macOS security features explained, one by one

MacUpdated

macOS has a long list of security features built in. Here they are one at a time, with what each does and where its setting lives, followed by the gap they leave.

Quick answer

macOS includes a login password and Touch ID, FileVault disk encryption, Gatekeeper and notarisation, XProtect antivirus, System Integrity Protection, a firewall, privacy permissions with camera and microphone indicators, automatic security updates, Find My with Activation Lock, and Lockdown Mode. Several live in System Settings > Privacy & Security.

Login password and Touch ID

In System Settings > Lock Screen, Apple's setting "Require password after screen saver begins or display is turned off" locks the Mac when it's idle, so the password is needed when it wakes.

Touch ID sits on top of the password, not instead of it. You set it up in System Settings > Touch ID & Password. Apple says your password is still required when you start up your Mac, after five unrecognised fingerprint attempts, and at times to keep using Touch ID, for example every 48 hours.

FileVault

Apple's Platform Security guide calls FileVault a built-in encryption capability to secure all data at rest. Apple's support page says turning it on keeps someone from getting access to your data without entering your login password.

To turn it on, go to System Settings > Privacy & Security, scroll down and click FileVault. You'll choose between your iCloud account and a recovery key to unlock the disk if you forget your password. Apple warns that if you lose both the password and the recovery key, your files are lost.

Gatekeeper and notarisation

Gatekeeper is designed to help ensure that only trusted software runs on your Mac, Apple says. When you open an app, plug-in or installer from outside the App Store, it checks that it's from an identified developer, notarised by Apple to be free of known malicious content and hasn't been altered. It also asks for your approval before opening downloaded software for the first time.

You choose what's allowed in System Settings > Privacy & Security, under "Allow applications from". Apple calls App Store the most secure setting to protect your system from malware. App Store and Known Developers is the other choice.

XProtect

XProtect is the antivirus built into macOS. Apple describes it as signature-based detection and removal of malware, with signatures Apple updates automatically. It checks apps when they're first launched, when they've been changed and when its signatures update. If it finds known malware, it blocks it, moves it to the Bin and alerts you in the Finder. Its updates arrive with the automatic security updates below.

System Integrity Protection

System Integrity Protection, or SIP, makes critical parts of macOS read-only. Apple says this applies whether a process is sandboxed or running with administrative privileges. It's on by default from OS X 10.11 onwards.

The firewall

Apple says a firewall can protect your Mac from unwanted contact initiated by other computers. Turn it on in System Settings > Network > Firewall. Once it's on, Options lets you choose Block all incoming connections, decide which apps can accept connections, and turn on Enable stealth mode, which stops your Mac answering probing requests such as ping. There's more on whether to use it in Mac firewall: on or off.

Privacy permissions and camera indicators

System Settings > Privacy & Security lists the apps that have requested access to things like your camera, microphone, screen and keyboard input, under names such as Camera, Microphone, Screen & System Audio Recording and Input Monitoring. You can switch any app off there.

You can also see when the camera is on. Apple says a green light beside the built-in camera glows when it's in use. In the menu bar, next to the Control Centre icon, an orange dot means the microphone is in use, a green dot a camera, and a purple dot that system audio is being recorded.

Automatic updates

Apple says keeping your software up to date is one of the most important things you can do for your Mac's security. In System Settings > General > Software Update, click the Info button next to Automatic Updates and turn on the option that installs security updates and system files. On macOS Tahoe 26 or later, also turn on Automatically Install in System Settings > Privacy & Security > Background Security Improvements.

Find My and Activation Lock

Find My Mac lets you put a lost Mac in Lost Mode from the Find My app, which locks it with a passcode and can show a message with your contact details. Activation Lock comes with it. Apple says it's designed to prevent others from using your Mac if it's lost or stolen, and asks for your Apple Account password or device passcode before anyone can turn off Find My, erase the Mac or reactivate it.

It works on Macs with Apple silicon or the T2 chip running macOS Catalina or later, with two-factor authentication on your Apple Account. Turn on Find My Mac in System Settings: click your name, then iCloud, and find Find My Mac. See Mac Activation Lock for the details.

Lockdown Mode

Apple calls Lockdown Mode an optional, extreme protection against rare, highly sophisticated cyber attacks, designed for the very few individuals who might be personally targeted because of who they are or what they do. It needs macOS Ventura or later. With it on, most message attachment types are blocked, some complex web technologies are blocked and configuration profiles can't be installed. Turn it on in System Settings > Privacy & Security, then restart.

What none of these covers

Almost everything above comes back to your password. FileVault keeps someone from getting at your data without your login password. Touch ID falls back to the password. The lock screen asks for it on wake. Someone who knows your password, or watched you type it, can enter it at your Mac just as you would. None of the features in this guide records who unlocked the Mac with the right password.

Where Failshot fits

Your password is the first layer. Failshot is the second: second layer device security for your Mac. While it's on, it photographs whoever unlocks your Mac, then, with Pro, records a 5-second video, and its window tells them the unlock was photographed. With the Mac's built-in camera, the green light comes on.

It's an extra layer beside the macOS features above, for the moment someone sits down at your Mac and unlocks it. With Pro, turn on alerts and Failshot emails you about an unlock you don't confirm as yours, a wrong Failshot PIN or answer, or its camera access being switched off while it's on. Switching it off, or quitting it from its menu, takes Touch ID or your Failshot PIN and answer, never your Mac password.

Failshot is a free download for macOS 14 or later, and free to use. Pro adds video, email alerts and the encrypted vault. Try Failshot Pro free for 7 days. Your card is taken at sign-up and charged on day 8 unless you cancel.

More questions

Is a Mac secure out of the box?

Some protections work without a switch. Apple says that by default all software in macOS is checked for known malicious content the first time it's opened, and SIP is on by default. Others have a switch you control: FileVault, Find My and the firewall. Automatic security updates are worth checking too.

Does a Mac need extra security software?

The NCSC says antivirus is often included in the operating systems on Apple computers. It also warns that separate antivirus products won't always work alongside the built-in one. There's more in does a Mac need antivirus.

Is FileVault on by default?

Apple's support page doesn't say it's on by default. It says Macs with Apple silicon or a T2 chip already encrypt their data automatically, and that turning on FileVault adds an extra layer by requiring your login password.

What is the most secure setting for apps on a Mac?

Apple says allowing apps only from the App Store is the most secure setting to protect your system from malware. The setting is under "Allow applications from" in Privacy & Security.

Sources