If you&#x27;re looking to hide your activity from malware, you should be incredibly excited by SIP. With SIP enabled, you have <i>more</i> protection from malware introspecting other processes or monitoring activity on the system. Hell, if you&#x27;re a researcher building tools to detect and analyze OS X malware, you&#x27;d likely <i>benefit</i> from SIP by opting-in your tools to SIP&#x27;s restrictions. (Tangential example: Chrome is taking this step; Canary is currently SIP restricted.)<p>Malware can only introspect SIP-protected activity by employing kernel exploits. If malware can compromise the kernel, it&#x27;s game over. You&#x27;re not going to hide anything, ever.<p>If anything, it sounds like you want SIP&#x27;s purview expanded to encompass more of OS X.