Does a Mac need antivirus? What's built in, and when to add more

MacUpdated 14 October 2026

Every Mac already has antivirus built in. Apple calls it XProtect, and it works alongside Gatekeeper and notarisation, which check apps before they open. The UK's National Cyber Security Centre (NCSC) says Apple devices contain built-in virus protection that is already turned on. Whether you need anything extra depends mostly on how the Mac is managed and kept up to date.

Quick answer

macOS includes XProtect, which Apple describes as built-in antivirus technology, plus Gatekeeper and notarisation to check apps from outside the App Store. The NCSC advises making sure built-in antivirus is switched on and kept up to date. A separate product can make sense for organisations or for a Mac that no longer gets updates, though the NCSC's first advice for an unsupported Mac is to replace it. Run only one.

What antivirus is built into a Mac?

XProtect. Apple's Platform Security guide says macOS includes built-in antivirus technology called XProtect for the signature-based detection and removal of malware. Apple updates its signatures automatically, separately from macOS updates, and by default macOS checks for those updates daily.

According to Apple, XProtect checks for known malicious content whenever:

an app is first launched
an app has been changed in the file system
XProtect's signatures are updated

When it finds known malware, Apple says XProtect blocks it, moves it to the Bin and alerts you in the Finder. Apple also describes a remediation engine that removes malware when it receives updated information, and an engine that detects unknown malware based on behavioural analysis. Apple describes its defences as three layers: stop malware launching, block it from running, then remediate it if it has run.

What do Gatekeeper and notarisation do?

They check apps before they run. Apple says that when you download and open an app, plug-in or installer from outside the App Store, Gatekeeper verifies that it's from an identified developer, is notarised by Apple to be free of known malicious content, and hasn't been altered. It also asks for your approval before opening downloaded software for the first time.

Notarisation is Apple's malware scanning service for developers who distribute Mac apps outside the App Store. Apple scans the app for known malware and, if none is found, issues a ticket. Apple can also revoke that ticket later for apps known to be malicious, and Gatekeeper can then block them.

To check which apps your Mac allows:

Open System Settings, then click Privacy & Security.
Scroll down to Security.
Under "Allow apps downloaded from", choose App Store, or App Store and identified developers.

Apple notes these settings may not be available if your Mac is managed by an administrator or IT department.

If macOS blocks an app that hasn't been notarised or is from an unidentified developer, Privacy & Security shows an Open Anyway button after you try to open it. Apple warns that running software that hasn't been signed and notarised may expose your computer and personal information to malware, so use it only if you're certain the app comes from a trustworthy source and hasn't been tampered with.

How do I keep the built-in protection up to date?

Turn on automatic security updates. Apple says your Mac installs Background Security Improvements, security-configuration updates and system data files in the background, and that keeping your software up to date is one of the most important things you can do for your Mac's security. Apple lists XProtect's updates among those security-configuration updates.

In macOS Tahoe 26 or later:

Choose Apple menu > System Settings, click General, then Software Update.
Click the More Info button next to Automatic Updates and make sure "Install system data files and security updates" is on.
Then go to System Settings > Privacy & Security, click Background Security Improvements, and make sure Automatically Install is on. Apple says Background Security Improvements arrived in macOS 26.1.

In macOS Sequoia, Sonoma and Ventura:

Choose Apple menu > System Settings, click General, then Software Update.
Click the More Info button next to Automatic Updates and make sure "Install Security Responses and system files" is on.

Apple adds that laptops must be plugged in to download updates automatically.

When can extra antivirus software make sense?

The NCSC's advice for home users is to make sure the built-in antivirus is switched on, which it says makes you instantly safer. It also says separate antivirus products won't always work alongside the built-in software, and could even stop it working. Its guidance for organisations says the antivirus built into macOS will meet the needs of many organisations, and that some may also wish to look at commercial products.

Situations the NCSC describes where more can make sense:

A managed or work Mac. For organisations, the NCSC describes adding to XProtect with a built-in antivirus solution from the device management provider and a separate endpoint detection and response tool, and says it's best to use both. If your employer manages your Mac, follow its rules.
A Mac that no longer gets updates. The NCSC's advice is to replace a computer that's no longer supported with one that still gets updates. Until then, it says third-party antivirus that is still supported on obsolete platforms might help manage some of the risks.

Two NCSC cautions apply either way. It doesn't recommend using more than one antivirus product on a device, because the benefit is minimal and the products may conflict. And it notes that when a trial version that came with a computer expires, you'll have to pay or register to keep using it. If you do choose a product, the NCSC suggests doing your own research.

Can a Mac get spyware or a keylogger?

If you're worried that a partner or someone you live with has put something on your Mac, you don't have to deal with it alone. In the UK, the National Domestic Abuse Helpline, run by Refuge, is on 0808 2000 247. In an emergency, call 999.

Apple's own malware pages describe malware reaching a Mac, and how XProtect blocks and removes it. If you're worried about spyware or a keylogger, the settings to check are the ones that control what apps can watch. Apple says some apps can monitor your keyboard, mouse or trackpad even when you're using other apps, and you decide which are allowed.

Choose Apple menu > System Settings, then click Privacy & Security.
Click Input Monitoring and turn off any app you don't recognise or no longer need.
Go back and click Screen & System Audio Recording. Apple says some apps and websites can record your screen and audio; turn off any you don't expect.
In System Settings, click General, then Login Items & Extensions, and look for apps that open at login that you didn't add.

For a very small group of people, Apple offers Lockdown Mode. Apple describes it as an optional, extreme protection for the very few individuals who might be personally targeted by some of the most sophisticated digital threats, and says most people will never be targeted this way. On a Mac, choose Apple menu > System Settings, click Privacy & Security, scroll down, click Lockdown Mode, then click Turn On and follow the prompts. The Mac restarts to turn it on.

Where Failshot fits

Failshot is not antivirus. It doesn't scan for, detect or remove malware, spyware or keyloggers, it doesn't detect remote access, and it doesn't replace XProtect, Gatekeeper or software updates. It covers a different risk: someone with your Mac in their hands.

With Failshot on, it photographs whoever unlocks your Mac, then records a 5-second video. Video is on by default and can be switched off. Sound is off unless you turn it on, and the app warns you that recording someone's voice without their permission is against the law in some places.
Whoever unlocks sees Failshot's window saying the unlock was photographed, and when a video is recording. With the Mac's built-in camera, the green light comes on.
Email alerts and location are off until you turn them on. With alerts on, Failshot emails you about an unlock you don't confirm as yours, a wrong Failshot PIN or answer, or its camera access being switched off while it's on.
Photos are kept on your Mac. They leave it only in email alerts and the encrypted web vault, if you turn those on, and, if you join your organisation with its invite code, encrypted for its security team too.
Switching Failshot off, or quitting it from its menu, takes Touch ID or your Failshot PIN and answer, never your Mac password. A wrong Failshot PIN or answer takes another photo. Like any Mac app, it can still be force-quit, and then it takes no photos until it's open again.

Failshot is out now for Mac, on macOS 14 or later, as a free download from failshot.app. Turning it on needs Failshot Pro, a paid subscription, and there's no free trial. Failshot Pro is £3.99 a month or £23.99 a year, VAT included, for as long as you stay subscribed, if you subscribe by 31 October 2026. From 1 November 2026 new subscriptions are £5.99 a month or £35.99 a year.

What it doesn't do: it doesn't photograph a wrong password at the login or lock screen. It doesn't photograph the first login after a restart or a log out. Logging out, restarting or shutting down closes Failshot without asking for Touch ID or your Failshot PIN, and unless you've set it to start at login, it stays off until you open it again. It can't find a lost Mac on demand: location, if you turn it on, is noted only at an unlock. It has no remote lock or wipe. It's for your own Mac, or a Mac your organisation has authorised you to manage with Failshot. iPhone, Android and Windows versions are coming soon.

Questions people also ask

Is XProtect real antivirus?

Apple describes XProtect as built-in antivirus technology for the signature-based detection and removal of malware. It updates its signatures automatically, separately from macOS updates, and Apple says it also includes an engine that detects unknown malware based on behavioural analysis.

How can I see if XProtect has been updated?

Apple says to hold the Option key while choosing System Information from the Apple menu, then select Installations under Software and sort by Install Date. Apple lists XProtectPayloads and XProtectPlistConfigData among the security-configuration updates your Mac installs in the background.

Can I run two antivirus programs on a Mac?

The NCSC doesn't recommend more than one antivirus product on any device. It says the security benefit is minimal and the products may conflict, which can cause stability problems. It also notes separate products could stop built-in antivirus working.

Does Gatekeeper stop all malware?

Apple doesn't describe it that way. It describes Gatekeeper and notarisation as checks for known malicious content. XProtect adds an engine that detects unknown malware based on behaviour, and remediation for malware that has already run. Keep automatic security updates on.

Do I need antivirus if I only use the App Store?

Apple calls the App Store the safest place to get apps for your Mac, because Apple reviews each app before it's accepted. Apple also says that, by default, all software in macOS is checked for known malicious content the first time it's opened, however it arrived. The NCSC's advice still applies: keep built-in antivirus on and up to date.