Mac Security Basics: The Settings That Matter in macOS 27

Most Macs are set up once and never audited. The settings are spread across System Settings, and much online advice is antivirus marketing or menu paths from before the Settings app was redesigned.

This guide ranks the settings by effort and payoff: a five-minute round, a thirty-minute round, and a yearly review. Each item names the threat it answers, where it lives, what it costs, and how to check it without changing anything.

Apple's macOS version page lists macOS 27 Golden Gate (27.0.1, 28 September 2026) as the latest, with Tahoe 26.7.1 the latest 26, and its security releases page lists Golden Gate for Apple silicon Macs only. Paths come from Apple's macOS 26 and 27 user guides, which matched step for step wherever both were compared, and from Apple Support articles. The Terminal output comes from a Mac on macOS 26.5.2; macOS 27 itself was not available to click through.

The checklist: four threats, three time bands

The settings answer four threats: a lost Mac (FileVault, lock screen, Find My), software you run (updates, Gatekeeper, XProtect, permissions), stolen passwords (passkeys, two-factor), and rare targeted attacks (Lockdown Mode).

Read-only commands to check each setting

These only read. socketfilterfw also has --set... options and xprotect has an update subcommand, so copy only what is here.

sw_vers -productVersion                  # compare with 27.0.1 (or 26.7.1 on Tahoe)
softwareupdate --list                    # what is pending; never add --install here
softwareupdate --history | grep -i "background security"
fdesetup status                          # FileVault is On.
spctl --status                           # assessments enabled
/usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate   # Firewall is enabled. (State = 1)
sysadminctl -screenLock status           # screenLock delay is 900 seconds
csrutil status                           # System Integrity Protection status: enabled.
xprotect version                         # Version: 5367 Installed: 2026-10-14 ...

The comments show output from that macOS 26.5.2 Mac. spctl --status shows whether Gatekeeper checking is on, not which "Allow applications from" option you chose. csrutil status is a check only: System Integrity Protection stops even root modifying protected system folders. The recovery key test returns true for a valid key, per its man page, and was not run. Only built-in help describes xprotect and sysadminctl.

Updates and FileVault: the two that cannot wait

Updates. Apple's update guide lists three switches: download new updates, install macOS updates, and install Security Responses and system files. Laptops must be plugged in to download automatically. Apple's support article adds Background Security Improvements, lightweight fixes for Safari, WebKit and system libraries delivered between updates from macOS 26.1. Its switch is "Automatically Install" in Privacy & Security; with it off you wait for the next full update.

Note: The names differ between Apple pages: the user guide still says "Rapid Security Responses". Turn on every switch you find in either place.

The cost is restarts. The trap is trusting the toggles: say sw_vers shows 26.5.2 while softwareupdate --list offers 26.7.1. The switches are on and the Mac is still behind, so check the version.

FileVault. On a Mac with Apple silicon or a T2 chip, Apple says your data is already encrypted. FileVault adds a layer, "keeping someone from decrypting or getting access to your data without entering your login password". Other Macs must turn it on to encrypt anything. TidBITS reports that signing in with an Apple Account during setup switches it on, which no Apple page read for this guide states, so run fdesetup status.

Apple's Passwords guide says you get a recovery key during setup and can view it in Passwords: click All, then your Mac's name (Settings > General > About > Name if you forget it). It also appears on an iPhone signed in to the same Apple Account. Apple's FileVault page still lists an iCloud-account option, so confirm which method your Mac uses.

Warning: If you forget your login password, cannot reset it, and lose the recovery key, Apple says your files and settings are lost forever. Keep a copy away from the Mac and its startup disk: a Passwords entry synced to your phone is one copy, and a printed copy covers a locked Apple Account. Our backup guide covers the Time Machine password too.

Software you run: Gatekeeper, XProtect and permissions

Apple's Platform Security guide describes three layers: prevent launch (App Store, or Gatekeeper with notarization), block (Gatekeeper, notarization, XProtect) and remediate (XProtect). Notarization is Apple's scan of developer-submitted software for known malware, revocable even after approval. XProtect uses signatures updated automatically, independent of system updates, with a daily check by default. It scans when an app first launches, changes, or when signatures update.

Gatekeeper's default is software from the App Store, or signed by a registered developer and notarized. Apple's guide offers App Store, or App Store and Known Developers. App Store only is the most protective and blocks anything downloaded directly. Our suggestion, untested: keep the default on your own Mac, and use App Store only on one belonging to someone who installs nothing new.

Warning: After a block, Privacy & Security shows Open Anyway, which saves an exception. Apple says running unsigned or non-notarized software may expose you to malware. The same goes for pasting a Terminal command from a web page: these checks judge software you open, not a command you run.

The permission audit. Apple's settings page defines the sensitive lists. Full Disk Access covers all files, including Mail, Messages, Safari and Time Machine data. Accessibility lets apps run scripts and system commands. Input Monitoring sees what you type. Also read Screen & System Audio Recording, Camera and Microphone. For each app, ask whether you recognise it and still use it, and switch off the rest; an app that needs access can ask again. Our screen recording checklist covers recordings, and the login items guide covers software that starts by itself.

Accounts, Find My and the firewall

Passwords and passkeys. The Passwords app (macOS Sequoia 15 and later) flags passwords that are easily guessed, reused or in known leaks; choose Security. Apple's passkey article says passkeys are phishing-resistant, share no secret with the site, and sync through end-to-end encrypted iCloud Keychain. The cost is dependence on your Apple Account, so keep two-factor on; Apple says it is the default for most accounts.

Find My. Apple's Activation Lock page says your Apple Account password or device passcode is then needed to turn off Find My, erase the Mac, or reactivate it. An Apple silicon Mac needs Full Security (the default) and two-factor. Turn Find My off before selling; the new Mac checklist has the erase order.

Firewall. Apple says a firewall guards against unwanted contact initiated by other computers, and a sharing service opens a port. Our reading: it matters on networks you do not control and does nothing about software you run. Apple's pages do not state the factory default and vendor blogs say off, so check yours. "Block all incoming connections" also cuts off sharing services beyond basic internet services, per Apple, and stealth mode stops replies to ping. Switch off unused services in General > Sharing.

Advanced Data Protection and Lockdown Mode: decisions, not defaults

Advanced Data Protection. Apple's iCloud overview says standard protection end-to-end encrypts 15 data categories, including Health and iCloud Keychain passwords; Advanced Data Protection makes it 25, adding iCloud Backup, Photos and Notes. It is optional and needs two-factor, a device passcode or password, and every signed-in device on a supported version (macOS 13.1 or later). You must set up a recovery contact or 28-character recovery key first.

The risk is lockout. Apple then holds no keys, so recovery depends on your device password, contact or key. iCloud.com web access is disabled once it is on, and links, Shared Albums and iWork collaboration stay outside end-to-end encryption. It suits people who keep recovery arrangements current.

Lockdown Mode. Apple's description is an optional, extreme protection for the very few people who might be personally targeted by sophisticated attacks: "Most people are never targeted by attacks of this nature." On a Mac it limits message attachments, blocks some web technologies, blocks FaceTime calls from people you have not contacted in 30 days, and prevents installing configuration profiles. Apple silicon laptops also need your explicit approval before connecting an accessory. Turn it on under Privacy & Security > Lockdown Mode, then Turn On & Restart, per device. macOS 27 adds exclusions for individual contacts; Safari sites can be excluded on both. Consider it if your work makes you a plausible target; otherwise it is probably not for you, on Apple's own framing.

Two myths, checked

"Macs don't get malware." Jamf's Security 360 Mac report, from customer incidents and over 150,000 Macs at the end of 2025, found about half the malware it recorded was trojans and a third infostealers. It says the days of "Mac can't get malware" are long gone, and describes a fake-interview campaign that "bypasses Gatekeeper by convincing users to manually execute commands". Palo Alto Networks' Unit 42 reported in September 2026 that the AMOS stealer spreads through pasted Terminal commands, malicious ads and cracked-software pages. Both are security vendors, and neither gives your odds. No source read for this guide gives a trustworthy infection rate for a home user, so this guide gives none.

"You must buy antivirus." Apple's guide calls XProtect "built-in antivirus technology". AV-TEST ran 10 consumer products on Tahoe 26.3 against over 400 Mac samples; eight detected all, two 98.5 and 97.5 percent. It lists no built-in baseline, so it cannot show whether a paid tool beats XProtect, and neither it nor Apple calls one mandatory. Our reading: optional if you often run software from outside the App Store, or your employer requires it. It does not replace skipping the pasted command.

Where to start this week

• Today, five minutes: run fdesetup status and softwareupdate --list, switch on every update setting, and set the lock-screen delay.
• Today: find the FileVault key in Passwords and copy it somewhere that does not depend on this Mac.
• This weekend, 30 minutes: set Allow applications from, read each permission list, and fix the top items under Passwords > Security.
• Once a year: run the key test, revisit the two decisions above, and check your macOS is on Apple's security releases page. September 2026 covers macOS 27, Tahoe 26 and Sequoia 15; Sonoma's latest entry is 14.8.9 from 6 August.

More Mac guides are in the Mac hub.

We build Tend, a free macOS app (macOS 11 or later). Its Resilience Center shows FileVault status read-only, and its Privacy audit lists apps' sensitive permissions. Every check above works with System Settings and Terminal alone.

Frequently asked questions

Do I need antivirus on a Mac?

Apple builds in XProtect and describes it as antivirus technology that updates automatically. Paid tools are optional, and make most sense if you often run software from outside the App Store or an employer requires one.

Should I turn the Mac firewall on?

It is a low-cost setting that blocks unwanted inbound connections, which matters most on networks you do not control. Apple's pages do not state the factory default, so run the socketfilterfw --getglobalstate check first.

What happens if I lose my FileVault recovery key?

If you can still log in, nothing is lost today: find the key in Passwords and make a second copy. If you forget your login password, cannot reset it, and have no key, Apple says your files and settings are lost forever, so keep a backup.

Sources and further reading

• Protect data on your Mac with FileVault - Apple, Mac User Guide for macOS 27, 2026. Automatic encryption, recovery options, lost-forever warning.
• See the FileVault recovery key for your Mac in Passwords - Apple, Passwords User Guide, 2026. Where the key is stored.
• About Background Security Improvements for iOS, iPadOS, and macOS - Apple Support, 2026. What they are and the Privacy & Security switch.
• Protecting against malware in macOS - Apple Platform Security guide, 2024. Notarization, XProtect, the three layers.
• About Lockdown Mode - Apple Support, 2026. Who it is for and what it limits.
• How to turn on Advanced Data Protection for iCloud - Apple Support, 2026. Requirements and recovery methods.
• Security 360: Annual Trends Report, Mac - Jamf, 2026. Malware mix and delivery routes; a vendor report.
• Atomic macOS (AMOS) Stealer Activity - Palo Alto Networks Unit 42, 2026. How a Mac stealer spreads.