC as the default lockdown/kiosk mode.

Ideally, Ivanti Secure Access Client would be added as permitted process to your SEB configurations, so that it can be used with AAC. Permitted processes on macOS/iOS can be granted network access. But unfortunately this only works if the process is an app with UI, currently AAC doesn't allow to grant network access to background processes. So it depends on the architecture of the VPN client if it will work in AAC. For example the native macOS Cisco Secure Client doesn't work, as it uses various background/helper processes. But Cisco allows to use its AnyConnect iOS client also on macOS (on Apple Silicon Mx Macs), which can be added as a permitted process in SEB for macOS (but it has to be started and connected before starting SEB, because its UI somehow can't be displayed while in AAC). There is even a new Add Preset Process… in SEB's Settings / Applications / Permitted Process, which currently contains only AnyConnect (but we could add other VPN or similar helper tools). See screen shot for necessary properties (Allow network access, Allow running in background).

I assume that the built-in VPN feature of macOS would also work with AAC (but didn't test it). So in case you can alternatively use its supported VPN protocols instead of a dedicated VPN client, this might also solve the issue.

Otherwise the only alternative is to not require VPN for exam access or to use the classic kiosk mode in SEB. Please see Release Notes for details about the new lockdown mode policy setting (Settings / Security / macOS / Lockdown/Kiosk Mode / Enforce classic kiosk mode for the less secure, but more compatible mode).

The menu bar cannot be used in SEB 3.7 anymore, as in macOS 26 it created a new security vulnerability.