Laptop security software: what each type does

MacWindowsUpdated

Laptop security software isn't one product. Each type covers a different risk, and Macs and Windows laptops already include most of them in some form. Check those are switched on first, then add software for whatever they leave uncovered.

Quick answer

The main types are antivirus, firewall, disk encryption, backup, password managers, device finding with remote lock or erase, and an unlock record that photographs whoever unlocks the laptop. Macs and Windows PCs include the first six in some form. Check they're switched on, and add software only for a gap the built-in tools leave.

What does antivirus and anti-malware software do?

It looks for malicious software and stops it running. Apple's Platform Security guide describes the Mac's malware defences in three layers: Gatekeeper and notarisation aim to stop malware launching, the same two plus XProtect block it from running, and XProtect removes malware that has already run. You choose where apps may come from in Apple menu > System Settings > Privacy & Security, next to "Allow applications from".

On Windows, the built-in Windows Security app includes Microsoft Defender Antivirus, which Microsoft says scans files and processes that you open or download.

  1. Search for Windows Security in the Start menu and open it.
  2. Select Virus & threat protection > Manage settings.
  3. Check that Real-time protection is on.

When to add more: the NCSC's device security guidance, written for organisations, says the built-in tools will meet the needs of many, calls XProtect "reasonably effective" on macOS, and says older versions of Windows will benefit from third-party antivirus. It advises against running two antivirus products on one device, because they may conflict. See does a Mac need antivirus.

Does a laptop need a separate firewall?

Usually not. Apple says a firewall can protect your Mac from unwanted contact initiated by other computers, and Microsoft says Windows Firewall filters network traffic and blocks unauthorised access. The NCSC says modern devices have firewall software built in and turned on by default, but suggests checking it in case a previous user turned it off.

  • On a Mac: Apple menu > System Settings > Network > Firewall.
  • On Windows: Windows Security > Firewall & network protection, then choose your network profile and switch Microsoft Defender Firewall on.

What does disk encryption protect?

It keeps what's stored on the laptop unreadable without your login. Apple says a Mac with Apple silicon or the T2 chip encrypts its data automatically, and that FileVault provides an extra layer of security, so others can't access your data without your login password. An Intel Mac without the T2 chip needs FileVault to be encrypted. Turn it on in Apple menu > System Settings > Privacy & Security > FileVault.

On Windows, Microsoft says Device Encryption enables BitLocker automatically when you first sign in with a Microsoft account, but not with a local account. Go to Settings > Privacy & security > Device encryption. BitLocker Drive Encryption is offered on Windows Pro, Enterprise and Education.

Do I need backup software?

You need a backup. The NCSC lists the reasons: a lost, stolen or broken device, accidental deletion, and malware such as ransomware.

On a Mac, Time Machine backs up files that weren't part of the macOS installation to an external disk. On Windows, Windows Backup syncs your Desktop, Documents, Pictures, Videos and Music folders to OneDrive and stores your settings with your Microsoft account; select Start, type backup, and choose Windows Backup.

When to add more: the NCSC suggests keeping irreplaceable things both in the cloud and on removable media, and disconnecting the removable media when it isn't in use.

Is a password manager security software?

Yes. The NCSC says a password manager stores passwords safely, lets you use a different password for every service, and only autofills on the correct website. It also says saving passwords in your browser is safe on your own devices, never on a shared public one.

On a Mac with macOS Sequoia or later, saved passwords are in the Passwords app, and Apple says iCloud Keychain keeps them updated across your devices. On Windows, Microsoft Password Manager is in Microsoft Edge under Settings > Passwords and autofill, with a personal Microsoft account.

What does device-finding and remote erase software do?

It helps after a laptop goes missing, if you turned it on beforehand. Apple's Find My shows a lost Mac's approximate location, can play a sound, lock it, and erase it remotely. On a Mac with Apple silicon or the T2 chip, with two-factor authentication on, Find My also enables Activation Lock, which Apple says is designed to prevent others using your Mac if it's lost or stolen.

Find my device on Windows 10 and 11 needs a Microsoft personal account with administrator rights and location on. You can then lock the laptop from account.microsoft.com/devices. Microsoft's page doesn't describe a remote erase.

What is an unlock record?

Software that photographs whoever unlocks the laptop. Apple doesn't document a built-in way to do this, and none of the Microsoft pages above describes one. The other types mostly deal with someone who doesn't have your password. Someone who does signs in as you. See who unlocked my Mac.

Where Failshot fits

Your password is the first layer. Failshot is the second: second layer device security, and an unlock record, for the moment someone sits down at your Mac and unlocks it.

  • It's out now for Mac as a download from failshot.app, for macOS 14 or later. It's free to download, and free to use. Pro adds video, email alerts and the encrypted vault. Try Failshot Pro free for 7 days. Your card is taken at sign-up and charged on day 8 unless you cancel.
  • While it's on, it takes photos of whoever unlocks your Mac, then, with Pro, records a 5-second video. Video can be switched off.
  • With the Mac's built-in camera, the green light comes on, and its window tells whoever unlocked the Mac that the unlock was photographed.
  • With Pro, turn on alerts and Failshot emails you about an unlock you don't confirm as yours, a wrong Failshot PIN or answer, or its camera access being switched off while it's on.
  • Switching it off, or quitting it from its menu, takes Touch ID or your Failshot PIN and answer, never your Mac password.

It's for your own Mac. The Windows version is coming soon, as are iPhone and Android.

More questions

What is the best laptop security software?

The set that covers your gaps. Start with what's built in: malware protection, the firewall, encryption, backup, a password manager and Find My or Find my device. The NCSC says built-in tools meet the needs of many organisations. Then add software for a specific gap.

Do I need to buy antivirus for a Windows laptop?

Not necessarily. Windows Security, with Microsoft Defender Antivirus, is built into Windows. The NCSC says older versions of Windows will benefit from third-party antivirus, and advises against running two antivirus products at once.

Can security software find a stolen laptop?

Find My on a Mac and Find my device on Windows can show where a laptop is and lock it, and Find My can erase a Mac. Both have to be switched on before the laptop goes missing.

Can laptop security software show who used my laptop?

Most types can't. Antivirus, firewalls and encryption don't record who signed in. An unlock record, which photographs whoever unlocks the laptop, is the type built for that.

Sources