Antivirus for Macs in business

Do Macs need antivirus at work?

For a business, yes. The question is not whether macOS is secure (it has strong protections of its own) but whether you can show, manage and act on the protection of every Mac you are responsible for.

Macs in a business open the same email attachments, links, shared files and browser downloads as Windows PCs. They hold the same customer data, sign in to the same Microsoft 365 tenant and connect to the same file shares. A Mac that passes a malicious file to a Windows colleague, or a stolen session token taken from a Mac browser, causes the same incident as any other device.

Three practical reasons push organisations towards business antivirus on Macs:

• Cyber Essentials and insurance. The Cyber Essentials malware protection control expects an active, up-to-date mechanism on every in-scope device, and macOS devices can meet it with anti-malware software that stops malicious code running and blocks malicious websites. Our sister site explains the Cyber Essentials malware protection requirement. Insurers and customers' security questionnaires often ask the same question in plainer words: is every device protected, and can you prove it?
• Visibility. Without a management console you cannot see which Macs are protected, which have detected something and which have fallen out of date.
• Consistency. One product across Macs, Windows PCs and servers means one set of policies, one place to look and one licence to manage.

If you only have a handful of Macs and no other devices, the case is weaker, but many organisations run a mix of Macs, Windows PCs and servers, and that is where a business product earns its place.

What macOS protects by itself

Apple builds several layers into macOS, and they are worth understanding before you buy anything:

• Gatekeeper and notarisation: apps from outside the App Store are expected to be notarised, meaning Apple has scanned them for known malware before they are distributed. Gatekeeper checks this before an app opens and can block apps Apple has since found to be malicious.
• XProtect: Apple's built-in, signature-based anti-malware. Apple updates its signatures separately from macOS updates, and XProtect blocks known malware when an app first launches or changes, and removes infections it finds.

These are real protections and they work quietly on every Mac. What they are not is a business tool. There is no console where IT sees every Mac's status, no central policy for web filtering or USB devices, no alert to your IT team when something is blocked, no report for an assessor and no investigation trail if something does get through. They also do nothing for your Windows PCs, servers or phones.

Business antivirus does not replace Apple's protections; it runs alongside them and adds the management layer a business needs, plus extra protection layers such as behaviour monitoring, web protection and, on some products, detection and response.

Business antivirus products that protect macOS

Every endpoint protection product we supply, apart from Halcyon and Absolute (which do different jobs), protects macOS. The table summarises how each vendor covers Macs from its own published material. Supported macOS versions change with each vendor release, so we check your Macs against the vendor's current support list before quoting.

A common thread: features are usually fullest on Windows, and a few capabilities (certain isolation, device control or patching features) differ on macOS. That is not a reason to avoid any product, but it is a reason to check the specific features you care about. The vendors comparison has the wider picture, and business antivirus explains what separates a business product from a home one.

Licensing Macs: per user or per device

How Macs are counted affects cost, especially where people have both a Mac and a Windows PC:

• Per user: Sophos Endpoint and Trend Micro Worry-Free count people, not devices. A designer with a MacBook and a Windows workstation uses one licence.
• Per device: CrowdStrike, SentinelOne, ThreatDown, Bitdefender, Trend Micro Vision One Endpoint Security, Webroot, Check Point and WatchGuard count each protected device, so every Mac is one licence.

Neither model is better in general. Per user tends to suit organisations where people have several computers; per device suits shared Macs, kiosk machines and teams where everyone has one laptop. Our business antivirus cost guide explains the other things that move the price, without quoting figures, and we can model both approaches if your mix makes it worthwhile.

Deploying antivirus to Macs with device management

Security software on a Mac needs permissions that a user would otherwise be asked to approve: typically a system extension, a network extension for web protection and full disk access so it can scan files. Approving these by hand on every Mac is slow and error-prone, and a missed approval leaves a Mac only partly protected.

The cleaner route is mobile device management (MDM). With the Mac enrolled in an MDM such as Microsoft Intune, configuration profiles pre-approve the vendor's extensions and permissions, and the installer is pushed silently. Company-owned Macs bought through Apple Business Manager can be enrolled automatically when they are first switched on, so protection is in place before the user starts work.

A typical Mac rollout with us looks like this:

1. Check every Mac's macOS version and chip against the vendor's current support list.
2. Build the vendor's configuration profiles in your MDM and test them on one or two Macs.
3. Remove any old antivirus, then deploy the new agent to a pilot group.
4. Confirm each Mac reports into the console with full protection, then extend to everyone.
5. Set policies for web protection, device control and exclusions to match your Windows devices.

If you do not yet manage your Macs centrally, Forever Group can help with mobile device management as well; it makes antivirus, encryption and software updates on Macs far easier to keep in step.

Choosing for a mixed Mac and Windows estate

Rather than looking for one product that is right for everyone, work through the criteria that matter to you:

• One console for every platform: Macs, Windows PCs, servers and, if needed, phones and tablets in the same place.
• macOS feature parity: the features you rely on (web protection, device control, isolation, rollback) available on Macs, not just on Windows.
• Apple silicon and current macOS support: published by the vendor, and kept up with as Apple releases new versions.
• Encryption management: FileVault managed from the same console helps with lost laptops (Sophos Device Encryption and GravityZone Full Disk Encryption both do this).
• Licence fit: per user if people have several computers, per device if they do not.
• Room to grow: an upgrade path to detection and response on the same agent if your insurer or customers ask for it later. Our EPP vs EDR page explains the difference, and endpointsecurity.uk has EDR, XDR and MDR guidance.

For the server side of a mixed estate, see server antivirus, and for Linux machines see Linux antivirus.

How we help

Forever Systems supplies business antivirus for Macs from the vendors above, on the licence model that suits your mix of devices. We can:

• review your Macs and other devices and suggest products that cover them from one console
• set out per-user and per-device options side by side in a quote
• help prepare MDM configuration profiles and plan the removal of your current product
• set policies that match your Windows devices, so Macs are not the gap

Contact us and tell us roughly how many Macs and other devices you have, and ask us for a quote. We can set out the options that fit.