

This means that even the newest malware should be identified by XProtect, although Apple isn’t always as fast at getting this information updated as other antivirus solutions are. Updates to XProtect are pushed out frequently and macOS automatically checks for updates daily–a Mac user doesn’t even need to do anything as these updates are separate to macOS updates. XProtect will scan an app the first time it launches and it will scan the app every time there is an update issued for it. However, you should be aware that even legitimate software has been known to conceal malware.Įven if the developer is recognised by Apple, the software will still be checked against a list of known malware in XProtect. See: How to open a Mac app from an unidentified developer. If you know that the software is from a legitimate developer you can override this and open the app. If Gatekeeper detects that the app has no notorization to prove the developer is certified by Apple, a message saying the app can’t be opened because of your settings will be displayed. Unfortunately in the past there have been apps that slipped through this process because a certificate was present, such as the case of the Shlayer malware, but Apple has ramped up security since and changes to notarized apps are pushed out as required. If you choose to allow installations from identified developers then Apple will look for evidence that the app is notarized and it will also verify that the app hasn’t been tampered with and no malware is present. If you prefer to allow installations from outside the Mac App Store follow the same steps but choose App Store and identified developers from the options. Under Allow applications downloaded from select App Store.Scroll down to Security and select App Store below Allow applications downloaded from.If you want to make sure your Mac can only install apps from the Mac App Store these are the steps to follow:

If you only install apps from the Mac App Store, or notarised apps from identified developers, you should be safe, but sticking to the Mac App Store is the safest option as apps on the Mac App Store can’t be tampered with. As long as the app has passed Apple’s tests it will have a Notarisation ticket, which Gatekeeper looks for before telling macOS that it is safe to open. An identified developer is one whose software has been scanned by Apple to ensure it is safe. Mac users can choose to only install apps from the Mac App Store, which is the safest option as it mean that the app has been thoroughly checked by Apple before being distributed.Īlternatively there is an option to install apps from the Mac App Store and from identified developers. Apple makes it hard to install an app that might not be safe on a Mac.
