CyberIndexBeta

Product

XProtect is the antivirus technology built into macOS, using signatures that Apple updates automatically to detect and remove known malware. The first layer of defense is designed to inhibit the distribution of malware, and prevent it from launching even once—this is the goal of the App Store, and Gatekeeper combined with Notarization. This process can very quickly block malicious apps because checks for revocation tickets happen in the background much more frequently than even the background updates that push new XProtect signatures. macOS includes built-in antivirus technology called XProtect for the signature-based detection and removal of malware. It is recorded as supporting malware detection.

Current Version
5368
Market
ConsumerEnterpriseSMB
Licence
Free
Price
Free
Record Created
2026-08-20
Last Updated
2026-10-28

Vendor

Apple does not sell security software. The protections listed here are built into macOS and shipped with every Mac, which makes them the baseline any third-party product on that platform is competing against rather than products a buyer chooses. Three of them appear in this index. XProtect is the malware signature system Apple updates silently in the background; Gatekeeper checks that an application has been signed by an identified developer and notarised by Apple before it will run; and the built-in firewall controls incoming connections. Alongside them sit System Integrity Protection, the signed system volume and app sandboxing, which are architectural rather than detection features and are not listed separately. Apple publishes no detection rates and does not enter its protections into the public test laboratories, so the laboratory columns here will stay empty for them. That is not a gap in the product: it is a company that treats platform security as part of the operating system rather than as a product to be benchmarked. Vendor page →

Website
apple.com
Country
United States
Headquarters
Cupertino, United States
Year Established
1976
Customers
500K organisations
Users
2.5B devices protected
Revenue
$416.2B (2025)

Platforms

macOSnative

Target Market

Consumer primaryEnterprise secondarySMB secondary

Capabilities

Malware Detectionkeynative
Ransomware ProtectionkeyNot known
Behavioral DetectionkeyNot known
Web ProtectionkeyNot known
Email ProtectionNot known
Host FirewallNot known
Sandbox AnalysisNot known
Cloud-Assisted ScanningNot known
Heuristic DetectionNot known
Device ControlNot known
Vulnerability ShieldingNot known
Central Management ConsoleNot known

11 of 12 not yet known — not recorded, which is not the same as not supported.

Pricing

PlanLicencePriced perBilledPrice
SummaryFreenot statedno recurring chargeFree

Versions

  • 5368macOS

The newest release each source names per platform, not every release the vendor has shipped. A release date is shown only where one is recorded.

Independent Tests

Not tested This product does not appear in any test run CSI holds. That is not a low score.

Certifications

OESIS Framework SupportSupported1 activeSupported

Change History

This record was created 2026-08-20. Everything below is what has changed since.

  • 2026-10-28New versionNew version: 5368 (macOS)evidence
  • 2026-10-10Product updatedSold to: Consumerevidence
  • 2026-10-08New versionNew version: 5366 (macOS)evidence
  • 2026-10-06New versionNew version: 5363 (macOS)evidence
  • 2026-09-30New versionNew version: 5362 (macOS)evidence
  • 2026-09-25New versionNew version: 5360 (macOS)evidence
  • 2026-09-22Product updatedListed in Enterprise Antimalwareevidence
  • 2026-09-22Product updatedListed in Small Business Antimalwareevidence
  • 2026-09-22Product updatedListed in Free Antimalwareevidence
  • 2026-09-22Product updatedListed in Home Antimalwareevidence
  • 2026-09-19Product updatedAlso sold to: SMBevidence
  • 2026-09-09New versionNew version: 5358 (macOS)evidence
  • 2026-09-08New versionNew version: 5358evidence
  • 2026-08-20Certification addedCertified: OESIS Framework Support (Supported)evidence
  • 2026-08-20Capability addedMalware Detection: built inevidence
  • 2026-08-20Pricing plan addedPrice: freeevidence
  • 2026-08-20Product updatedAlso sold to: Enterpriseevidence
  • 2026-08-20Product updatedAlso sold to: Consumerevidence
  • 2026-08-20New versionNew version: 5355evidence
  • 2026-08-20Platform addedRuns on macOSevidence
  • 2026-08-20Product createdNew product listedevidence

May we count your visit? CyberIndex would like to use Google Analytics to see which pages are read. It sets cookies and sends your visit to Google. Decline and nothing is loaded — the site works the same either way. Privacy.