Best antivirus for Mac? How to choose security software

MacUpdated

Every Mac already has antivirus. Apple calls it XProtect, and the UK's National Cyber Security Centre (NCSC) says it is reasonably effective at preventing malware on the platform. We don't rank products, because we haven't tested them. This guide covers what to check before adding one, and how to spot fakes.

Quick answer

macOS includes XProtect, which Apple describes as built-in antivirus technology, alongside Gatekeeper and notarisation. Keep automatic security updates on. If you still want extra software, the NCSC says make an informed choice: check how it gets updates, whether it's still supported, and run only one. Get it from the App Store or the developer's own website.

What does macOS already do against malware?

Apple's Platform Security guide describes three layers. The App Store, or Gatekeeper with notarisation, tries to stop malware launching. Gatekeeper, notarisation and XProtect block it from running. XProtect then removes malware that has already run.

Apple updates XProtect's signatures automatically, and by default macOS checks for those updates daily. XProtect also has an engine that detects unknown malware by its behaviour. When it finds known malware, it blocks it and moves it to the Bin.

Gatekeeper checks software from outside the App Store: Apple says it verifies that it's from an identified developer, is notarised by Apple to be free of known malicious content, and hasn't been altered.

All of this depends on updates. In macOS Tahoe 26 or later:

  1. Choose Apple menu > System Settings, click General, then Software Update.
  2. Click the More Info button next to Automatic Updates and turn on "Install system data files and security updates".
  3. Go to System Settings > Privacy & Security, click Background Security Improvements, and turn on Automatically Install.

In macOS Sequoia, Sonoma and Ventura, the setting in step 2 is called "Install Security Responses and system files", and there's no step 3.

Do I need extra security software on a Mac?

The NCSC's advice for home users is to make sure built-in antivirus is switched on, which it says makes you instantly safer. Its device guidance says some people may still want a third-party product. It also warns that separate antivirus products won't always work alongside the built-in software, and could even stop it working completely.

What should I check before installing Mac security software?

The NCSC says to make an informed choice. Its questions, with advice from Apple and the US Federal Trade Commission (FTC), make a short checklist:

  1. Do you need it at all? The NCSC asks whether third-party software is needed in the first place.
  2. How does it get updates, including new signatures? The FTC says to update security software regularly, or set it to update automatically.
  3. Is it still supported, including on older versions of macOS?
  4. How does it compare with other products? The FTC suggests looking for recommendations from independent review sites.
  5. Where are you downloading it from? Apple says to install software from the App Store or get it directly from the developer's website. The FTC warns of bogus software ads on social media and search engines, and says to type the maker's web address yourself.
  6. Will it be the only one? The NCSC doesn't recommend more than one antivirus product on a device. The benefit is minimal and the products may conflict.
  7. What happens when a trial ends? The NCSC notes you'll have to pay or register to keep using it.

Which permissions should make me stop and think?

You decide which apps get certain kinds of access on your Mac. Apple says some apps can monitor your keyboard, mouse or trackpad even while you use other apps, and some apps and websites can record your screen and audio. Before you allow either, it's worth asking whether that app actually needs it.

To review what you've already allowed:

  1. Choose Apple menu > System Settings, then click Privacy & Security in the sidebar.
  2. Click Input Monitoring and turn off any app you don't recognise or no longer use.
  3. Go back and click Screen & System Audio Recording, and do the same.

How do I spot a fake "your Mac is infected" warning?

Don't believe a web page that says your Mac has a virus. Apple says that if a pop-up or alert while you're browsing warns you about security problems or viruses on your device, don't believe it. Don't call the number or follow the links. Navigate away, or close the whole window or tab.

The FTC adds two plain rules. Real security pop-up warnings never ask you to call a phone number. And legitimate tech companies won't contact you by phone, email or text to tell you there's a problem with your computer. It describes how the scam usually goes: you call, they ask for remote access to your computer, run a fake diagnostic test, then charge you to fix a problem that doesn't exist.

macOS's own malware messages look different. They appear when you try to open an app. Apple says that if macOS detects known malware, it tells you the app can't be opened and moves it to the Bin.

What if I already called the number or paid?

  1. If you paid, contact your bank or card company. For a charge you didn't expect, the FTC says to ask them to reverse it. In the UK, the NCSC says to tell your bank and report it to Report Fraud.
  2. If you shared a username or password, change it right away, and change it anywhere else you used the same one, the FTC says.
  3. The FTC also says to turn on two-factor authentication.

Where Failshot fits

Your password is the first layer. Failshot is the second: second layer device security for your Mac. While it's on, it photographs whoever unlocks your Mac, then, with Pro, records a 5-second video.

It's for the moment someone sits down at your Mac and unlocks it.

  • With the Mac's built-in camera, the green light comes on, and Failshot's window tells whoever unlocked the Mac that the unlock was photographed.
  • With Pro, turn on alerts and Failshot emails you about an unlock you don't confirm as yours, a wrong Failshot PIN or answer, or its camera access being switched off while it's on.
  • Photos, and Pro videos, are kept on your Mac, and leave it only in Pro email alerts and the encrypted web vault, if you turn those on.
  • Switching it off, or quitting it from its menu, takes Touch ID or your Failshot PIN and answer, never your Mac password.

Failshot is a free download for Mac (macOS 14 or later) from failshot.app. Free to use. Pro adds video, email alerts and the encrypted vault. Try Failshot Pro free for 7 days. Your card is taken at sign-up and charged on day 8 unless you cancel. iPhone, Android and Windows versions are coming soon.

More questions

What is the best antivirus for Mac?

We don't rank products, because we haven't tested them. Every Mac includes XProtect, which the NCSC calls reasonably effective. If you want more, check how a product updates and whether it's still supported, and run only one.

Can I run two antivirus programs on a Mac?

The NCSC doesn't recommend more than one antivirus product on a device. It says the extra security benefit is minimal and the products may conflict, which can affect stability.

Will a real virus warning ask me to call a number?

No. The FTC says real security pop-up warnings never ask you to call a phone number. Apple says not to believe browser pop-ups warning of viruses on your device, and to close the window or tab.

Where should I download Mac security software from?

Apple says to install software from the App Store or directly from the developer's website. The FTC says don't click ads to download software; type the maker's web address yourself.

Sources