You might wonder why anti-malware software is not on the list of things to install on a Mac. After decades of using anti-malware software, some of it quite sophisticated, I don’t think any package’s benefits outweigh the cost in terms of price, false positives, and system load.
Anti-malware software has a distinct weakness: it can’t protect against unknown threats. It’s 100% designed to keep out-of-date systems protected from well-known viruses and the like, and to safeguard an up-to-date system as quickly as possible from malware that has just been discovered and characterized. If you keep your Mac up to date and never install software of any kind from the internet (besides the App Store) or software handed to you by other people, you can probably forgo anti-malware software, as it has no real path to find you.
For everyone else, it’s worth considering. While a portcullis doesn’t protect a castle when it’s open, cutting the rope and dropping it is an effective way to keep hordes from rampaging through that front door. Likewise, automatic updates and scanning are terrific ways to ensure you aren’t caught out by a prior or current exploit.
What antivirus software cannot catch
You’d think with all the AI in the world and decades of research about viruses, there should be a way to detect malicious behavior and shut it down. And yet that’s still largely a dream, with one exception for ransomware that I describe below.
Instead, anti-malware software’s virus-protection portion largely relies on the same technology it has for decades. A hash is made of a malicious payload—in just the same way that Apple creates a cryptographic summary of legitimate software—and stored in a list. When the anti-malware app scans a drive for bad actors, it generates a signature of each item it finds and compares it against its stored list, which is frequently updated.
The best current anti-malware software helps you with five distinct issues:
- Known malware: Blocking already known and extant malware, including routinely scanning files on your Mac, volumes you mount on your Mac, and attachments that arrive via email
- Phishing websites: Blocking phishing websites and those that host links to malicious software, either loaded in the browser or as downloads
- Behavior alerts: Identifying dubious behavior that might be fine, but you should review to be sure, such as opening a file or accessing a folder in an unexpected location
macOS requires you to grant permission the first time an app attempts to access files in certain locations, which is a coarse but useful version of this. See how to control which apps use your Mac camera and files.
- Ransomware: Blocking ransomware activities based on the way that ransomware functions, discussed below
- Windows malware: Preventing you from passing Windows viruses on to someone else
Ransomware is the exception
Ransomware is the odd one out in this whole discussion. While being the biggest likely threat to Mac users, it’s also by far the easiest to track. Ransomware operates by suddenly creating a mass of new, encrypted files and deleting ones with similar names. It’s rarely sophisticated; it just has to be launched by a user or through some method that lets it insert itself and run.
Some anti-malware software can detect this broad category of behavior because it’s so specific, and can lock down folders and prompt your response before more than one or a handful of files are locked away.
Windows malware on a Mac
macOS can’t run malware that’s written for Windows machines, so even if a Windows virus appeared on your drive, it wouldn’t do any damage; it would simply be inert.
Mac anti-malware apps, however, do identify, quarantine, and remove Windows malware, because of the chance you might pass it on via email or as part of an infected Microsoft Office document to someone else who uses Windows.
And even though macOS isn’t Windows, you can run Windows via virtualization software like Parallels Desktop. Mac anti-malware software won’t protect you there, so you should absolutely run Windows anti-malware software within your Windows installation.
