Mac security basics

Apple’s Mac computers come with a set of built-in security features: automatic updates, a login password and screen lock, disk encryption, Time Machine backups, Find My, and several layers of malware protection. This guide explains these Mac security settings: what each one does, why it matters, and how it is usually turned on in recent versions of macOS, based on Apple’s own help pages and guidance from the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC).

A Mac without any extra antivirus software isn’t starting from nothing: Apple says macOS has built-in malware protection. The steps here are about checking the built-in settings are on. Apple changes menus between macOS versions, so each section links to Apple’s page with the latest steps, and the Personal Cyber Safety Checklist gives a way to tick them off.

Why it matters

A Mac often holds email, banking, tax records and years of photos, and it’s usually signed in to an Apple Account that also reaches iCloud and other Apple devices. Each setting covers a different risk. Updates close security weaknesses. A screen lock and FileVault keep the Mac and its data private. Two-factor authentication protects the Apple Account. Time Machine keeps copies of files, and Find My can help locate, lock or erase a missing Mac.

Some of these only help if they are set up before something goes wrong. Apple says Find My Mac only helps if it was set up before the Mac went missing, and a backup can only restore what was backed up.

How to update macOS

The ACSC describes automatic updates as “a ‘set and forget’ feature that updates your software as soon as it becomes available”, and says: “The easiest way to stay on top is by turning on or confirming automatic updates where possible.”

Apple says Software Update checks for updates automatically and only shows software compatible with that Mac model. Apple also says: “Before installing new software, it’s a good idea to back up your Mac.” Software Update settings include options to control whether the Mac downloads or installs updates automatically; the steps are below.

Based on Apple’s instructions (checked October 2026). Menus can change between versions; Apple’s Update macOS page has the latest steps.

1. Choose Apple menu > System Settings, click General in the sidebar, then click Software Update.
2. If an update is available, click the button to update, upgrade or restart. If none is listed, Apple describes clicking Check for Updates.
3. Enter the administrator password (the password used to log in) if asked.
4. Keep the Mac awake with the lid open while it installs. Apple says it may restart and show a progress bar or blank screen several times.

To change the automatic options, based on Apple’s Software Update settings guide (checked October 2026):

1. Choose Apple menu > System Settings, click General, then Software Update.
2. Click the info button next to Automatic Updates.
3. Turn on the options wanted: Download new updates when available, Install macOS updates, and Install Security Responses and system files.

Older Macs eventually stop getting updates. The ACSC says: “The risk of a cybersecurity incident is much higher when a product reaches end of support.” Its end-of-support page lists “Apple macOS Big Sur” among common end-of-support products, and says the best way to stay protected is “to upgrade to a new product.”

How to set the screen to lock

A login password protects the Mac when it’s left unattended. The ACSC’s first steps guide describes locking devices “with a passphrase, password, PIN or passcode”, and setting them “to automatically lock after a short time of inactivity.” On a Mac, the Lock Screen settings control how long the Mac can sit idle before the screen saver starts or the display turns off, and how soon after that a password is needed.

Based on Apple’s instructions (checked October 2026). Apple’s Lock Screen settings guide has the latest steps.

1. Choose Apple menu > System Settings.
2. Click Lock Screen in the sidebar (scroll down if needed).
3. Set how long the Mac can be inactive on battery and on the power adapter before the display turns off.
4. Use Require password after screen saver begins or display is turned off to choose how soon a password is needed.

Standard and administrator accounts

The ACSC’s user account guidance explains that “An administrator account has complete control of a computer”, which makes it a target. It describes using a standard account for everyday tasks such as email and web browsing, giving each person their own standard account, and keeping a separate administrator account for tasks like adding users. Apple describes the difference: “Standard users can install apps and change their own settings, but can’t add other users or change other users’ settings.”

Based on Apple’s instructions (checked October 2026). Apple’s Add a user guide has the latest steps.

1. Choose Apple menu > System Settings, then click Users & Groups in the sidebar.
2. Click Add User (an administrator password is needed).
3. In the New User menu, choose Standard.
4. Enter a full name and a password. Apple notes the account name can’t be changed later.
5. Click Create User.

How to turn on FileVault

FileVault encrypts the data on the Mac’s startup disk, so it can’t be read without the login password or a recovery key. Apple says Macs with Apple silicon or an Apple T2 Security Chip encrypt their data automatically, and describes turning on FileVault as an extra layer of security. Macs without either need FileVault turned on to encrypt their data.

Apple is blunt about the risk: “Don’t forget your recovery key.” It says that if both the login password and the recovery key are lost, “you won’t be able to log in and your files and settings will be lost forever.” Apple describes keeping the recovery key somewhere other than the Mac, or letting the iCloud account unlock the disk instead.

Based on Apple’s instructions (checked October 2026). Apple’s FileVault guide has the latest steps.

1. Choose Apple menu > System Settings, click Privacy & Security, then click FileVault (scroll down if needed).
2. Turn on FileVault. The Mac may ask for the password.
3. Choose how to unlock the disk if the login password is forgotten: allow the iCloud account to unlock it, or create a recovery key and store it safely.
4. Click Continue. If other users have accounts, Apple says each one enters their password before they can unlock the disk.

How to turn on two-factor authentication for an Apple Account

The Apple Account links the Mac to iCloud, purchases and Find My. Two-factor authentication means that signing in on a new device needs the password and a six-digit code shown on a trusted Apple device or sent to a trusted phone number. Apple says “Two-factor authentication is the default security method for most accounts.” The ACSC says multi-factor authentication “makes it harder for cybercriminals to gain initial access to your account.”

Based on Apple’s instructions (checked October 2026). Apple’s two-factor authentication page has the latest steps.

1. Open System Settings.
2. Click your name, then Sign-In & Security.
3. Check whether two-factor authentication is already on.
4. If not, turn it on and follow the onscreen instructions.

Apple says a verification code isn’t asked for again on that Mac unless the account is fully signed out, the Mac is erased, or the password has to be changed. Our guides to how to secure your online accounts, how passkeys work and planning account recovery cover the wider picture.

How to back up with Time Machine

The ACSC describes backing up as “a precautionary measure so that it can be recovered if it is ever lost, stolen or damaged.”

Time Machine is the Mac’s built-in backup. It copies files to an external drive, such as a USB or Thunderbolt drive. Apple says it keeps hourly backups for the past 24 hours, daily backups for the past month and weekly backups for earlier months, and that “The oldest backups are deleted when your backup disk is full.” Apple’s guidance is to use a drive with “at least twice the storage capacity of your Mac” and to use it only for Time Machine. An optional Encrypt Backup setting protects the backup with a password, which Apple says is needed to restore files later.

Based on Apple’s instructions (checked October 2026). Apple’s Time Machine guide has the latest steps.

1. Connect the external drive to the Mac.
2. Choose Apple menu > System Settings, click General, then click Time Machine.
3. Click Add Backup Disk (or the + button).
4. Select the drive and click Set Up Disk.
5. Answer any prompts, including whether to erase the drive and whether to turn on Encrypt Backup.

Apple says backups then start automatically, with the first one taking longest. Our guide to the 3-2-1 approach to backups explains the idea of keeping more than one copy.

How to turn on Find My Mac

Find My can show a missing Mac on a map, play a sound, lock it and erase it. Apple says: “When you add your Mac to Find My, Activation Lock is automatically turned on.” Activation Lock ties the Mac to the Apple Account, and Apple’s guidance is to remove it before a Mac is sold, given away or traded in. Our guide to resetting a Mac before selling or recycling it covers this. Apple describes the optional Find My network as an “encrypted, anonymous network of hundreds of millions of Apple devices” that can help locate a device even when it’s offline.

Based on Apple’s instructions (checked October 2026). Apple’s Set up Find My on Mac guide has the latest steps.

1. Open System Settings and click your name at the top of the sidebar.
2. Click iCloud, click See All, then click Find My Mac.
3. Click Turn On, then Allow so Find My Mac can use the Mac’s location. (If Location Services is off, Apple describes turning it on in Privacy & Security > Location Services first, with Find My turned on in the app list.)
4. Optionally, turn the Find My network on.
5. Click Done.

If a Mac goes missing, Apple’s lost or stolen Mac page describes finding it in the Find My app or at icloud.com/find, marking it as lost, erasing it if recovery seems unlikely, and reporting it to local police, who may ask for the serial number. Apple says that “Find My Mac is the only Apple service that can help track or locate a lost Mac.” Without it, Apple describes changing the Apple Account password and the passwords for other accounts used on the Mac.

How macOS protects against malware

Apple describes several built-in layers. According to Apple’s Platform Security guide, the App Store, Gatekeeper and notarisation aim to stop malware launching; Gatekeeper, notarisation and XProtect block it from running; and XProtect removes malware that has run. Apple says “macOS includes built-in antivirus technology called XProtect for the signature-based detection and removal of malware”, and that XProtect “updates signatures automatically—independent from system updates.”

Apple describes Gatekeeper as “designed to ensure that only trusted software runs on your Mac”, and says: “An app that has been notarised by Apple indicates that Apple has checked it for malicious software and none was detected.” If macOS can’t check an app, Apple describes contacting the developer or looking for an updated or alternative app in the App Store, and only overriding the warning when certain the app is from a trustworthy source.

The Allow applications from setting controls where apps can come from. Apple calls the App Store-only option “the most secure setting to protect your system from malware.”

Based on Apple’s instructions (checked October 2026). Apple’s Protect your Mac from malware guide has the latest steps.

1. Choose Apple menu > System Settings, then click Privacy & Security.
2. Scroll to Security.
3. Use the menu next to Allow applications from to choose App Store or App Store and Known Developers.

How to review app permissions and privacy settings

Apps ask before using the camera, the microphone, location, files and folders, or screen recording. Apple’s Privacy & Security settings list the apps that have asked for each, and access can be changed for each app. The ACSC’s first steps guide says to “Check the privacy permissions carefully when installing new apps on your device, particularly for free apps.”

Based on Apple’s instructions (checked October 2026). Apple’s Privacy & Security settings guide has the latest steps.

1. Choose Apple menu > System Settings, then click Privacy & Security.
2. Click a category, such as Location Services, Camera, Microphone, Files & Folders or Screen & System Audio Recording.
3. Review the apps listed and turn access off for any that don’t need it.
4. For location, click Details at the bottom of the Location Services list to see which system services use it.

Things to watch for

• A lost FileVault recovery key. Apple says files can be lost forever if both the login password and the recovery key are forgotten.
• Warnings when opening an app. Apple describes caution with any app macOS can’t check, and only overriding when certain it’s trustworthy. Our guide to fake tech support and remote access scams explains how scammers talk people into installing software.
• A full backup drive. Apple says Time Machine deletes the oldest backups when the disk is full.
• Settings that have to be on beforehand. Find My Mac and backups can’t be switched on after a Mac is gone.
• Unexpected verification codes. A six-digit Apple code nobody asked for may mean someone has the password. Our guide to what to do if an account has been hacked explains where official guidance says to start.
• An unsupported macOS version. The ACSC describes the risk as much higher at end of support.

Common questions

How do I secure my Mac?

Apple’s and the ACSC’s guidance covers a handful of built-in settings: automatic macOS updates, a screen lock and login password, FileVault, two-factor authentication for the Apple Account, Time Machine backups, Find My Mac, and the Allow applications from setting. The ACSC also describes using a standard account for everyday tasks. Apple says Find My Mac only helps if it was set up before the Mac went missing. The steps start at how to update macOS.

Do I need antivirus on my Mac?

Apple says macOS “includes built-in antivirus technology called XProtect”, which updates its signatures automatically, alongside Gatekeeper and notarisation. Apple’s own malware help page doesn’t discuss third-party antivirus software, and the ACSC’s personal cyber security first steps guide focuses on updates, multi-factor authentication, backups, passphrases and screen locks. How macOS protects against malware explains the built-in layers, and the guide to antivirus software explains what paid security suites add.

What do I do if my Mac is lost or stolen?

Apple’s lost or stolen Mac page describes finding it in the Find My app or at icloud.com/find, marking it as lost, erasing it if recovery seems unlikely, and reporting it to local police, who may ask for the serial number. Apple says that “Find My Mac is the only Apple service that can help track or locate a lost Mac.” Without it, Apple describes changing the Apple Account password and other passwords used on the Mac. See how to turn on Find My Mac.

Do I need to turn on FileVault on my Mac?

It depends on the Mac. Apple says Macs with Apple silicon or an Apple T2 Security Chip encrypt their data automatically, and describes FileVault as an extra layer of security; Macs without either need FileVault turned on to encrypt their data. Apple warns that if both the login password and the recovery key are lost, “your files and settings will be lost forever.” The setting is under Privacy & Security; see how to turn on FileVault.

Is it safe to click Open Anyway on my Mac?

Apple describes Open Anyway as an override for an app macOS has blocked because it can’t check it, and the app is then saved as an exception. Apple describes using it only when certain the app is from a trustworthy source and hasn’t been tampered with, and otherwise contacting the developer or looking for an alternative in the App Store. The guide to remote access scams explains how scammers talk people into installing software.

How do I back up my Mac?

With Time Machine, the Mac’s built-in backup, which copies files to an external drive. Apple describes using a drive with “at least twice the storage capacity of your Mac”, set up under System Settings > General > Time Machine > Add Backup Disk. Apple says it keeps hourly backups for the past 24 hours, daily backups for the past month and weekly backups for earlier months. See how to back up with Time Machine.

Where to get official help

• Apple Support (support.apple.com) has the current steps for every Mac setting in this guide.
• ASD’s ACSC publishes guidance on updates and end of support and, according to its cybercrime help page, runs a 24/7 hotline on 1300 CYBER1 (1300 292 371). Cybercrime can be reported to police through ReportCyber from the same page.

Related guides

• How to secure your online accounts
• Passkeys explained
• An account recovery plan
• Backups for personal devices: the 3-2-1 approach
• Selling, giving away or recycling a device
• Windows computer security basics
• Chromebook security basics