Description:

XProtect is the built-in antivirus and malware detection system in macOS. It operates transparently in the background and automatically checks files against a database of known malware signatures when an app is first opened, when it changes, and during periodic background scans. Apple updates XProtect definitions automatically, separately from full macOS updates, without user interaction. It works alongside Gatekeeper and Notarization to provide layered malware protection.

Rationale:

XProtect is the first line of defense against known macOS malware. It automatically scans files for known malicious signatures and blocks execution of detected malware. Apple regularly updates XProtect definitions to address new threats. Verifying that XProtect definitions are current and active ensures the device is protected against the latest known malware threats without requiring third-party antivirus software.

Impact:

  • Automatically detects and blocks known malware before it can execute.

  • Operates silently in the background with minimal impact on daily use.

  • Definitions update automatically — no manual intervention required.

  • Works in conjunction with Gatekeeper and Notarization for comprehensive protection.

  • Cannot be turned off by the user — its definitions are updated by Apple separately from full macOS updates.

Default Value:

XProtect is enabled by default on all macOS devices and cannot be manually disabled. However, its definitions may become outdated if automatic security updates are turned off or blocked, or if the Mac has not connected to the internet for an extended period.

Pre-Requisite:

  • macOS 11 Big Sur or later. (The xprotect command used below requires macOS 15 Sequoia or later; alternatives for older versions are shown.)

  • Internet connection for automatic definition updates.

  • Automatic updates must not be blocked by system policy.

Remediation:

Test Plan:

Pre-Implementation Check (run before making any changes)

Open Terminal (Applications > Utilities > Terminal) and check that automatic security updates are turned on:


defaults read /Library/Preferences/com.apple.SoftwareUpdate ConfigDataInstall

defaults read /Library/Preferences/com.apple.SoftwareUpdate CriticalUpdateInstall


Expected on a compliant Mac: 1 for both. 0 means automatic security updates are turned off (non-compliant). A message saying the setting “does not exist” means it has never been changed and the default (ON) is in use.

Check the installed XProtect version. On macOS 15 Sequoia and later:


xprotect version


On macOS 14 Sonoma and earlier:


defaults read /Library/Apple/System/Library/CoreServices/XProtect.bundle/Contents/Info.plist CFBundleShortVersionString


Write down the version number so you can compare it after the update.

Post-Implementation Check (run after completing the Implementation Steps)

Run the two defaults read commands from the Pre-Implementation Check again. Expected output: 1 for both.

Run the version check again. Expected: the same or a newer version number than before.

Then confirm XProtect updates have been installed on this Mac:


system_profiler SPInstallHistoryDataType | grep -A 4 -i xprotect


Expected: one or more XProtect entries (for example XProtectPlistConfigData or XProtectPayloads), each with an Install Date. A recent install date confirms definitions are being updated.

Implementation Steps:

Step 1: Open System Settings

Click the Apple menu and select System Settings.

Step 2: Turn on automatic security updates

Go to General > Software Update and click the ⓘ (info) button next to Automatic Updates. Make sure “Install Security Responses and system files” is ON (turning on the other options is also recommended), then click Done. On macOS 12 and earlier, go to System Preferences > Software Update > Advanced and tick “Install system data files and security updates”.

Alternatively via Terminal:


sudo defaults write /Library/Preferences/com.apple.SoftwareUpdate ConfigDataInstall -bool true

sudo defaults write /Library/Preferences/com.apple.SoftwareUpdate CriticalUpdateInstall -bool true


Step 3: Update XProtect now

On macOS 15 Sequoia and later, run:


sudo xprotect update


On macOS 14 Sonoma and earlier, install pending updates, including XProtect data:


sudo softwareupdate --install --all --include-config-data


Note: This installs all pending updates, including macOS updates, which may need a restart afterwards. If XProtect is already up to date, it reports that no updates are available.

Backout Plan:

XProtect itself cannot be turned off or rolled back — it is a core macOS security component managed by Apple. The only setting changed by this guide is automatic security updates. To undo that change (not recommended):

Step 1: Turn off automatic security updates

Go to System Settings > General > Software Update, click ⓘ next to Automatic Updates, and turn off “Install Security Responses and system files”.

Alternatively via Terminal:


sudo defaults write /Library/Preferences/com.apple.SoftwareUpdate ConfigDataInstall -bool false

sudo defaults write /Library/Preferences/com.apple.SoftwareUpdate CriticalUpdateInstall -bool false


Note: With this setting off, XProtect definitions will become outdated. If XProtect is causing application conflicts, contact Apple Support or your MDM provider. Do not attempt to remove or disable XProtect.

Note:

  • XProtect updates automatically — ensure the device has periodic internet access to receive definition updates.

  • XProtect works alongside Gatekeeper — both must be active for full malware protection.

  • For enterprise environments, ensure MDM policies do not block Apple security update servers.

Reference: