Why your Mac may not scan for malware

For more than a decade, macOS has scanned for malware in the background, without telling users when scans happen or what they find. Apple’s Malware Removal Tool (MRT) handled this work until 2022; it ran at startup and could also be launched manually. Apple replaced it with XProtect Remediator (XPR), a more capable system of scanning modules available on macOS Catalina and later. XPR runs as a scheduled background task, but its scans can consume substantial processing power and energy. Daily runs are time-limited, with a full scan allowed only weekly.

XPR’s schedule and power requirements can leave laptop users with scans skipped for days or weeks, especially if their Macs are usually on battery. Until September 2026, users could still launch XPR themselves, but version 163 removed that option: attempts to open it now fail silently. macOS also offers no built-in way to check when scans last ran or what they found. Scan records may be found in system logs or Endpoint Security events, but they are difficult to access and can disappear quickly; third-party utilities can expose some log information. The result is that users may not know whether protection is running, even when XPR is working as intended. Despite its technical improvements over MRT, its unreliable scheduling on laptops and lack of transparency make third-party malware scanners a more dependable and visible option for users seeking additional protection.