The online world is still a dangerous place, but while antivirus vendors try to sell you subscriptions for their products, macOS is still secure enough for users to resist the products. The best antivirus for Mac is a combination of existing protections and user common sense.
Viruses and malware are a part of life online, with many reports detailing how various digital bad guys are badly affecting systems around the world. Both for individuals and organizations with stricter security practices.
In Windows, having some form of additional protection was, and still is, necessary, especially since it is the primary target for virus manufacturers. With a smaller user base, Mac was less of a target at first, but has become more prominent over the years.
What helped the Mac was its reputation for being highly immune to malware and viruses in general. That it was virus-proof in some way and you didn’t need an antivirus tool at all.
That’s still pretty much true today, up to a point. Apple includes various mechanisms in macOS that make it very difficult for malware to be a problem for the typical user.
This hasn’t stopped various companies from trying to provide additional security, declaring themselves in a way as the best antivirus for Mac.
Granted, it remains a target for viruses and malware, but certainly not in a way that Windows users need worry about. Although some of them are due to users being careful and thinking about how they act online, a large part still depends on the protection systems implemented by macOS.
This reputation for safety exists for good reason. Here’s why.
Porter
Of all the protections Apple has in macOS, Gatekeeper is the most visible to users. You will know it as the warning that appears whenever you download software from the internet and try to run it.
Gatekeeper is able to prevent malware from running on a Mac, placing several obstacles in the way that the user himself must circumvent.
Rather than looking for malicious code outright, Gatekeeper acts more like a nightclub bouncer, making sure the software has the proper permission to run.
Gatekeeper is a secondary defense against online dangers, after the user’s own sense of security.
Gatekeeper checks a downloaded app before running it for the first time, making sure it’s either from the Mac App Store or has a valid Developer ID and has been notarized by Apple.
If it’s from the Mac App Store, then the app has already gone through various checks through Apple itself, so Gatekeeper correctly assumes there’s little harm in that and allows the app to run.
When it comes from other sources, that’s where more checks come in.
The Developer ID is provided to the developer to indicate that they are a trusted creator of the app in the first place. Applying the certificate to the application is a way to ensure that it comes from that specific developer without any modifications being made to it.
The notarization part involves developers providing apps to an automated notary service operated by Apple, which verifies that the app is safe to run.
Think of notarization as the equivalent of Apple checking to make sure the application is correct and handing it over to the developer with a mark to indicate that particular executable is correct.
Apps with a valid and notarized Developer ID are authorized by Gatekeeper to run and are therefore trusted by macOS.
If an application package is interfered with by a malicious third party actor, it could affect either or both, the developer ID certificate or notarization security. In such cases, Gatekeeper would see a problem and stop running the application.
The problem is that it’s still possible for users to run apps that aren’t notarized by Apple on a Mac, or see warnings issued by Gatekeeper and press for the app to run regardless. It’s not hard to get around these Gatekeeper notices.
Unfortunately, this gives viruses and malware a chance to exist on macOS, which would otherwise be thwarted by Gatekeeper on the first instance.
That said, Gatekeeper’s protection has caught the attention of virus producers because if they can thwart this system, they have a head start in infecting the Mac. Occasional issues have occurred, but Apple is working to fix them as soon as they appear.
Apart from those rare occasions, Gatekeeper has been quite resilient and a very useful tool in the Mac security arsenal. At least as far as his powers stretch.
Gatekeeper can do a lot of the heavy lifting of maintaining Mac security. It simply cannot cover all eventualities.
System Integrity Protection
Another mechanism that comes into play is System Integrity Protection (SiP), which limits how an application can run on a Mac.
Specifically, it prevents malware from making changes to certain protected folders and files on the Mac. By restricting the root user account, the principal who has free administrative reign, SiP can help limit the damage caused by malware operating as if they were a root user.
Prior to OS X El Capitan, applications installed using an administrator’s username and password were granted root-level access, without any limitations. A malicious application with such rights would be able to affect important areas of the Mac’s operating system, and nothing would stop it.
You can check that SiP is enabled using the System Information app in macOS.
SiP protects a series of very important areas of macOS including the system folder, usr, bin, sbin, var, and pre-installed apps as part of macOS itself.
At the same time, SiP also allows third-party applications to write to the Applications, Library, and usr/local folders, which are typical areas that a legitimate application will need to access.
Under these protections, SiP will still allow changes to protected folders and files, but only within processes signed by Apple itself that also have specific rights to allow such activity. For example, Apple’s own software updates and installers are usually allowed to make changes through SiP.
Just as there are occasional gaps in Gatekeeper’s security history, there are minor issues in SiP, such as an October 2021 flaw that allowed app installer packages notarized by Apple to perform activities normally prohibited by SiP.
Again, Apple worked quickly to fix the issue before it became a real problem.
Apple Silicon
Another thing that Apple’s hardware manages to do well is the hardware itself. Apple’s change from Intel provided more than just performance benefits and more control over the entire system.
It also means Apple’s systems aren’t affected by the same chip issues that can plague Intel computers.
Take for example Meltdown and Spectre, which were exploits that exploited vulnerabilities in Intel chips. Apple computers that also used Intel chips were affected by the same vulnerabilities and therefore had to undergo various patches.
Apple Silicon can avoid Intel chip vulnerability issues, but Apple still has to deal with all of its chip design issues.
With the move to Apple Silicon, the Mac is no longer affected by the same processor-based vulnerabilities that Intel had to deal with, simply due to using different designs.
It’s not entirely a change that absolves Apple of having to deal with any chip issues. Researchers have already found their own problems with Apple Silicon.
The key here is that these are hardware issues that Apple can fix and manage on its own, without having to rely on Intel to come up with a fix. And also hardware issues that are not caused by third-party decisions, only Apple’s.
The best antivirus for Mac is user awareness
The problem with security features like SIP and Gatekeeper is that they can provide protection as far as they are allowed to go. If a user thinks they know more, they may be bypassing the restrictions and potentially allowing malware to run unhindered.
It’s not just in macOS, but just about everywhere. Although all protection functions can be made available, an indifferent user can do everything in their power to thwart these same systems.
For example, a well-secured Windows system with antivirus and firewall could be well protected. Except that the user can always disable both the antivirus and the firewall if they wish, leaving their PC vulnerable.
You’ll find that macOS is pretty secure on its own, without necessarily needing antivirus installed.
You can put a sandwich in an office refrigerator, in a rigid container wrapped with several layers of tape and with several notes stating that it is your sandwich and not to steal it. But you know deep down that the office thief will still eat your sub.
The best antivirus for Mac might just be the user themselves, because if they can remember to be careful about the things they download from the internet, they should be fine.
For example, it only makes sense to download apps from sources you trust. It could be the developer, an established marketplace, or better yet, the Mac App Store.
Next, pay attention to Gatekeeper’s warnings, as they should make you think twice about running the download in the first place.
And then there are the other obvious things, like being aware of the sites you visit, the links you click on, and the information you provide online.
If you’re vigilant, you can be pretty safe online with a Mac, without an antivirus installed.
That’s not to say you shouldn’t install antivirus on your Mac. They can be a handy backup, as a cognitive safety net, and could detect things that Apple’s own systems elude.
However, this is only if the user is careless in the first place. And even so, if they can bypass Apple’s protections, they will also bypass all other anti-malware tools installed on a Mac, even if they are securely locked down by the company’s security teams.
The best antivirus for Mac is to not be stupid in how you use it in the first place.
