Do Macs Need Antivirus? What XProtect Covers and When to Add More

It’s one of the most common questions new Mac owners ask: do Macs need antivirus, or is that a Windows thing? The honest answer is that most people don’t need it, because macOS already includes antivirus and several other layers of protection that work quietly in the background.

Here’s what your Mac does on its own, who might want more, and how to check your Mac for viruses if something feels off.

Do Macs need antivirus? The short answer

For most people, no. A Mac running an up-to-date version of macOS, with apps from the App Store or from developers you trust, is well protected without third-party antivirus.

That’s not because Macs can’t get malware. They can. It’s because macOS is built to stop most of it before it runs, and to clean up known threats automatically. What you do matters more than what you install: keep macOS updated, and be thoughtful about what you download.

There are a few good reasons to add more, covered below. Fear isn’t one of them.

How your Mac protects itself

Apple describes its approach in three stages: stop malware from launching, block it if it gets onto your Mac, and remove it if it ever runs. These are the pieces that make that happen.

Protection	What it does	Do you need to do anything?
Gatekeeper	Checks apps you download before they open	Keep the default setting
Notarization	Apple scans developers’ apps for malware before release	No
XProtect	Built-in antivirus that blocks known malware	No, it updates itself
XProtect Remediator	Periodically scans for and removes known malware	No
System Integrity Protection	Stops software from changing core system files	Leave it on
Background updates	Delivers security fixes and new malware definitions between macOS updates	Keep automatic updates on

Gatekeeper and notarization

When you open an app you downloaded from the internet, Gatekeeper checks that it comes from an identified developer, that it has been notarized by Apple, and that it hasn’t been altered. Notarization means Apple has scanned the app for known malware before the developer distributed it.

If Apple later discovers that an app is harmful, it can revoke it, and macOS will block it, even if it was previously approved.

You’ll find the setting in System Settings › Privacy & Security, under Security. The setting that controls which apps can open (labeled Allow applications downloaded from or Allow applications from, depending on your macOS version) should be set to App Store or App Store and identified developers. The exact wording varies slightly between versions, and either choice is a good one.

XProtect and XProtect Remediator

XProtect is the antivirus built into every Mac. It uses signatures of known malware to check apps when they first open, when they change on disk, and when its definitions update. If it finds something, macOS blocks it and offers to move it to the Trash.

XProtect Remediator is the cleanup side. It runs scans in the background on a regular schedule, and if it finds known malware that has already made it onto your Mac, it removes it. It doesn’t announce itself; it simply works.

Apple updates XProtect independently of macOS, and by default your Mac checks for new definitions daily.

System Integrity Protection

System Integrity Protection (SIP) keeps even administrator-level software from modifying protected parts of macOS, like the /System folder and Apple’s built-in apps. Only Apple-signed processes, such as macOS updates, can change them. This makes it much harder for malware to dig in.

SIP is on by default. Leave it on. No legitimate cleaner or antivirus app should ask you to turn it off.

Background security updates

Apple can deliver security fixes and malware definitions without a full macOS update:

• System data files and security updates carry XProtect definitions and other security configuration. In System Settings › General › Software Update, click the ⓘ button next to Automatic Updates. On macOS 26 Tahoe, turn on Install system data files and security updates. On macOS Sequoia, Sonoma and Ventura, the option is called Install Security Responses and system files.
• Background Security Improvements are small security patches delivered between macOS releases, starting with macOS Tahoe 26.1. They replace the Rapid Security Responses used on macOS Ventura through Sequoia. To check, go to System Settings › Privacy & Security › Background Security Improvements and make sure Automatically Install is on.

Both are on by default. They’re the reason your Mac’s built-in antivirus stays current without you thinking about it.

Who might want extra antivirus

Third-party antivirus isn’t wrong. It’s just not necessary for most people. It can make sense if you:

• Work for a company that requires it. Many businesses need endpoint protection on every computer for compliance, insurance or audits. Your IT team will usually install and manage it.
• Share lots of files with Windows users. Windows malware can’t run on a Mac, but your Mac can pass infected files along. A scanner catches Windows threats that XProtect isn’t designed to look for.
• Download a lot from outside the App Store. If you regularly try new utilities, plug-ins or pirated software (please don’t), an occasional second-opinion scan is reasonable.
• Manage Macs for family members who are prone to clicking pop-ups and installing things they shouldn’t.

If you might be personally targeted

Journalists, activists, government officials and others whose work makes them a target face a different kind of threat: rare, highly sophisticated attacks. Antivirus isn’t the answer here. Apple’s Lockdown Mode is.

Lockdown Mode limits features attackers tend to exploit, such as most message attachments, some web technologies, incoming FaceTime calls from people you haven’t contacted, and configuration profiles. To turn it on, go to System Settings › Privacy & Security, scroll down to Lockdown Mode, click Turn On, and follow the prompts to restart.

Apple is clear that most people are never targeted this way, so most people don’t need it.

Signs your Mac may have malware

Most Mac malware is adware or junk that you were tricked into installing, not a dramatic virus. Look for:

• Your browser’s homepage or search engine changed without your permission.
• Pop-ups, new tabs or redirects to sites you didn’t ask for.
• Browser extensions or toolbars you don’t recognize.
• Apps in your Applications folder that you don’t remember installing, especially “cleaners” or “optimizers.”
• Alerts in a web page claiming your Mac is infected and urging you to call a number or download something. These are scams. Close the tab.
• Unknown items in your login items, or a configuration profile you didn’t add.
• Fans running hard or your Mac feeling slow while you aren’t doing much, with an unfamiliar process near the top of Activity Monitor.

One sign on its own doesn’t mean your Mac is infected. A slow Mac is far more often a full disk or a stuck app.

How to check your Mac for viruses and remove them

Work through these steps in order. Most adware is gone by step four.

1. Check Activity Monitor

1. Open Activity Monitor from Applications › Utilities.
2. Click the CPU tab, then click the % CPU column to sort by usage.
3. Look for unfamiliar process names using a lot of CPU.

If you find one, search its exact name online before doing anything. Many oddly named processes are part of macOS. If a misbehaving app won’t close, see our guide on how to force quit on Mac.

2. Review login items and background apps

1. Choose Apple menu › System Settings.
2. Click General, then Login Items & Extensions (on macOS Ventura and Sonoma, it’s called Login Items).
3. Under Open at Login, select anything you don’t recognize and click the Remove button (–).
4. Under Allow in the Background, turn off items you don’t recognize.

3. Check for configuration profiles

Profiles can change your browser settings, network settings and more. Adware sometimes installs one.

1. Open System Settings › General › Device Management. On macOS Ventura, go to Privacy & Security › Profiles instead.
2. If you see a profile you didn’t install, and your Mac isn’t managed by your work or school, select it and click the Remove button (–).

If you don’t see the setting or the list is empty, no profiles are installed.

Warning: On a work or school Mac, don’t remove profiles. Ask your IT team first.

4. Remove suspicious browser extensions

• Safari: Choose Safari › Settings, click Extensions, select anything unfamiliar and click Uninstall. Then check the General and Search tabs to make sure your homepage and search engine are what you want.
• Chrome: Click the ⋮ menu, choose Extensions › Manage Extensions (or go to chrome://extensions), and click Remove on anything you don’t recognize.
• Firefox: Choose Tools › Add-ons and Themes, then remove unknown extensions.

5. Delete apps you didn’t install

Open your Applications folder and move anything suspicious to the Trash, then empty it. Some adware leaves support files behind, so our guide to deleting apps on Mac completely is worth following for stubborn ones.

6. Run a free scan for a second opinion

If you still see symptoms, run a scan with one of the tools below, then restart your Mac.

7. If problems persist

Change passwords for important accounts from a different, trusted device, starting with your Apple Account and email. As a last resort, back up your documents, erase your Mac and reinstall macOS, then restore your files rather than your apps.

Reputable free tools for checking a Mac

You don’t need to pay to get a second opinion.

Malwarebytes for Mac

Best for: A quick, free on-demand scan · Price: Free scanner, paid real-time protection · Website

The free version scans your Mac and removes adware, malware and unwanted programs whenever you run it. Real-time protection is a paid feature, and new installs typically start with a trial of it. When the trial ends, the free scanner keeps working.

Objective-See tools

Best for: Seeing exactly what’s set to run on your Mac · Price: Free and open source · Website

Objective-See is a nonprofit that makes free, open-source Mac security tools:

• KnockKnock scans your Mac once and lists everything installed to run automatically, like launch agents, login items and extensions, so you can spot anything out of place.
• BlockBlock runs continuously and alerts you when something tries to install itself to run at startup.
• LuLu is a free outbound firewall. Our guide to the Mac firewall explains how it complements the built-in one.

These tools show you raw information, so they suit people comfortable researching what they find.

Paid security suites

Full security suites for Mac are also available from companies including Intego, Bitdefender and Norton. They add real-time scanning and often extras like web protection or VPNs. If your employer or a client requires antivirus, or you want the extra layer, compare features and trial terms on their official sites. Avoid any app that shows up uninvited in a pop-up, claims your Mac is already infected, or asks you to turn off System Integrity Protection.

How to keep your Mac safe

These habits matter more than any antivirus app:

• Install macOS updates promptly from System Settings › General › Software Update.
• Keep automatic security updates on, including system data files and Background Security Improvements.
• Get apps from the App Store or the developer’s official website, not download portals or links in emails.
• Don’t use “Open Anyway” on apps you’re unsure about. If macOS can’t verify an app, that’s worth taking seriously.
• Ignore pop-ups that say your Mac is infected. Close the tab, or quit the browser if it won’t close.
• Keep the firewall on, especially on public Wi-Fi.
• Leave System Integrity Protection on.
• Use strong, unique passwords and two-factor authentication for your Apple Account.
• Review login items and browser extensions every few months.
• Back up regularly with Time Machine or a cloud backup service, so even a worst case is a minor inconvenience.

The bottom line

Your Mac already has antivirus. XProtect, Gatekeeper, notarization and System Integrity Protection cover most people well, as long as macOS stays up to date. Add a scanner if your work requires it or you regularly handle files from Windows users, and use the free tools above whenever something feels off.

For Apple’s own explanation, see Safely open apps on your Mac and About background updates in macOS.