Free security software for Mac: what macOS already includes

MacUpdated

Your Mac already comes with security software you don't pay extra for. Apple builds antivirus into macOS, called XProtect, along with Gatekeeper, a firewall, FileVault encryption and Find My. The UK's National Cyber Security Centre (NCSC) says antivirus is often included for free in the operating systems on Windows and Apple computers.

Quick answer

macOS includes XProtect, which Apple describes as built-in antivirus technology, plus Gatekeeper, a firewall, FileVault and Find My. Check each is switched on and keep automatic security updates on. Treat any pop-up offering a free virus scan as a scam, and get software from the App Store or the developer's own website.

What security software is built into a Mac?

Five tools come built in. Apple's Platform Security guide says macOS includes built-in antivirus technology called XProtect for the signature-based detection and removal of malware. The NCSC says that making sure built-in antivirus is switched on makes you instantly safer.

  • XProtect checks for known malware. When it finds some, Apple says it blocks it, moves it to the Bin and alerts you in the Finder.
  • Gatekeeper checks apps from outside the App Store. Apple says macOS checks the Developer ID signature to verify the software is from an identified developer.
  • The firewall can protect your Mac from unwanted contact initiated by other computers, in Apple's words.
  • FileVault keeps someone from getting at your data without your login password. Apple says a Mac with Apple silicon or the T2 Security Chip encrypts its data automatically.
  • Find My can show a lost Mac's approximate location on a map, play a sound, lock it or erase it, if you set it up before the Mac went missing.

How do I check the free protection is switched on?

Most of it depends on updates. Apple issues XProtect's updates automatically, and by default macOS checks for them daily. Work through these in System Settings.

  1. Security updates (macOS Tahoe 26 or later): choose Apple menu > System Settings > General > Software Update. Click the More Info button next to Automatic Updates and turn on "Install system data files and security updates". Then go to Privacy & Security > Background Security Improvements and turn on Automatically Install.
  2. Security updates (Sequoia, Sonoma or Ventura): in the same More Info panel, turn on "Install Security Responses and system files".
  3. Where apps can come from: go to Privacy & Security, scroll to Security, and next to "Allow applications from" choose App Store, or App Store and Known Developers. Apple calls App Store only the most secure setting.
  4. Firewall: go to Network > Firewall and turn it on.
  5. FileVault: go to Privacy & Security > FileVault and turn it on.
  6. Find My: click your name at the top of the sidebar, then iCloud > See All > Find My Mac, and click Turn On. Apple's setup steps also turn on Location Services, and Find My within it, under Privacy & Security > Location Services.

Is a free antivirus pop-up on a website real?

No. Apple says that if a pop-up or alert while you're browsing warns you about security problems or viruses on your device, don't believe it, and don't call the number or follow the links. Navigate away, or close the window or tab.

The US Federal Trade Commission (FTC) says scammers create fake security warnings that tell you to call a phone number for tech support, and that real security pop-ups will never ask you to call one. The FTC describes how it usually goes: they ask for remote access to your computer, claim to find a malicious program, then offer to remove it for a fee.

macOS's own warnings look different. Apple says that if macOS detects known malware, your Mac tells you the app can't be opened and moves it to the Bin. That message appears when you try to open an app, not on a web page.

How do I judge a free Mac security app?

Start by asking whether you need it. The NCSC's device security guidance says built-in products will meet the needs of many organisations, and that some people may still want a third-party product. If you do look at one, these questions come from official guidance:

  1. How does it update? The FTC says to update security software regularly, or set it to update automatically. The US Cybersecurity and Infrastructure Security Agency (CISA) says antivirus can only detect malware with known characteristics, which is why new definitions matter.
  2. Will it be the only one? The NCSC doesn't recommend more than one antivirus product on a device. It says the benefit is minimal and the products may conflict.
  3. Will it work with what's built in? The NCSC says separate antivirus products won't always work alongside the built-in software.
  4. Is it a trial? The NCSC says that when a trial version expires, you'll have to pay or register to keep using it.
  5. How does it compare? CISA says your choice may come down to recommendations, particular features, availability or price, and the FTC suggests independent review sites for recommendations.

Where should I download Mac security software?

Apple says the safest place to get apps for your Mac is the App Store. If you download from the internet or directly from a developer, Apple says macOS continues to protect your Mac, and an app notarised by Apple has been checked for malicious software.

The FTC adds two rules. Don't click on ads to download software, because scammers place bogus ads on social media and search engines. Go to the website by typing in the address yourself.

If macOS blocks an app, Privacy & Security shows an Open Anyway button. Apple says to use it only when you're sure the app is trustworthy.

Where Failshot fits

Your password is the first layer. Failshot is the second: second layer security for your Mac, for the moment someone sits down at it and unlocks it.

  • While it's on, Failshot photographs whoever unlocks your Mac, then, with Pro, records a 5-second video.
  • With the Mac's built-in camera, the green light comes on, and Failshot's window tells whoever unlocked the Mac that the unlock was photographed.
  • With Pro, turn on alerts and Failshot emails you about an unlock you don't confirm as yours, a wrong Failshot PIN or answer, or its camera access being switched off while it's on.
  • Switching it off, or quitting it from its menu, takes Touch ID or your Failshot PIN and answer, never your Mac password.

Get it from failshot.app for macOS 14 or later. Free to download. It's free to use. Pro adds video, email alerts and the encrypted vault, and you can try Pro free for 7 days. Your card is taken at sign-up and charged on day 8 unless you cancel. iPhone, Android and Windows versions are coming soon.

More questions

Is there free antivirus for Mac?

Yes. Every Mac includes XProtect, which Apple describes as built-in antivirus technology. Apple updates it automatically, and by default macOS checks for those updates daily. The NCSC says antivirus is often included for free in the operating systems on Apple computers.

Does a MacBook Air have the same free protection?

macOS includes XProtect, Gatekeeper, the firewall, FileVault and Find My, so a MacBook Air running macOS has them too. Apple says a Mac with Apple silicon or the T2 chip encrypts its data automatically.

Is the Mac firewall on by default?

Apple's firewall page doesn't say. Check it yourself: choose Apple menu > System Settings > Network > Firewall, and turn it on if it's off.

Can I trust a website that offers a free Mac virus scan?

Don't trust one that pops up while you browse. Apple says not to believe browser alerts warning of viruses on your device, and to close the window or tab. The FTC says real security warnings never ask you to call a number.

Should I install a free antivirus as well as XProtect?

It depends on how you use the Mac. The NCSC says built-in tools meet the needs of many organisations, and that separate antivirus products won't always work alongside the built-in software. If you add one, run only one.

Sources