Built-in defences and verification

macOS ships with several defences already switched on. The most useful thing you can do with them is not configure them further, but check, occasionally, that nothing has quietly turned them off. Every command in this lesson is read-only: none of them change a setting.

It is worth being clear about why a check matters at all if these defences are on by default. Software installers sometimes ask for permission to change security settings as part of setting themselves up, a family member or colleague troubleshooting a problem may turn something off and forget to turn it back on, and a Mac that was set up years ago may simply predate a setting that is now the default for new installs. None of that is likely, but the checks below take a few seconds and change nothing, so there is little reason to skip them.

System Integrity Protection (SIP)

SIP restricts even the root/administrator account from modifying protected parts of the system: core folders such as /System, /usr, /bin and /sbin, and Apple’s built-in apps. Apple explains that these “can be modified only by processes that are signed by Apple and have the appropriate entitlements,” which stops harmful software with administrator access from silently rewriting the operating system underneath you. Third-party software can still write to /Applications, /Library, and /usr/local. Check its status with:

$ csrutil status
System Integrity Protection status: enabled.

Turning SIP off requires booting into recoveryOS and running csrutil disable deliberately; it never turns off on its own. This course will not walk through that process, because there is rarely a good reason for a single-user Mac to do it, and doing so removes a protection that is otherwise very hard for harmful software to bypass.

Gatekeeper and notarization

Gatekeeper checks apps before they are allowed to run for the first time. Apple describes it as technology “designed to ensure that only trusted software runs on your Mac,” by verifying that an app is signed by an identified developer or downloaded from the App Store. Since macOS Catalina, most software distributed outside the App Store must also be notarized: submitted to Apple and scanned for known malicious content before Gatekeeper will let a user open it, and Apple can revoke that notarization later if malicious software is found. Check whether the assessment system Gatekeeper relies on is active:

$ spctl --status
assessments enabled

XProtect

Where Gatekeeper checks software before it first runs, XProtect keeps checking afterwards. Apple’s Platform Security guide describes it as built-in technology for the signature-based detection and removal of harmful software, which scans apps when they launch, when files change, and updates its signatures independently of full macOS updates. Gatekeeper, notarization and XProtect work as layers: the first two try to keep harmful software off the Mac in the first place, and XProtect catches what slips through.

Lockdown Mode

Lockdown Mode is a different kind of defence: not a background check, but a deliberate, visible trade of convenience for protection. Apple describes it as “an optional, extreme protection that’s designed for the very few individuals who... might be personally targeted by some of the most sophisticated digital threats,” and is explicit that “most people are never targeted by attacks of this nature.” Turned on, it blocks most message attachment types and link previews, restricts complex web technologies in Safari, blocks FaceTime calls from unknown contacts, and requires a device to be unlocked before an accessory can connect to it. It is found in System Settings → Privacy & Security → Lockdown Mode, and is worth knowing about rather than necessarily using: it is built for people who have concluded, specifically, that they may be a target of this kind, not as a general hardening step.

Keeping it all current

None of the above matters if the Mac is running old software with known, fixed weaknesses. System Settings → General → Software Update is the primary way to keep macOS current, and can be set to install updates automatically. From Terminal, you can check what is available without installing anything:

$ softwareupdate --list
Software Update found the following new or updated software:
* Label: macOS 26.1-26A123
	Title: macOS 26.1, Version: 26.1, Size: 11728377KiB, Recommended: YES, Action: restart