Does a Mac have built-in antivirus? What XProtect is and does

MacUpdated

Yes. Every Mac has built-in antivirus called XProtect. Apple's Platform Security guide describes it as built-in antivirus technology for the signature-based detection and removal of malware. Apple updates it automatically, independently of macOS updates, and it works alongside Gatekeeper and notarisation, which check apps before they open.

Quick answer

macOS includes XProtect, which detects and blocks known malware, removes malware that has already run, and has an engine that detects unknown malware by its behaviour. Apple updates its signatures automatically, and by default your Mac checks for those updates daily. Keep automatic security updates on so it stays current.

What is XProtect?

XProtect is the antivirus built into macOS. Apple says it automatically detects and blocks the execution of known malware. When it finds known malware, it blocks it, moves it to the Bin and alerts you in the Finder.

It isn't only a list of known threats. Apple says XProtect contains an advanced engine to detect unknown malware based on behavioural analysis.

When does XProtect check apps?

Apple says that in macOS 10.15 or later, XProtect checks for known malicious content whenever:

  • an app is first launched
  • an app has been changed in the file system
  • XProtect's signatures are updated

Apple adds that XProtect scans only apps that have been changed or apps at first launch.

How does XProtect update?

Apple monitors for new malware infections and strains and updates XProtect's signatures automatically, independently of system updates. By default, macOS checks for these updates daily. They arrive as what Apple calls security-configuration updates, installed in the background without restarting your Mac.

To make sure they're on in macOS Tahoe 26 or later:

  1. Choose Apple menu > System Settings, click General, then Software Update.
  2. Click the More Info button next to Automatic Updates and turn on "Install system data files and security updates".
  3. Go to System Settings > Privacy & Security, click Background Security Improvements, and turn on Automatically Install.

In macOS Sequoia, Sonoma and Ventura, the setting in step 2 is called "Install Security Responses and system files", and there's no step 3.

To see when updates last arrived, Apple says to hold the Option key while choosing Apple menu > System Information, select Installations under Software in the sidebar, then sort by the Install Date column.

What is XProtect Remediator?

Apple's Platform Security guide and support pages don't use the name XProtect Remediator. What they describe is a remediation engine inside XProtect. Apple says XProtect includes technology to remediate infections should malware make its way onto a Mac, and that this engine remediates infections based on updates automatically delivered from Apple. It removes malware when it receives updated information, and keeps checking periodically for infections. Apple notes XProtect doesn't automatically restart the Mac.

Apple's page on background updates lists two of the security-configuration items by name. XProtectPayloads removes known malware. XProtectPlistConfigData prevents known malware from running.

How do Gatekeeper and notarisation fit with XProtect?

They come first. Apple describes Mac malware defences in three layers:

  1. Stop malware launching: the App Store, or Gatekeeper combined with notarisation.
  2. Block malware from running: Gatekeeper, notarisation and XProtect.
  3. Remediate malware that has run: XProtect.

Gatekeeper checks software from outside the App Store. Apple says it verifies that the software is from an identified developer, is notarised by Apple to be free of known malicious content, and hasn't been altered, and asks for your approval before downloaded software opens for the first time.

Notarisation is Apple's malware scanning service for developers who distribute Mac apps outside the App Store. Apple scans the software for known malware and, if none is found, issues a notarisation ticket. Apple can also issue a revocation ticket for apps known to be malicious, even ones previously notarised. macOS checks for new revocation tickets regularly, more often than XProtect's signature updates, so Gatekeeper can block those files from launching.

What should I do if my Mac warns me about malware?

Apple says that if macOS detects known malware, it tells you the app can't be opened and moves it to the Bin. You may be asked to share a copy anonymously with Apple. Apple says that if you do, macOS uploads only the malware executable, or the app bundle containing it, and nothing else.

Other messages mean different things, according to Apple:

  • "Will damage your computer": macOS found malicious content, or the app's authorisation has been revoked.
  • "Can't be opened": the app has been modified or damaged. Apple says it may be broken or corrupted, or may have been tampered with.
  • Apple cannot check it for malicious software: Apple suggests checking the App Store for an updated version or searching for an alternative app.

A warning inside your web browser is a different matter. Apple says that if a pop-up warns you about security problems or viruses on your device, don't believe it, don't call the number or follow the links, and close the window or tab. The US Federal Trade Commission says real security pop-up warnings never ask you to call a phone number.

Where Failshot fits

Your password is the first layer. Failshot is the second: second layer device security for your Mac. While it's on, it photographs whoever unlocks your Mac, then, with Pro, records a 5-second video.

It's for the moment someone sits down at your Mac and unlocks it.

  • With the Mac's built-in camera, the green light comes on, and Failshot's window tells whoever unlocked the Mac that the unlock was photographed.
  • With Pro, turn on alerts and Failshot emails you about an unlock you don't confirm as yours, a wrong Failshot PIN or answer, or its camera access being switched off while it's on.
  • Photos, and Pro videos, are kept on your Mac, and leave it only in Pro email alerts and the encrypted web vault, if you turn those on.
  • Switching it off, or quitting it from its menu, takes Touch ID or your Failshot PIN and answer, never your Mac password.

Failshot is a free download for Mac (macOS 14 or later) from failshot.app. Free to use. Pro adds video, email alerts and the encrypted vault. Try Failshot Pro free for 7 days. Your card is taken at sign-up and charged on day 8 unless you cancel. iPhone, Android and Windows versions are coming soon.

More questions

Is XProtect turned on by default?

Apple describes XProtect as built into macOS, and says macOS checks for XProtect updates daily by default. What you can control is whether security updates install automatically, in System Settings > General > Software Update, under Automatic Updates.

Is XProtect enough on its own?

The UK National Cyber Security Centre (NCSC) says XProtect is reasonably effective at preventing malware on the platform, and that some users may still want a third-party product. If you add one, the NCSC doesn't recommend running more than one antivirus product on a device.

Does XProtect scan files all the time?

Apple says XProtect checks apps at first launch, when an app has been changed, and when its signatures are updated, and that it scans only changed apps or apps at first launch. Its remediation engine also checks periodically for infections.

How do I know XProtect has updated?

Hold the Option key and choose Apple menu > System Information, then click Installations under Software and sort by Install Date. Apple lists XProtectPayloads and XProtectPlistConfigData among the security-configuration updates your Mac installs in the background.

Can I open an app that macOS says will damage my computer?

Apple's Open Anyway instructions cover apps that haven't been notarised or are from an unidentified developer. Its page gives no steps for opening an app flagged as malicious. For an app it can't check, Apple suggests looking for an updated version in the App Store or an alternative app.

Sources