MacOS incorporates several built-in security features, including XProtect. Introduced in 2009 with macOS X 10.6 Snow Leopard, this antivirus technology uses a signature-based approach to defend against a malware attack. But is it enough?
Not quite. XProtect is one foundation towards securing your fleet, but you’ll also want additional security measures. We’ll explain what you should know about XProtect and how to use it.
How does XProtect work?
XProtect relies on YARA signature-based detection to find and remove malware. (YARA is an open-source tool developed by malware researchers to identify malware based on code similarities in malware families.) Traditionally, XProtect checks for malware when an app first launches, when it’s changed, or when its signatures are updated. Since it doesn’t provide continuous monitoring, it uses minimal system resources.
If XProtect detects known malware, XProtect blocks the malicious software, informs the user, and suggests they move it to the trash bin.
Apple continues to monitor threat intelligence and issue security updates accordingly, and macOS checks for relevant updates daily. XProtect also includes an engine to remediate infections with Apple’s automatic updates.
What is XProtect Remediator?
XProtect Remediator, introduced with macOS 12.3 Monterey in 2022, takes things to the next level by regularly scanning during periods of low activity. These scans are brief, so they shouldn’t significantly slow down performance. However, XProtect remediation takes a more proactive approach to malware detection and removal.
Is XProtect secure enough?
XProtect is a worthwhile tool, but it may not catch everything. Because it focuses on known malware threats, new or sophisticated malware could sneak past it. And some malware reportedly has. A researcher found that XProtect failed to consistently detect an AdLoad malware variant.
That’s why incorporating an additional third-party mobile threat detection, malware protection, or antivirus software is important. Features like continuous monitoring, advanced threat detection, and phishing detection can help fortify your security posture.
How do you enable XProtect?
XProtect should be enabled by default. But if you suspect someone may have tinkered with it, it never hurts to confirm XProtect is still doing its job.
To check whether XProtect is enabled (and enable it if it isn’t already), follow these simple steps:
In the upper left corner, click the Apple icon. Select System Settings from the drop-down menu.
Click General > Software Update.
Depending on your OS, click Advanced or the i inside a circle.
Confirm there’s a check next to Install system data files and security updates or that Install Security Responses and system files is toggled on (again, depending on your OS version).
Close the window.
How do you check the XProtect version?
Checking the XProtect version is easy on Mac. It’s even easier with SimpleMDM. Here’s how to get that information on a Mac computer:
Click Apple menu. Then, hold down Option while clicking Apple menu. Click System Information > Software > Installations.
Sort by name by clicking Software Name.
Scroll down to XProtectPlistConfigData.
Revel in your newfound insight.
If you’re using SimpleMDM, you can also just view the installed app inventory to see what version of XProtect is on your managed devices. It really is that easy.
How do you access XProtect?
You’re unlikely to need to access XProtect. However, if you can’t resist peeking at the malicious apps XProtect checks for, here’s how.
Go to Macintosh HD > Library > Apple > System > Library > CoreServices.
Control-click on XProtect.bundle, then click Show Package Contents.
Expand Contents > Resources.
Press the space bar. The XProtect.plist file should open and show what XProtect checks for.
How do you disable XProtect?
XProtect is important for keeping Macs safe. For that reason, we don’t recommend disabling XProtect on any Mac computer. But if XProtect is using too much CPU, memory, or battery power and you feel you simply must disable it, here’s how:
Open System Settings > Software Update.
Depending on your OS, click Advanced or the i inside a circle.
Remove the check next to Install system data files and security updates or toggle off Install Security Responses and system files (depending on your OS version).
Click OK.
There. You’ve weakened your security. We hope you’re proud of yourself.
Don’t get us wrong: XProtect is essential. But it shouldn’t be your only security measure. Effective Apple device management requires robust endpoint security and a powerful yet flexible MDM solution, such as SimpleMDM. Sign up for a free 30-day trial to take it for a spin.
