Security

Is my Mac secure? Check it yourself, in five minutes

By the Noah team·Updated August 25, 2026·8 min read
Short answerYour Mac ships with five protections. Three are on unless someone turned them off; two depend on how your Mac was set up. You can check all five yourself:
  • Gatekeeper — refuses to open apps that aren't signed by a known developer.
  • System Integrity Protection — stops anything, including you, from altering the parts of macOS that matter.
  • FileVault — scrambles everything on your disk, so a stolen Mac is a brick.
  • XProtect — Apple's built-in malware scanner, updated quietly in the background.
  • The firewall — controls what's allowed to reach your Mac over the network.
Those five handle known malware, which is why Macs rarely get viruses in the old sense. They do not cover the thing you installed yourself — an extension, a profile, an app that starts at login. That is what actually goes wrong on a Mac, and it's the second half of this guide.

You searched this because something felt off, or because a page told you your Mac was infected. Almost always, the page was the problem.

Ten-second triage: if you're seeing pop-ups, a browser that opens to a search page you didn't choose, or ads where ads don't belong — that's adware, and it's real. If you just want to know where you stand, start at the top and run the five checks.

First, measure

Open Terminal (⌘ Space, type Terminal, Return). Four commands answer most of the question. None of them change anything — they only report.

Gatekeeper

Your Mac checks every app the first time you open it, and refuses anything that isn't signed by a developer Apple knows. That check is called Gatekeeper.

zsh — Terminal
% spctl --status
Sample result
assessments enabled

“Enabled” is what you want. If it says disabled, someone turned it off — that's a real finding.

System Integrity Protection

macOS keeps its own core files locked away from every program on the machine, including ones you run as an administrator. This is System Integrity Protection, usually shortened to SIP. It's the reason a bad app on a Mac can annoy you but rarely takes the system over.

zsh — Terminal
% csrutil status
Sample result
System Integrity Protection status: enabled.

Should say enabled. Disabling it takes a deliberate trip through Recovery mode, so if yours is off, it was turned off on purpose — by you, or by software you installed.

FileVault

Every modern Mac encrypts its disk in hardware whether you ask it to or not. What FileVault adds is the part that matters: it ties the key to your password, so the disk stays locked until someone signs in. With FileVault off, the encryption is still there, but the Mac unlocks itself on its own — so the protection is only as good as your login. This is the one worth turning on today if it's off.

zsh — Terminal
% fdesetup status
Sample result
FileVault is On.

If it's off, turn it on in System Settings > Privacy & Security > FileVault. On modern Macs it costs you nothing in speed — save the recovery key somewhere safe when it offers.

The firewall

The firewall controls what's allowed to connect to your Mac from the network around it.

zsh — Terminal
% /usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate
Sample result
Firewall is enabled. (State = 1)

Off is common and not alarming on a home network — your router already refuses unexpected incoming connections before they reach the Mac. Worth turning on in System Settings > Network > Firewall if you use public Wi-Fi, where there is no router of yours in the way.

XProtect

Apple ships a malware scanner inside macOS called XProtect, and updates it quietly in the background — no subscription, no icon in your menu bar. You mostly can't tell it's there, which is the point.

zsh — Terminal
% system_profiler SPInstallHistoryDataType | grep -A2 XProtect
Sample result
    XProtectPlistConfigData:

      Version: 5325
      Source: Apple

The version number climbs on its own as Apple ships new signatures. Seeing a recent one means the scanner is current.

Healthy readings mean the built-in defences are doing their job, and no product you can buy improves on that list. They don't mean nothing is wrong — they only cover malware Apple already knows about. What follows is the half they can't cover, because you let it in yourself.

Configuration profiles

Your browser opens to a search engine you didn't choose, and changing it back doesn't stick.

A configuration profile is a settings file that can change your Mac's behaviour from the outside — the mechanism a workplace uses to manage a fleet of company laptops. Adware abuses it, because a profile can force your browser's homepage and search engine and then prevent you from changing them back. This is the single most reliable sign of adware on a Mac.

zsh — Terminal
% profiles list
Sample result
There are no configuration profiles installed for user 'x'

This is the healthy answer on a personal Mac. If your Mac is managed by an employer or school, you'll see their profiles here — that's expected.

FixSystem Settings > General > Device Management, select any profile you didn't install and don't recognise, and remove it. Then reset your browser's homepage and search engine.

Browser extensions

Ads on pages that never had ads, new tabs you didn't open, a search bar you didn't add.

This is how Macs actually get compromised. Not a virus — an extension you installed on purpose, for a coupon finder or a PDF converter or a video downloader, that reads every page you visit. Extensions are granted enormous access, and the popular ones get bought and quietly repurposed.

Fixopen your browser's extensions page — Safari > Settings > Extensions, or chrome://extensions — and remove everything you didn't deliberately install and don't actively use. Be ruthless; nothing here is precious.

What loads when you log in

Your Mac is slow from the moment it starts, and things you don't recognise are already running.

Apps can register themselves to start automatically. Most are legitimate and just accumulate over years. Some aren't — and a program that starts itself every login is a program that doesn't need you to run it.

zsh — Terminal
% ls ~/Library/LaunchAgents
Sample result
com.google.GoogleUpdater.wake.plist
com.google.keystone.agent.plist
<one file per background item>

Each file is one thing that starts on its own. Recognisable vendor names are normal — an updater for software you installed. Names that mean nothing to you are worth searching.

FixSystem Settings > General > Login Items & Extensions. Remove what you don't recognise from the top list, then scroll to the background items underneath — that's where the ones that never asked you live.

NoahThis is where Noah tends to find the actual problem. On one real Mac it found 14 login items loading at startup; on another, 28 apps starting at login and dragging the whole machine down.

The antivirus question

Your Mac got slower after you installed security software.

Antivirus on a Mac inspects every file your machine touches, which means it is always running and always working. On top of the five protections already built in, it usually buys less than it costs.

There's a second problem: much of what's sold as Mac security software is the thing it claims to protect you from. If it found problems before you asked it to scan, or it wants payment to fix what it found, that's the tell.

NoahIn one real session Noah found a customer's antivirus running seven separate processes on a Mac mini — one of the named culprits behind the slowness they'd asked about.

Fixif you didn't install it deliberately, remove it. If you did and your Mac has been slow since, open Activity Monitor and sort by CPU to see what it's actually costing you.

What a real problem looks like

Worth knowing, so you can tell a genuine sign from a scare:

  • A configuration profile you didn't install.
  • A browser homepage or search engine that reverts every time you change it.
  • Pop-ups that appear when no browser is open.
  • An admin password prompt from something you didn't start.
  • Gatekeeper or System Integrity Protection reporting disabled when you never turned them off.

Not signs of a problem: a web page saying your Mac is infected (a web page cannot scan your Mac), fans running loud, a full disk, or a Mac that's simply gotten slower — those are ordinary and have ordinary causes.

The short version

  1. Run spctl --status, csrutil status, and fdesetup status — all three should say enabled or on.
  2. Run profiles list — anything you didn't install is your answer.
  3. Remove every browser extension you don't actively use.
  4. Check Login Items & Extensions, including the background list underneath.
  5. If you installed antivirus, check whether it's what's slowing you down.
Try Noah free

A Mac you can stop worrying about.

Just tell Noah what's wrong:

Is my Mac secure?
Check my Mac freeFirst conversation free7-day free trial afterOnly with your OK

Already have Noah? Open it on this problem →

Frequently asked questions

Do I need antivirus on a Mac?

For most people, no. macOS ships with Gatekeeper, System Integrity Protection, Apple's own XProtect malware scanner, and optionally FileVault and the firewall. Third-party antivirus adds constant background scanning on top of that, and often costs more in speed than it buys in safety. What it does not protect you from is the real risk on a Mac: adware, browser extensions, and configuration profiles.

How do I know if my Mac has a virus?

Check for the specific signs rather than guessing: a configuration profile you did not install (run profiles list), a browser homepage that reverts every time you change it, pop-ups when no browser is open, or Gatekeeper and System Integrity Protection reporting disabled when you never turned them off. A web page claiming your Mac is infected is not evidence — a web page cannot scan your Mac.

How do I check if FileVault is on?

Run fdesetup status in Terminal. It answers 'FileVault is On.' or 'FileVault is Off.' Modern Macs encrypt the disk in hardware either way; what FileVault adds is tying the key to your password, so the Mac stays locked until someone signs in rather than unlocking itself. Turn it on in System Settings > Privacy & Security > FileVault, and keep the recovery key somewhere safe.

What is a configuration profile and why does it matter?

A configuration profile is a settings file that changes your Mac's behaviour from the outside. Employers and schools use them legitimately to manage company machines. Adware abuses them, because a profile can force your browser's homepage and search engine and stop you changing them back. On a personal Mac, a profile you did not install is the strongest single sign of adware. Check with profiles list, and remove them in System Settings > General > Device Management.

Why does my Mac say an app can't be opened because it's from an unidentified developer?

That is Gatekeeper doing its job. macOS refuses to open apps that are not signed by a developer Apple recognises. If you are certain the app is safe and you know where it came from, you can allow it in System Settings > Privacy & Security. If you are not certain, the refusal is the right answer — leave it.

Can Noah tell me if my Mac is secure?

Yes, for the software side. Noah checks the built-in protections, what loads at login, and what is running in the background, and explains in plain English what it finds — including when the answer is that nothing is wrong. It will not manufacture problems to justify itself, and it will not remove anything without your approval.

Keep readingWhy is my Mac so slow? The real causes →Connected to Wi-Fi but nothing loads →

Commands in this guide are standard, read-only macOS diagnostics unless noted; anything that changes your system is called out. When in doubt, back up first with Time Machine.