Do Macs need antivirus?

1What's built into every Mac

XProtect checks for known malicious content when an app is first launched, when an app changes in the file system and when its rules are updated. Apple updates the rules daily, a second engine removes known malware and keeps checking periodically, and a third looks for unknown malware by its behaviour (Apple Platform Security: XProtect).

Gatekeeper asks for your approval before downloaded software opens for the first time. It checks that the software is from an identified developer, hasn't been altered and was notarized (Apple Platform Security: Gatekeeper).

Notarization means the developer sent the software to Apple, which scanned it for known malicious content before it was published. Apple notes it is effective against known files.

So yes: if you searched for "mac antivirus built in", that's XProtect. It runs by itself; there's nothing to open.

2Make sure it's switched on

Open System Settings → General → Software Update, click the ⓘ next to Automatic Updates and turn on Install Security Responses and system files. That keeps XProtect's rules current.

While you're there:

• System Settings → Privacy & Security → FileVault: on, so a lost Mac doesn't give up your files.
• System Settings → Network → Firewall: on.
• Privacy & Security → Allow applications from: App Store & Known Developers (on older macOS: App Store and identified developers).

3What gets past it in 2026

Apple's layers check files. Many of 2026's attacks on Macs don't need a file you open:

• Commands you paste. Fake AI tool pages and "clean up your Mac" ads talk people into pasting a line into Terminal that installs a stealer (The Hacker News, 16 March 2026). A script piped into the shell is never opened as an app, so Gatekeeper never asks. See the Mac check.
• Signed and notarized malware. In December 2025 Jamf found a MacSync dropper that was a signed, notarized app, so it ran without being blocked; Apple then revoked its certificate (The Hacker News, 24 December 2025). Protection arrives after Apple learns of a file, not before.
• Fake sites and look-alike addresses. A phishing page or a poisoned wallet address involves no malware at all. See crypto wallet safety.
• Services you left open. LeakIX found 12,269 Ollama servers on the public internet with no authentication in February 2026 (LeakIX, 23 February 2026). If you run a local AI server, keep it on your own Mac (127.0.0.1), not on every network.

4When a Mac needs more

Built-in protection plus good habits is enough for most people. Consider more if you hold crypto you can't afford to lose, run AI agents that can read your files and keys, or handle other people's data.

What "more" can mean:

• Free, single-purpose tools from Objective-See: LuLu (an outbound firewall), KnockKnock (lists everything that starts by itself) and BlockBlock (alerts when something installs itself to start automatically).
• A paid security suite, if you want web filtering and real-time scanning. Pick one with a clear privacy policy, and know that it can't undo a command you've already pasted.
• Work Macs: use what your employer provides.
• Crypto: a hardware wallet, so your keys never touch the Mac.

5Free checks you can do today

• Pasted a command in Terminal? Check your Mac: ten minutes, by hand.
• Crypto wallet safety: recovery phrases, clipboard swaps, address poisoning.
• Keep macOS and your browser updated; most attacks use holes that are already fixed.
• Install apps from the App Store or the developer's own site, never from an ad.

6Questions

Does a Mac have a built-in antivirus?

Yes. XProtect is built into macOS: it checks apps when they first open, when they change and when its rules update, and it removes known malware in the background. Gatekeeper and notarization check downloads before they first open.

Do Macs need antivirus in 2026?

Most people don't. Keep automatic security updates on, install software from sources you know, and never paste Terminal commands from web pages. Consider more protection if you hold valuable crypto or run AI agents with access to your keys.

How do I run a virus scan on my Mac?

There's no scan button: XProtect checks apps by itself and keeps checking in the background. To check by hand for what it can miss, follow the steps on Pasted a command in Terminal? Check your Mac.

Is there a free malware scanner for Mac?

XProtect is free and always on. Objective-See's free tools, such as KnockKnock, list what starts by itself on your Mac. The manual check on this page covers the places stealers hide.

What's the best antivirus for Mac?

MLX doesn't sell one, so here's the honest answer: for most people, the built-in protection with automatic updates on is enough. If you want more, choose a product with a clear privacy policy and real-time scanning, and keep the habits on this page either way.