What is XProtect? Do Macs still need antivirus?

What XProtect is

Apple describes XProtect as macOS's "built-in antivirus technology" for the signature-based detection and removal of malware (Apple Platform Security, Protecting against malware in macOS). It's part of every Mac, it's on by default, and there's no app to open or switch to turn on.

It works from a list of signatures: descriptions of known malware, written in a format called YARA. According to Apple, XProtect checks for known malicious content whenever:

• an app is opened for the first time,
• an app has been changed on disk, or
• the signatures themselves are updated.

When it finds known malware, it blocks it, moves it to the Trash and tells you in Finder. Apple updates the signatures automatically, separately from macOS updates, and says macOS checks for them daily by default.

Apple also notes what XProtect doesn't do: it scans apps at first launch and apps that have changed, not every file on your disk.

The layers macOS already has

Apple's security guide describes three layers of malware defense: stop malware from launching, block it from running, and remove it if it has already run. These are the parts that do the work:

Apple's guide calls the remediation part "an engine that remediates infections" rather than naming it. On a Mac, its scanners sit inside XProtect's own app as separate tools named XProtectRemediator plus a malware family (Adload, Bundlore and so on), which is where the usual name, XProtect Remediator, comes from. Eclectic Light, which tracks these updates closely, found that the regular scan runs roughly once a day when the Mac is on mains power and not busy, and that laptops kept on battery can go a long time without one (Eclectic Light, September 2026). That's an independent finding, not Apple documentation.

Gatekeeper has one setting worth knowing. In System Settings › Privacy & Security, under Allow applications from, the default is App Store & Known Developers (that's the label on macOS 27; Apple's guides write it as "App Store and identified developers" or "App Store and Known Developers"). The stricter choice is App Store only. Since macOS 15 Sequoia, you can no longer Control-click an app to skip Gatekeeper's check; to open software Gatekeeper blocked, you go to Privacy & Security and click Open Anyway, which Apple says is available for about an hour after you tried to open it (Apple Developer, Updates to runtime protection in macOS Sequoia; Apple, Open a Mac app from an unknown developer).

How to check XProtect is up to date

The automatic updates setting

XProtect's signatures arrive with Apple's background security updates, so the setting that matters is the one that allows them. Open System Settings › General › Software Update and click the ⓘ button next to Automatic Updates. Then make sure this is on (Apple, About background updates in macOS):

• macOS 26 Tahoe and macOS 27: Install system data files and security updates. (Some of Apple's guide pages still use the older name; this is the label macOS 27.0.1 shows.)
• macOS 15 Sequoia: Install Security Responses and system files.

On macOS 26.1 and later there's one more switch: System Settings › Privacy & Security › Background Security Improvements, where Automatically Install should be on (Apple, About Background Security Improvements).

Eclectic Light also reports that, on macOS 15 and later, XProtect has a second update route over iCloud that runs whatever these settings say (Eclectic Light, How XProtect is updated). Keep the setting on anyway: it also covers the remediation engine and other security data.

See the version in Terminal

On macOS 15 and later, this prints the installed XProtect version and when it was installed. It only reads, and needs no password:

xprotect version

On our Mac, a MacBook with macOS 27.0.1, it printed:

Version: 5366 Installed: 2026-10-07 05:07:45 +0000

A version number on its own doesn't tell you much; the install date does. On our Mac it was six days old. If yours hasn't changed in months, check the automatic updates setting above. xprotect status shows whether launch scans and background scans are enabled.

The same command has check and update options. We don't recommend relying on them: Eclectic Light found they don't behave consistently across macOS 15, 26 and 27, and the update option needs administrator rights. If automatic updates are on, there's nothing to force.

Without Terminal

Hold the Option key, open the Apple menu and choose System Information. Under Software › Installations, look for entries named XProtectPlistConfigData, XProtectPayloads or XProtectCloudKitUpdate, and check the install dates (Apple Platform Support, Understand how XProtect works).

So, do you need antivirus?

For most people: no, if the basics are on

If you keep macOS up to date, leave automatic security updates on, keep Gatekeeper at its default and install software from the App Store or from developers' own sites, macOS already covers known Mac malware at the moment it matters: when something tries to run. We found no Apple page that recommends third-party antivirus for Macs; Apple's support pages mention antivirus software only in passing, for example when troubleshooting Time Machine or Migration Assistant.

When a separate tool makes sense

• Your employer requires it. Some organizations require endpoint security software for compliance, central reporting and response across many Macs. That's a fleet-management job XProtect isn't built for.
• You pass files to Windows users. Apple describes XProtect as checking Mac apps, so it isn't designed to flag a Windows virus sitting in an email attachment you're about to forward.
• You want a second opinion. If you suspect something got through, an on-demand scan from a reputable vendor is a reasonable check. Download it only from the developer's own site or the App Store.
• You often open software that Gatekeeper can't check, such as unsigned tools. A scanner adds a check there, though the safer habit is to avoid software you can't verify.

Habits that matter more than any app

1. Update macOS and your apps. Updates fix security bugs that malware could otherwise use. Here's how to update everything, including apps from outside the App Store.
2. Download from the source. The App Store or the developer's own website, not download portals or links in ads.
3. Take Gatekeeper's warnings seriously. If macOS says it can't check an app for malware, the safest answer is not to open it. Use Open Anyway only for software you trust and expected to be unsigned.
4. Be wary of installers you didn't go looking for, such as a "codec" or "player update" a website says you need.
5. Check what starts with your Mac. Unfamiliar items in System Settings › General › Login Items & Extensions are worth looking up.

And keep a backup. It doesn't stop malware, but it means no single bad download can cost you your files.

How Tend helps

Tend's free Security check shows whether FileVault, the firewall, Gatekeeper and System Integrity Protection are on, which XProtect and XProtect Remediator versions you have and when they last changed, and whether the automatic update settings that deliver them are on. It can also read the signature of every app in your Applications folder and every startup helper: it lists apps that don't come from a notarized developer or the App Store, and helpers that point at a missing file, aren't signed by an identified developer or run from an unusual place. Tend only reads these things and tells you where to change them. It isn't antivirus: it doesn't scan your files or remove malware. How the Security check works.

Questions

Related guides

Sources

• Apple Platform Security, Protecting against malware in macOS
• Apple Platform Security, Gatekeeper and runtime protection in macOS
• Apple Platform Security, System Integrity Protection
• Apple Platform Support, Understand how XProtect works
• Apple, About background updates in macOS
• Apple, About Background Security Improvements for iOS, iPadOS and macOS
• Apple, Safely open apps on your Mac
• Apple, Open a Mac app from an unknown developer
• Apple Developer, Updates to runtime protection in macOS Sequoia
• Apple, Protect your Mac from malware
• Eclectic Light, How XProtect is updated (August 2026)
• Eclectic Light, XProtect Remediator 163 doesn't run (September 2026)

Spotted something out of date? Tell us and we'll fix it.