XProtect: the antivirus already on your Mac.
Every Mac comes with XProtect, Apple’s built-in protection against known malware. It works quietly in the background, which also means you rarely see what it checks. Here’s what it does, where it stops, and how to make sure it’s up to date.
Free · macOS 13 or later · Apple silicon and Intel
What XProtect does
Recognizes known malware
XProtect uses signature rules (YARA) that Apple writes for malware it has found, and updates them on its own schedule, separately from macOS updates.
Checks apps when they run
It checks an app when it’s first opened, when it has changed and when its rules are updated. If it finds known malware, macOS blocks it and offers to move it to the Trash.
Removes some infections
Recent versions of macOS also look for malware XProtect knows about in the background, and remove it.
Works with Gatekeeper and notarization
Gatekeeper and notarization check who signed an app and that Apple scanned it; XProtect looks for malware Apple already knows.
Where XProtect stops
- It only knows what Apple knows. New malware, or a variant changed enough to slip past the rules, can run until Apple adds signatures for it.
- Its updates depend on a setting. XProtect’s rules arrive as security responses and system files, so if Install Security Responses and system files is off in Software Update’s automatic updates, they can fall behind.
- You don’t see it work: there’s no XProtect window, no scan button and no report of what it checked.
How to check that XProtect is up to date
- Hold down Option, choose Apple menu → System Information, then open Software → Installations and look for recent entries whose names start with XProtect.
- Or run system_profiler SPInstallHistoryDataType in Terminal and look for the XProtect entries in its output.
- In System Settings → General → Software Update, click the info button next to Automatic Updates and make sure Install Security Responses and system files is on.
OpenNavo’s system check-up reads XProtect’s version and when it was last updated, warns you if it hasn’t been updated for over 30 days, and checks that security responses install automatically.
What OpenNavo adds
OpenNavo doesn’t replace XProtect. It adds the checks XProtect doesn’t tell you about:
Virus scans with ClamAV
Quick, full and scheduled scans with the open-source ClamAV engine, and a scan before anything you install through OpenNavo.
Startup items
Everything that starts by itself, with its signature and app, and an alert when something new appears.
Signature check-up
Installed apps’ signatures and notarization, with an alert if a developer signature changes.
Other Mac security apps in the catalog
These apps are listed in OpenNavo’s catalog too, if you want to compare. Each comes from its own developer and has no partnership with OpenNavo.
Questions
Is XProtect enough?
XProtect blocks malware Apple has signatures for and updates itself, so keep it on and up to date. It can’t catch what Apple hasn’t added yet, though, and it doesn’t show you what it checked. A second scanner and a look at your startup items add the checks it doesn’t make.
Can I turn XProtect off?
There’s no setting for it in System Settings. It’s part of macOS and protected along with the rest of the system.
Where is XProtect on my Mac?
Its rules live in /Library/Apple/System/Library/CoreServices/XProtect.bundle, which macOS protects from changes. You don’t need to open it: the update history above shows when it last changed.
How is XProtect different from ClamAV?
Both match files against signatures of known malware, but they’re separate. XProtect uses Apple’s own rules and runs automatically; ClamAV is an open-source engine with its own database that runs when you scan. OpenNavo scans with ClamAV and shows XProtect’s status.
More on Mac security
See what XProtect doesn’t show you.
OpenNavo’s free system check-up shows whether XProtect is up to date, next to 10 other macOS security settings.
brew install --cask opennavo