Apple iMac

Do Macs and Apple laptops need security software, or is OS X safe to use without antivirus? We explore the issues. Here's why Macs don't need security software.

The question of whether Macs require security software is not a new one. I asked it myself when I bought my first Mac 10 years ago, and the empirical evidence suggests that the answer I received then was correct. My PowerBook G4 has been connected to the internet, without protection, for a decade. It hasn't yet fallen prey to malware.

Indeed, head over to the forums on the Apple Store website and you'll find the same answer time and again - 'you don't need security software because I haven't got security software and it's never been a problem'.

The scientists among you will recognise this as a confusion of cause and effect. It's also a simplification of a complex issue. Here then, are reasons for and against the suggestion that Macs don't require antivirus, with what I hope is a definitive verdict.

Why Macs don't need security software

Quite simply, because all the evidence suggests they don't. I've had an unprotected Mac connected to the web for 10 years, and I have never had a problem. Why this is the case is worth investigating, however.

The argument most often put forward is a simple one of market economics: because Apple's global market share is in single figures, criminals go after the bigger shoals of fish in the Windows world. There is something in this - virtually all current malware exists to generate cash for criminals. Crooks are not known for their application or invention, so the biggest, easiest target gets all the attention.

In practice cybercriminal gangs are focused exclusively on Windows because there are more Windows users, yes, but also because Windows is still easier to hack. As a Unix-based operating system OS X is by its very nature sandboxed. It's like having a series of fire doors - even if malware gains access to your Mac, it is unable to spread to the heart of the machine. Macs are not unhackable, but they are more difficult to exploit than Windows PCs. So just as a burglar could break into a house with an alarm system but will probably choose the unprotected dwelling next door, a Mac makes a less attractive target in a world in which only attractive targets tend to be attacked.

The most recent version of OS X - OS X 10.8 Mountain Lion - takes this even further. It includes the GateKeeper function that by default prevents Mac users from installing anything other than Apple-approved software. And the lack of Java and Flash plugins removes the temptation to install fake versions of both - previously the principal vectors of infection for Macs.


Why Macs need security software

However, there are no technical reasons why OS X cannot be targeted, and there are exploits in the wild: albeit they are principally Trojans, and require a user to erroneously install them.

And yes, criminals target the lowest hanging fruit, it is harder to target Macs, and the numbers of Mac users are relatively small, but that situation could change. Windows is becoming more secure - Windows 8 is the most secure Windows ever - and the Mac market share in wealthy western countries is around 20 percent. When you consider that Macs are expensive, and so their owners tend to be wealthier than the average PC users, they start to look like an attractive target. I'm not scare-mongering - the threat is not there in any significant scale. But someday it could be, and that may make AV a worthwile investment.

It's also worth remembering that the end user is always the weakest link. In many ways security software exists to save you from bad decisions - installing apps that appear to offer something for nothing, but turn out to be spyware or viruses. Even Mac users can fall victim in this way.

Do Macs need antivirus: the verdict

I'd say that if you are using your Mac at home, mostly for non business purposes, you can close this article and continue to operate without security software. Yes, it is a risk. But using the internet is a risk, and in my considered view running a Mac without AV is a worthwhile calculated risk.

There are exceptions, however. If you are running a business with a fleet of Macs, or a network of both Macs and Windows PCs, I'd suggest getting in some protection. It's a belt and braces approach that may not be necessary, but if you have a lot to lose it's a small price to pay for peace of mind.

You may also consider using antivirus on your Mac if for some reason you could be targeted individually - if you have access to sensitive or high-value data, for instance. If you do choose to buy antivirus for your Mac, take a look at the reviews roundup put together by our colleagues on Macworld: Best Mac antivirus software.