Auditing one app at a time is fine when you have a suspect. Batch scan is for when you don’t: point privacycommand at a folder, or at all of /Applications, and get a sortable, filterable table of everything at once. Each row carries the app’s risk tier, its warning and error counts, and the headline signals behind them. The same analyzer runs on every bundle — this is the full static pass, not a cheaper approximation. Click any row to open that app in the main window for the complete report.

​
What it’s good for

Fleet triage. New machine, inherited laptop, or an IT estate you’ve just taken responsibility for — this is the fastest way to find the handful of apps worth a closer look. Finding the outliers. Sorting by Trackers or risk surfaces the apps that don’t resemble their neighbours, which is usually more informative than any absolute threshold. Note that the Trackers column counts only tracker-class SDK hits, not every fingerprinted SDK — the full SDK count is in the CSV export and in each app’s own report. Periodic review. Re-running a scan after a few months of updates shows which apps have drifted. Pair it with Compare runs to see exactly what changed in any one of them.

​
Working through the results

Resist reading top to bottom. A more useful order:
1

Sort by risk tier, then scan the top

The tier is a heuristic, not a verdict — but it’s a reasonable reading order.
2

Filter to what you don't recognise

Bundled helpers and vendor utilities you’ve never opened are frequently the most interesting rows in the table.
3

Compare like with like

Two apps in the same category with very different tracker counts is a question worth asking.
4

Open the interesting ones properly

The table is triage. The judgement happens in the full report.
A full /Applications scan takes a while — every bundle gets the real static pass, including the binary work. Start it and go and do something else.

​
Getting the results out

The batch window has its own Export menu, separate from the single-app report exports: Both export the rows currently shown — filters and sort order are applied first. Narrow the table to what you care about, then export. This is the only way to get fleet-level results out of the GUI; the single-app JSON, HTML and PDF exports cover one bundle at a time.

​
From the command line

The same triage is available headless through auditctl preview --all-apps, which is the better route for CI or a scheduled job.