What are Gatekeeper and XProtect on a Mac?

Gatekeeper checks whether a downloaded app is signed by a known developer and notarized by Apple before macOS lets it run for the first time. XProtect is the separate system that checks that same app, and anything it later changes, against a list of known malware signatures — quietly, in the background, with no window to open and no scan button to press. Both ship on every Mac at no cost, need no setup, and have no on/off switch anywhere in System Settings. Together they stop most of what an ordinary user runs into. Neither one is the whole story, and neither was built to be.

What does Gatekeeper actually check before an app opens?

Gatekeeper only gets involved because of one small thing that happens first: when you download a file with Safari, Mail, or most other apps, macOS tags it with a hidden attribute called com.apple.quarantine. That flag is what tells Gatekeeper "this file came from outside the Mac, look at it before it runs." An app you build yourself in Xcode, or one you already ran and approved once, doesn't carry that flag and doesn't get re-checked the same way.

The first time you open a quarantined app, Gatekeeper checks two separate things. First, the code signature: is the app signed with a certificate tied to an identified developer — someone enrolled in Apple's paid Developer Program, whose private key cryptographically links every build they ship back to that one account? Second, notarization: has that specific build been submitted to Apple's automated scanning service and cleared? Apple's own security guide describes notarization as "a malware scanning service provided by Apple" that developers submit builds to before distributing them outside the Mac App Store, and it's a separate check from the signature itself — a build can be correctly signed and still fail notarization, or lose its notarization later.

That "later" part matters and most explanations skip it. Notarization isn't a one-time stamp Gatekeeper trusts forever: Apple can issue what its own documentation calls a revocation ticket for a build later found malicious, and Gatekeeper checks for that revocation too — so an app that was clean and notarized last month can start getting blocked with nothing on your end changed, because Apple pulled the ticket. Apps from the Mac App Store skip this path entirely: Apple reviews them directly before they reach your Mac, so there's no separate notarization check to fail.

How do you open an app Gatekeeper has blocked, and has the process changed recently?

It has, and if you're going by an old habit or an old tutorial, it won't work anymore. Through macOS Sonoma, Control-clicking a blocked app and choosing Open from the shortcut menu was the standard bypass. macOS Sequoia removed that option in 2024, and it stays removed in Tahoe: Control-click no longer offers a way past Gatekeeper's block.

The current path, per Apple's own support guide, is: open Apple menu → System Settings → Privacy & Security, scroll down to the Security section, and you'll see the blocked app named there with an Open Anyway button next to it. Click it, enter your account password, and click Open in the confirmation dialog. One detail nobody mentions until it bites them: that Open Anyway button only stays visible for about one hour after the blocked launch attempt. Wait longer than that and the button is simply gone from the pane — you have to double-click the app again to trigger the block a second time before Open Anyway reappears.

What does XProtect actually scan for, and what can it miss?

XProtect is what Apple's security guide calls "built-in antivirus technology … for the signature-based detection and removal of malware," using YARA-format signatures that Apple updates and pushes to every Mac silently. It runs its checks at three specific moments: when an app is first launched, when an app's files change on disk, and whenever Apple ships an updated signature file — not continuously, and not by scanning your whole disk on a schedule the way a traditional antivirus product markets itself.

The honest limit is right there in "signature-based." XProtect recognizes malware Apple has already written a signature for. A sample new enough that Apple hasn't seen and catalogued it yet won't trip a check, no matter how obviously malicious it would look to a person — the same gap every signature-based scanner on any platform has, and the single most important thing "Apple scans for malware automatically" leaves out. Apple's guide also references a newer behavioral-analysis layer for malware that doesn't match a known signature, sitting alongside the signature checks; Apple doesn't attach a version number to it, so treat it as real but loosely dated, not a feature you can pin to one release.

XProtect Remediator: the detail most explainers get wrong

If you've read that XProtect Remediator arrived with macOS Ventura, that's off by about six months and one major release. XProtect Remediator shipped with macOS Monterey 12.3, released March 14, 2022 — confirmed by independent Mac security researcher Howard Oakley's Eclectic Light Company, and by TidBITS' reporting from the same year. Apple's rollout wasn't loud, and general coverage of "Apple's malware tools" mostly caught up to it once Ventura shipped that October — which is likely where the mix-up started.

The original XProtect only checks at the three trigger moments above, and when it finds something, Apple's own guide is explicit that it can only alert you — it "can't attempt to remove any malware it detects" on its own. XProtect Remediator is a genuinely different mechanism bolted onto the same name: it runs a background scan on its own schedule, currently about once a day, looking for malware that's already running or already on disk, not just new arrivals — and when it finds a match, it can remove it automatically, a process Apple calls remediation. It replaced Apple's older, separate Malware Removal Tool (MRT), retired the following month. It's also kept growing: Eclectic Light Company's version tracking shows Remediator went from around eight scanning modules at launch to nineteen by June 2023, each one built to catch a specific malware family rather than one scanner trying to catch everything.

How can you tell any of this is actually running on your Mac?

There's no toggle for Gatekeeper or XProtect anywhere in System Settings, and that's a deliberate design choice, not a missing feature. Rather than take Apple's word for what these commands return, we ran them ourselves on a Mac running macOS 26.5.2 (build 25F84), on August 15, 2026. Your own output will carry different numbers by the time you try this — that's expected, and it's actually the proof the checks are live rather than static text:

$ spctl --status
assessments enabled

$ xprotect status
XProtect launch scans: enabled
XProtect background scans: enabled

That second command reports two separate lines, not one — launch scans and background scans, confirmed as distinct services on this Mac, which is the same split the comparison above draws between XProtect and XProtect Remediator. For the FAQ's "does it update on its own" question, here's a direct, checkable answer instead of just Apple's word for it:

$ xprotect version
Version: 5355   Installed: 2026-08-15 12:10:28 +0000

A real definition version with a real install timestamp, dated the same day this was run, with nobody touching Software Update by hand. And for the longer history behind that one number:

$ system_profiler SPInstallHistoryDataType | grep -A 4 XProtect
    XProtectPlistConfigData:
      Version: 2136
      Source: Apple
      Install Date: 15.12.2020, 21:50

That single entry is one of many on the same Mac — the same block repeats going back to 2020, one XProtectPlistConfigData entry per silent update, which is the closest thing macOS keeps to a receipt for "yes, this has been quietly updating itself the whole time." Console.app, filtered for "XProtect" or "Gatekeeper" while you launch a freshly downloaded app, shows the same checks as live log entries as they happen.

Worth knowing before you go looking for an off switch: separate independent testing by Eclectic Light Company in August 2026 found that sudo spctl --master-disable — the old admin command that used to fully disable Gatekeeper — no longer does that on current macOS. It now only "widens the scope of apps permitted to be run to include any signed app," and XProtect keeps reporting as enabled regardless. There doesn't appear to be a supported way to fully turn either one off.

What Gatekeeper and XProtect don't cover

Both systems are a floor, not a ceiling, and the gap is worth naming plainly rather than glossing over. Neither one reads the content of a website, an email, or a chat message, so neither can catch phishing or a fake "your browser needs an update" page on its own — that's a social-engineering problem, and social engineering doesn't trip a code-signature check or a malware signature, because no malicious code has run yet. Neither one evaluates a browser extension you installed and granted permission to yourself; you consented, so there's nothing to block. And critically, once you've clicked through Open Anyway on something you weren't sure about, both systems consider the matter settled — their entire job is to surface the block clearly and then get out of your way the moment you insist, not to keep arguing with you.

This is also a different system entirely from tccd and the TCC permission layer — Gatekeeper and XProtect decide whether an app is allowed to run at all, while TCC decides what an app that's already running and already approved can see, like your camera or your files. They sit next to each other, not on top of each other, and confusing the two is easy since both run silently with no dedicated app to open. For the fuller picture of what macOS checks without asking, our guide to why app permissions quietly change after an update covers the adjacent territory. And if the real question behind all of this is whether built-in protection is actually enough or you should be paying for something more, that's a separate decision this post deliberately leaves alone — whether Macs need antivirus in 2026 is a separate question, and one this post deliberately leaves alone.

FAQ

Is Gatekeeper the same thing as antivirus software?

No. Gatekeeper only checks whether a downloaded app is signed by an identified developer and notarized by Apple before its first launch — it doesn't scan file contents for known malware signatures. That signature scanning is XProtect's job, a separate system running alongside it.

Can I turn Gatekeeper off on a Mac?

Not fully, on current macOS. The old admin command sudo spctl --master-disable now only widens which signed apps are allowed to run rather than disabling the check, and there's no toggle for it anywhere in System Settings — by design.

Why does macOS say an app is "from an unidentified developer"?

It means the app's code signature isn't tied to anyone enrolled in Apple's paid Developer Program, so Gatekeeper has no verified identity or notarization ticket to check. The app can still run once you approve it through Privacy & Security > Security > Open Anyway.

Does XProtect update itself, or do I have to install something?

It updates itself, with no separate app, download, or user action required. Running xprotect version in Terminal shows the current definition version and the exact date it installed — on one Mac running macOS 26.5.2, that read "Version: 5355, Installed: 2026-08-15," the same day, with nobody touching Software Update.

What happens if I click Open Anyway on an app I'm not actually sure about?

Gatekeeper's block is lifted for that one app going forward, and it won't ask again on future launches. Neither Gatekeeper nor XProtect re-evaluates your decision afterward — approving an app once is treated as final unless you delete it and download it again.

Related guides