What Is XProtect?
Your Mac has been scanning for malware this whole time. XProtect is Apple's built-in detection engine, it updates on its own, and most people have no idea it exists.
XProtect is signature-based malware detection built into macOS. Apple maintains the signature list, pushes it out separately from system updates, and it runs without any configuration from you. There's no interface, no icon, and no notification unless it catches something.
The three layers people mix up
Gatekeeper
Checks an app's signature and notarisation status the first time you open it. Its job is deciding whether an app is allowed to run at all. It isn't looking for malware itself.
XProtect
Compares files against Apple's signature list when they're launched or changed. If something matches, macOS blocks it and tells you the file will damage your computer. That specific wording is XProtect talking.
XProtect Remediator
Added in macOS Monterey and considerably more active. Rather than only blocking at launch, it runs scans in the background on a schedule, hunting for known malware families already present on the system, and removes what it finds. This is the closest thing macOS has to a traditional antivirus scanner.
Checking that yours is current
XProtect updates arrive through Apple's configuration data channel, which is separate from macOS updates. That means a Mac stuck on an older macOS version still receives current malware signatures, which is a good design.
See when yours last updated:
system_profiler SPInstallHistoryDataType | grep -A 2 -i xprotectOr check the bundle version directly:
defaults read /Library/Apple/System/Library/CoreServices/XProtect.bundle/Contents/Info.plist CFBundleShortVersionStringUpdates land every few weeks, faster when something is spreading. If yours is months behind, confirm that automatic updates are enabled under System Settings, General, Software Update, in the small Automatic Updates panel. Install Security Responses and System Files should be on.
Where it falls short
XProtect is signature-based, so it catches what Apple has already seen and named. Three gaps follow from that.
New variants. Infostealer families get repackaged constantly, sometimes weekly. Signatures lag behind by their nature.
Adware and browser hijackers. Much of this sits in a grey zone where it isn't malicious enough for Apple to block outright, and it's the most common real complaint Mac users have.
Things you approved. If you were persuaded to install something and clicked through the warnings, XProtect has limited say. The dominant infection route on macOS today is consent, not exploitation.
So what's left to do?
Given XProtect exists, the useful additional work isn't another resident scanner duplicating it. It's visibility into the things signatures don't cover: what persists at startup, what your browser is running, what configuration profiles are installed, and where your Mac is connecting.
That argument is made at length in do Macs need antivirus, and it's the reason we built an auditor rather than a real-time scanner.
See what XProtect doesn't cover
CleanMachine audits launch agents, browser extensions, hidden apps, shell scripts and configuration profiles, then shows live network connections with the country behind each one. No ClamAV, no Terminal, no background scanner competing with Apple's. Free to scan.
↓ Download Free & ScanIf XProtect blocks something you trust
Occasionally a legitimate developer tool trips a signature. Don't reach for the disable instructions. Open System Settings, Privacy & Security, and look for the Open Anyway button that appears shortly after the block.
Before you do, take the warning seriously enough to check where the file came from. Downloads from official sites are rarely the problem. Cracked software and files from aggregator download sites are exactly what XProtect exists for.