Mac Security Test & Review 2025

Date	May 2025
Language	English
Last Revision	June 5th 2025

Release date	2025-06-13
Revision date	2025-06-05
Test Period	May 2025
Number of Testcases	899 Mac Malware 750 Mac PUA 500 Windows
Online with cloud connectivity
Update allowed
False Alarm Test included
Platform/OS	MacOS

Tested Products
Test Results
Product Reviews
Awards

Introduction

macOS has long enjoyed a reputation for robust security and is often seen as a “hardened” alternative to Windows. Although malware targeting macOS remains far less common than on Windows and Android, there have still been numerous real-world instances. In fact, attackers no longer regard Macs as secondary targets (https://www.macworld.com/article/670537/do-macs-need-antivirus.html, https://objective-see.org/blog/blog_0x7D.html). In 2023 and 2024, a surge of sophisticated information-stealers, most notably Atomic Stealer (AMOS), its fork Poseidon, and CloudChat, dominated new macOS threats. These cloud-controlled services harvest browser cookies, saved passwords, Keychain data, cryptocurrency wallet credentials, and even extract logins from popular password managers, VPN configurations, and FTP clients.

Distribution tactics have evolved accordingly, with threat actors now relying more on targeted malvertising campaigns and social-engineering schemes rather than user-installed adware bundles. Examples include cloned download sites offering “popular” Mac apps that instead serve up malicious disk images, deceptive Google ads, fake utilities (e.g., video-chat tools, VPN clients), trojanised installers, and phishing emails embedding PDF-masquerading apps. Consequently, both everyday users and enterprises must supplement basic vigilance with multi-layered defences: modern endpoint protection with real-time malware scanning, DNS and web filtering to block malicious ads, and EDR solutions to detect abnormal system behaviours before data is lost.

Out of the box, macOS delivers basic anti-malware capabilities. XProtect is Apple’s signature-based scanner that automatically checks new and modified apps against a database of known malware signatures and remediates infections. Gatekeeper ensures that only apps signed by verified developers and notarized by Apple can run on your Mac. Both features operate mostly in the background, with occasional configuration options and alerts. Complementing these measures, System Integrity Protection (SIP) locks down system-critical files and folders so that even system processes with root privileges cannot alter them. macOS isolates running processes through sandboxing and requires explicit permission for apps to access user files and other sensitive information, such as the camera, microphone, or location. By separating system files onto a read-only volume apart from user data, macOS further reduces the attack surface for malware. System and security updates are automatically installed through the standard macOS software-update process.

Apple’s approach might be adequate for well-established malware but might not respond quickly enough to emerging threats. Although the likelihood of harmful apps entering the App Store is low, any app that bypasses notarization will appear “safe” to macOS’s built-in protections. Third-party antivirus solutions with heuristic and behavioural engines can catch zero-day and fileless attacks that signature-only scanners might miss, while web- and phishing-protection browser extensions block malicious URLs before they load. Some Mac antivirus programs can also detect malware targeting other operating systems, such as Windows and Android, when it is inadvertently transferred between systems via an USB drive.

Experienced macOS users who carefully vet every download may feel their risk is low, but non-expert users, children, and those who frequently try new software could benefit from the extra layer of security a third-party antivirus provides.

Because macOS faces a smaller threat landscape than Windows, its market for anti-malware products is naturally more limited. Nevertheless, our annual Mac security tests consistently show that participating vendors are committed to threat research and continuous product improvement, delivering effective protection against evolving threats. We strongly encourage all security vendors to submit their solutions to independent, third-party evaluations, ensuring they meet current industry standards and user expectations. And for anyone worried that third-party antivirus might slow down their Mac, our tests found no meaningful impact on system performance with any of the reviewed products.

Best Practices for Enhancing Mac Security

As with Windows computers, Macs can be made safer by employing good security practices. We recommend the following:

Do not use an administrator account for day-to-day computing.
Use secure passwords (iCloud Keychain) or passkeys (biometric identification such as Touch/Face ID) and enforce multi-factor authentication wherever possible.
Deactivate any services such as Airport, Bluetooth, or IPv6 that you do not use.
Be careful about which programs you install and where you download them from.
Pay attention when granting programs permissions to sensitive system areas or information.
Be wary of opening any links that you receive via e.g., email.
Keep your macOS and third-party software up to date with the latest patches.
Regularly back up your data using Time Machine or another backup solution.
Use a VPN to secure your Internet connection, especially on public Wi-Fi networks.
Use a certified antivirus program for Mac to provide an additional layer of protection.
A list of antivirus programs for Mac can be seen here: https://www.av-comparatives.org/list-of-av-vendors-mac/

Tested Products

For this test, we used macOS Sequoia with the latest security patches, which was the most recent macOS version available at time of testing. The following products were reviewed and tested for this report, using the latest available versions as of May 2025:

Additional information about the products and additional third-party engines/signatures used inside the products: Avast, AVG, and Norton are products of Gen Digital and use the Avast engine. Intego uses the Avira engine for detecting Windows malware. Trellix uses the Bitdefender engine. Avast/AVG/Avira specifically asked us to test their free version.

We congratulate these manufacturers, who elected to have their products reviewed and tested, as we feel their commitment is a valuable contribution to improving security for Mac systems.

Test Procedure

This test checks how effectively the security products protect a macOS system against malicious apps. The test took place in May 2025, and used macOS malware that had appeared in the preceding months. We used a total of 899 recent and representative malicious Mac samples.

In the first half of 2025, thousands of unique Mac samples were collected. However, many of these could be classified as “potentially unwanted” – that is, adware and bundled software – depending on interpretation. Often, these samples were near-identical, with only minor modifications creating new file hashes to evade simple signature-based detection systems. After careful consideration, we selected 899 recent and prevalent Mac malware samples for testing, which we believe accurately represent the current threat landscape although this sample size is very small compared to Windows. However, it is significant given that most Mac systems do not use third-party security software and even a few threats can cause widespread damage. Because Mac security products only need to identify a small number of samples, we expect them to protect the system against most (if not all) of the threats, so the detection rate required for certification is relatively high. For the test, the macOS system was updated to its latest version and imaged. Each security product was installed on a fresh machine image, and its definitions were updated to May 8, 2025. The Mac systems remained connected to the Internet throughout the test to utilize cloud services. A USB flash drive containing the malware samples was inserted into the test machines, and some antivirus programs detected samples at this stage. We then scanned the flash drive, removing any detected samples. Undetected samples were copied to the Mac’s system disk and executed, giving the security products a final chance to detect them. Additionally, we tested for false positives using a set of clean Mac programs. None of the security products produced any false alarms.

To address the rising number of potentially unwanted applications (PUAs) on Mac systems, we conducted an additional test to evaluate the detection capabilities of the products. Specifically, we assessed the detection of 750 prevalent Mac PUAs using the same methodology as for malware detection. Many Mac security products assert that they can identify both Mac and Windows malware to prevent the user’s computer from transmitting harmful programs to Windows PCs. To test this claim, we evaluated if the Mac antivirus products can detect prevalent and current Windows malware. We used 500 Windows samples and followed the same procedure used for Mac malware detection, excluding any undetected samples since Windows programs cannot be executed under macOS.

Settings

All Mac consumer products were tested with default settings. Enterprise environments typically involve product configuration by a system administrator, following vendor’s guidelines. Therefore, we invited all vendors to configure their respective enterprise products accordingly. The scores achieved reflect performance under the specific settings detailed below.

CrowdStrike Falcon Pro: Everything enabled and set to “Extra Aggressive”.
Trellix: In “Malware Protection”, “Signature and Heuristic Detection”, “Cloud Lookup”, “Quarantine”, “Quarantine Malicious Archives” were enabled. “Exploit Guard” and all prevention actions were also enabled.

Test Results

The table below shows the protection results of the tested products. We would like to point out that while some products may sometimes be able to reach 100% detection rates in a test, it does not mean that these products will always protect against all threats. It just means that they were able to detect 100% of the widespread samples used in this test. We do not round up scores to 100% if there are misses. Programs with a score of 100% thus had zero misses. For PUA, the highest score possible is capped at 99% due to the nature of the files.

Product	Mac Malware Protection 889 samples	Mac PUA Protection 750 samples	Windows Malware Detection* 500 samples
Avast Free Security for Mac	100%	99%	100%
AVG AntiVirus Free for Mac	100%	99%	100%
Avira Free Security for Mac	99.3%	98%	100%
Bitdefender Antivirus for Mac	99.4%	99%	100%
CrowdStrike Falcon Pro for Mac	99.8%	98%	0%
Intego Mac Internet Security X9	97.1%	97%	100%
Kaspersky Premium for Mac	100%	99%	100%
Norton AntiVirus Plus for Mac	100%	99%	100%
Trellix Endpoint Security (HX) for Mac	99.4%	99%	100%
* Detection of Windows threats on Macs can be seen as discretionary. Some products do not include detection for non-Mac threats or have limited detection capabilities due to technical constraints

Product Reviews

Review Format

Here we have outlined the structure of the following product reviews for each of the consumer programs in this test. For the enterprise products we have used a slightly different review format which includes a brief product summary and sections about the cloud-based management console (e.g., dashboard, host management, detections, policies, investigation) as well as the endpoint protection client (e.g., deployment, general handling, alerts).

Summary: We briefly describe the nature of the product and highlight selected key aspects, such as whether it is free or paid, important security features, and our overall experience with it. Please note that all products protect against ransomware in the same way as for other types of malware. Where we have specifically mentioned “ransomware protection”, it means that specific user folders are monitored to prevent unauthorised changes.

Installation, Setup & Uninstallation: We describe how to get the product up and running on your Mac, starting with downloading the installer and finishing with any post-setup tasks needed, such as installing and enabling browser extensions. We record any options available, and whether you have to make any decisions during installation. There is also a note on how to uninstall the product, should you need to. Please be aware that when installing any antivirus product on macOS Sequoia (which was used for the tests and reviews), it is necessary to go into the macOS system settings and enable the program’s system extensions as well as grant the program specific permissions, such as Notifications or Full Disk Access. Since this process is essentially identical for all products, we have not mentioned it in the individual reviews.

General Handling & Essential Features: We consider how easy it is to find the most important functionality: protection status, different scan options, protection features, quarantine, subscription information (not applicable to free programs), update, settings, and help.

Protection: We describe the available scan options, including smart/full/custom scan, external storage scan, and scheduled scans, how and where to trigger them, and briefly mention any special detection settings that are enabled by default, e.g., detection of PUA or stalkerware. We might also give additional information about third-party detection engines and other relevant malware protection features, such as browser/email/ransomware protection.

Alerts: We look at how the current protection status is displayed, what sort of warning is shown if real-time protection or any other protection feature is disabled, and how to correct this. We also note what type of alert is shown when malware is discovered, and whether the user needs to take any action in this case.

Quarantine & Logs: We check the functionality that shows you which malicious items have been found, what information is provided about them, and what the actions are for dealing with them. If available from the program window, we will also note the types of data and events being logged by the program.

Advanced Options: We check whether only users with a macOS Administrator account can disable the protection features, uninstall the program, or restore/delete items from quarantine. We regard it as ideal if only administrators (not standard macOS users) can perform at least the first two tasks.

Avast Security for Mac

Summary

Avast Security Free for Mac offers a solid, user-friendly antivirus solution tailored for non-expert users. Its clean interface, straightforward setup, and reliable malware protection make it a good choice for Mac users seeking essential security without cost. Some of its key aspects are:

Effortless installation and setup of core features.
Modern, tile-based interface for easy navigation.
Various scan options and settings, including scheduled scans.
Clear and persistent alerts that keep users informed of any issues.
Administrative safeguards to prevent unauthorised changes.

Installation, Setup & Uninstallation

To set up the program, simply download and run the installer file available on the vendor’s website. The setup process is intuitive, with the program guiding you through each step and providing brief explanations along the way. You can uninstall the program via the macOS menu bar or by running the Avast Security Uninstaller directly from the macOS Applications folder.

General Handling & Essential Features

The main program window displays the protection status prominently, alongside quick access to smart scan, further scan options (Virus Scans), protection features (Core Shields), additional security features (e.g., Traffic Monitor, Network Inspector, Email Guardian), and quarantine. Settings (Preferences) are accessible via the program menu or the macOS menu bar. Subscription information is not applicable since the program is free. Manual updates can be initiated by clicking Check for updates under the system tray icon or program name in the macOS menu bar. Online help is available via the Help menu, directing users to Avast’s comprehensive support resources.

Protection

From Virus Scans on the home page, users can perform smart scans, deep scans encompassing all drives and system memory, external storage scans for connected devices, or targeted scans of specific files and folders. The latter can also be run from the Finder context menu. Scheduled scans and detection behaviours are customizable under Preferences; the detection of PUA is enabled by default. The Email Guardian scans emails of specified mail accounts for suspicious content. Note that the free version only supports mail apps installed on the Mac like Apple Mail and Microsoft Outlook. The Traffic Monitor provides insights into data transmission across apps, including the geographic locations of connected servers displayed on an interactive map.

Alerts

If real-time protection (File Shield) or web protection (Web Shield) within Core Shields is disabled, Avast displays a persistent alert in the main program window. To re-activate either protection feature, click Turn ON, which takes you to Core Shields to re-enable it.

When malware was detected during our protection test, an alert window appeared as depicted below. No user action was required, and the alert persisted until manually closed. Multiple detections are consolidated into a single alert, navigable via on-screen arrows. Expanding the details section at the bottom of the alert reveals further information, including the threat name, severity, file name/path, and associated process.

Quarantine & Logs

The quarantine is directly accessible from the home page and lists all isolated threats, along with details such as the threat name, file name/path, and detection date. Users can delete or, with administrative privileges, restore items.

Advanced Options

To enhance security, only users with macOS Administrator accounts can:

Disable protection features (under Core Shields).
Uninstall the program.
Restore items from quarantine.

Advertising

In-app messages inform about unresolved issues, such as ransomware vulnerability, network threats, and fake websites. When users attempt to address these flagged issues, Avast prompts them to purchase Avast Premium. If the initial upgrade offer is declined, a follow-up prompt appears, offering a 60-day free trial of Avast Ultimate as an incentive. Similar upgrade suggestions may also appear in detection alerts.

AVG AntiVirus Free for Mac