Do Macs need antivirus? An honest answer

Two camps, both wrong. One says Macs cannot get malware, which stopped being true a long time ago. The other sells you a subscription for a threat model that does not match how Macs actually get compromised.

What is true: macOS ships with several layers of protection that most people do not know are running, and the most common way a Mac gets infected is a user typing their password into an installer they went looking for.

What you already have

Gatekeeper checks that an app is signed by an identified developer and has been notarized by Apple before it will open. Check it is on:

spctl --status

You want assessments enabled. If it says disabled, someone turned it off, and turning it back on is one command with sudo.

XProtect is Apple’s built-in malware scanner. It has a signature list, it updates silently in the background, and it scans on launch. It is real antivirus, and it is already running. The version updates every few weeks — mine is on 5286 as I write this, which tells you how actively it is maintained.

XProtect Remediator goes further, running periodic scans for known families and removing what it finds, without any interface at all.

Notarization means Apple scanned the app before the developer could distribute it. Not a guarantee, but it removes the easiest attack.

System Integrity Protection and the sealed system volume mean malware cannot modify macOS itself, even with your password.

That is a genuinely serious stack, and it is the reason the honest answer for most people is that a third-party scanner adds little.

Where the protection ends

Every one of those layers can be defeated by a person clicking through it. The common real-world routes onto a Mac:

Fake installers. You search for an app, land on a site ranking above the real one, and download something that looks right. It asks for your admin password, which is normal for an installer, so you give it. Gatekeeper is satisfied because the thing is signed with a certificate the attacker bought and will abandon next week.

Cracked software. The single most reliable way to get malware on a Mac. The crack has to disable a check, so it has to run code, and you have already agreed to trust it.

Browser extensions. They run inside the browser, so none of the layers above apply. They can read every page you visit.

Phishing. No malware involved at all. Nothing on your Mac protects a password you typed into a convincing page.

Notice that a signature-based scanner does not help with most of that. The last two are not malware in the sense antivirus understands.

What actually helps

In descending order of effect:

1. Install from the developer’s own site or the App Store. Check the domain before downloading. This one habit removes most of the risk.
2. Never use cracked software. No exceptions worth arguing about.
3. Audit your browser extensions. Remove anything you do not actively use and cannot name the author of.
4. Keep macOS updated. Security fixes ship constantly, and XProtect definitions arrive with them.
5. Use a password manager and turn on two-factor. This addresses the phishing case, which is the one most likely to actually cost you something.
6. Do not disable Gatekeeper or SIP because a forum post told you to.

Checking whether something is already wrong

Malware on a Mac usually needs to survive a restart, which means it has to be in one of a small number of places:

ls -la ~/Library/LaunchAgents /Library/LaunchAgents /Library/LaunchDaemons

Look for entries you cannot connect to software you installed deliberately. On this machine that is seven, six and fourteen entries respectively, and all of them belong to apps I recognize.

Also worth checking: System Settings → General → Login Items, and your browser’s extension list. Between those and the folders above, you have covered where persistence lives.

So should you buy something?

For most people, no. Keep Gatekeeper on, install from real sources, avoid cracks, and you are covered better than a scanner would cover you.

There are exceptions. If you administer Macs for other people, you want central visibility. If you handle files from strangers all day, an on-access scanner earns its place. If you are required to run one for compliance, that decision is already made.

What is not worth buying is anything that opens with a scary number and a countdown. That style of product has been the dominant form of Mac “security software” for a decade, and the number is theater.

For what it is worth, CleanSpace includes a malware check that looks for known adware families and reviews your launch agents and login items — the same places listed above. It is not real-time protection and it does not pretend to be. It is a periodic look at the handful of locations where persistence lives, which is the check most people never run.