Does a Mac need antivirus? An honest answer
· 6 min read
The question gets two unhelpful answers: “Macs do not get viruses”, which is untrue, and “you must install antivirus”, which is usually sold by someone with an interest.
The useful answer is that macOS already includes several layers of protection, and the threats that actually reach people are ones antivirus is poorly placed to stop.
What macOS already does
Gatekeeper checks that applications are signed by an identified developer and notarised by Apple before they run. Unsigned software produces a warning you have to deliberately override. Gatekeeper explained covers the warnings.
Notarisation means Apple has scanned the software for known malware before it is distributed.
XProtect is built-in malware detection, updated silently and regularly. It is antivirus, in the sense that matters, and it is already running.
The Malware Removal Tool removes known infections during updates.
System Integrity Protection stops even administrator accounts modifying protected system files.
App Sandbox and TCC limit what applications can reach. This is why applications must ask before using the camera, the microphone, or your Documents folder.
That is a genuinely layered arrangement, and it handles the traditional threat well.
What actually catches Mac users
The realistic risks are mostly not malware in the classic sense.
Fake support calls and pop-ups. A page claims your Mac is infected and gives a number to ring. Someone talks you into installing remote access software and paying them. No antivirus stops this, because you install it yourself and authorise everything. The fake support call covers how it works.
Phishing. A convincing email leads to a convincing login page and your Apple Account or bank credentials are gone. This happens in the browser, not in a file. Phishing that targets Mac users covers the specifics.
Fake downloads. Searching for a popular Mac application and clicking a paid result that leads to a lookalike site. The download runs and looks right. Gatekeeper helps when the software is unsigned, and some of these are signed with stolen or purchased certificates.
Browser extensions with broad permissions that read every page you visit. Browser extensions covers the risk.
Adware bundled with software you chose to install, often from a download site rather than the developer.
Notice how many of those involve you being persuaded rather than the machine being attacked. That is the shape of the Mac threat, and it is why judgement matters more than software.
So should you install antivirus?
For most people, no. The built-in protections cover the traditional threat, and the realistic risks are social. Third-party antivirus adds background load, wants deep system access, and occasionally causes its own problems.
There are reasonable exceptions:
If your workplace requires it, that is settled.
If you frequently handle files you pass on to Windows users, a scanner is a courtesy: Mac-harmless Windows malware can travel through you.
If you have already been caught by something, a one-off scan with a reputable on-demand tool is sensible. On-demand rather than always-on.
If someone in the household is a likely target and installs things without thinking, an extra layer may be worth the overhead.
What to do instead
The measures that actually reduce risk, in order.
- Keep macOS updated. Security updates are the single most valuable thing. Security updates: which ones you can safely defer.
- Get software from the developer or the App Store, never from a search advertisement.
- Use a password manager and unique passwords, so one breach is contained.
- Turn on two-factor everywhere it is offered.
- Turn on FileVault, for the stolen-laptop case. FileVault.
- Back up, which turns ransomware from a catastrophe into an afternoon. A backup plan that survives one thing going wrong.
- Be suspicious of urgency. Nearly every successful attack involves pressure to act now.
That list does more than any product.
If you think something is already on the machine
Check what runs at login, which is where most unwanted software installs itself:
ls -1 ~/Library/LaunchAgents /Library/LaunchAgents /Library/LaunchDaemons 2>/dev/null
And System Settings, General, Login Items. Then check browser extensions, and Profiles under Privacy & Security, since some adware installs a configuration profile.
What to do the hour after you think your Mac was compromised covers the full sequence.
Questions
Do Macs get viruses? Malware for macOS exists and is far less common than for Windows. “Virus” specifically is largely a historical category; the modern threat is adware, credential theft and social engineering.
Is the free antivirus in my router or ISP package useful? Generally marginal, and it will not stop the social attacks that matter.
Does using an antivirus slow my Mac? Always-on scanners do add overhead, which is one reason on-demand tools are the better choice when you want one at all.
What about ransomware? Rare on macOS and possible. A working backup is the answer, not a scanner.