Though Windows is a tempting target for malware coders, macOS gets its share of attacks. Going without antivirus protection for your Mac is a bad idea. On the other hand, you don’t want to spend a lot of time fiddling with that protection or waiting on lengthy scans. Webroot AntiVirus for Mac scans at blazing speed and takes very little of your valuable disk space. However, it doesn’t appear in the latest independent lab tests, its scores in our hands-on tests are down, and its former powerful remote monitoring and control ability has been removed.
Our Editors’ Choice macOS antivirus tools are Bitdefender Antivirus for Mac and Norton 360 Deluxe for Mac. They’re not quite as speedy as Webroot, but Norton has one perfect lab score and Bitdefender has two.
As with Windows antivirus products, the most common price for a single Mac antivirus license runs just under $40. Webroot fits that profile, at $39.99 per year, as do Bitdefender, ESET Cyber Security (for Mac), and Trend Micro, among others. In the past, you could get three licenses for $49.99, but with the new simplified pricing, that choice is no longer available. As with Trend Micro’s software line, if you want more licenses you need to upgrade to a security suite. Some users will be put off by this lack of volume discount.
McAfee costs $64.99 per year, but that price lets you install McAfee’s antivirus protection on all your macOS, Windows, Android, iOS, and even ChromeOS devices. You pay $104.99 per year for Norton—quite a jump in price—but that gets you five cross-platform licenses, five no-limits VPN licenses, and 50GB of hosted storage for your (Windows-based) online backups. In addition, Norton offers a full suite, not just antivirus. At the other end of the spectrum, Avira Free Antivirus for Mac and Avast are totally free.
Technically you can run Webroot under the latest version of macOS or any of the three previous versions meaning that support goes back to Catalina (10.15). However, my Webroot contact confirmed that Mojave (10.14) is still supported. In any case, most Mac users stay up to date with the very latest. Avira, Kaspersky, and McAfee AntiVirus Plus for Mac also require Catalina or newer.
If you do have a reason to stick with an ancient macOS version (old hardware, perhaps), ProtectWorks AntiVirus (for Mac) supports versions all the way back to Snow Leopard (10.6). As for Norton, it used to limit support to the current OS and the two previous ones. However, the Norton website currently indicates support for versions from 10.10 (Yosemite) to Ventura.
During its quick installation, Webroot asks for your registration key and an email address. Registering an email address gets you access to 24/7 tech support and email alerts about new global security threats. As with Webroot AntiVirus on Windows, you can also opt in for “special offers and newsletters.” I didn’t.
Past versions of this product installed security extensions for Safari, Chrome, and Firefox very smoothly, with minimal user interaction required. That has changed in the last few versions. I had to manually locate and install the Web Threat Shield extension for Chrome and activate it with my keycode. My Webroot contact confirmed that only Chrome is supported at this time and that there’s no automated installation. That’s seriously awkward. Users who don’t make the extra effort (most of them, I imagine) won’t get the benefit of the Web Threat Shield feature, even though it shows as enabled in the main window.
More than most cross-platform antivirus tools, Webroot’s main window on a Mac looks the same as that of its Windows counterpart. Aside from the macOS window style, the only immediately visible difference is that the Windows edition includes a toggle for its firewall component, something absent on macOS. Shades of green back most parts of the window, with a large light-colored panel that reports details on the latest scan and the next scheduled scan. Naturally, there’s a big button to scan your Mac on demand. That’s a full scan by default, but, as I’ll explain, Webroot’s full scan is faster than most so-called quick scans.
As part of the setup process, you create a Webroot account online. From the online console, you can see all your subscriptions and registration codes. However, one extremely useful function of that console has been removed. You used to be able to monitor all your Webroot installations and even trigger actions such as launching a scan, handy if you’re managing Webroot for a tech-challenged family member. Sadly, that ability to remotely manage your installations has been removed.
When I review a Windows antivirus utility, I turn to the latest reports from the big testing labs. The more labs testing a product and the higher the scores achieved, the better. I also perform my own hands-on tests, using live malware safely isolated in a virtual machine. I can’t do as much hands-on testing with macOS products. Fortunately, two of the labs I follow test Mac antivirus products. Unfortunately, neither includes Webroot in its latest test reports.
Lab reports for Windows antivirus products typically exhibit a much larger point spread than those for Mac antivirus. In the latest report from AV-Comparatives, all but one of the tested products protected against at least 99% of the malware samples, and many reached 100%. Webroot received certification in some earlier instances of this test but doesn’t appear in the latest report.
Experts at AV-Test Institute rate products on three criteria: protection, performance, and usability. That last category refers to minimizing false positives, which are instances when the antivirus flags a valid program as malicious. Products can earn six points in each category, so the maximum possible total is 18 points. Avira, Norton, and Trend Micro all reached 18 points. Here again, Webroot doesn’t appear. Avast, AVG, Bitdefender, and Trend Micro Antivirus for Mac received perfect scores from both labs.
Like most of its competitors, Webroot offers two types of malware protection scanning. As the name implies, the default full scan looks at all files and active processes. The quick scan still checks active processes, but then only looks at files in startup locations and known threat locations. You’ll have to dig into Advanced Settings to select a quick scan.
In testing, a full scan of a clean Mac took just under three minutes, much quicker than the current average of 37 minutes. A quick scan finished in just one second. CleanMyMac completed its full scan in one minute, though it’s not entirely clear what’s covered by that scan. Norton 360 Deluxe, MacKeeper, and Clario all came in at less than 10 minutes.
Webroot runs a scan immediately upon installation, something that not all antivirus tools do. By default, it also schedules a full scan every day. You can modify the schedule to run on just one day of the week or on startup. But since it’s so crazy fast, there’s no real reason to switch away from the default.
Like most Mac antivirus utilities, Webroot aims to eliminate any Windows malware it sees, so your Mac doesn’t inadvertently infect other devices on your network. To test this feature, I copied my Windows malware collection to a thumb drive. I also turned on a setting called Automatically scan removable media. Webroot detected and quarantined 90% of the Windows-focused malware samples.
That’s good, but when tested with my previous sample collection Webroot managed 97%. Also tested against that previous sample set, Total Defense Essential Anti-Virus for Mac reached 97%, with G Data close behind at 96% and Avast One for Mac in third place with 95%.
Why waste time and energy writing malware to steal personal data when you can just ask people to hand over their secrets? That’s the mindset of the ne’er-do-wells behind phishing websites, those fraudulent sites that emulate online banking sites, email services, and even dating and gaming sites. If you aren’t observant enough to recognize the fraudulent site, you can wind up giving away your account to fraudsters.
Phishing works by tricking the user, with no reliance on any particular operating system or browser. If your smart air fryer includes a full-scale browser, you could fall victim to phishing while waiting for onion rings. Any device that can surf the internet can be a conduit for phishing attacks.
When testing a product’s ability to detect phishing frauds, I compare its detection rate with that of the protection built into Chrome, Edge, and Firefox. I start with a list of reported phishing URLs collected from websites that track such things. I work to make sure the collection includes both verified frauds and sites that are too new to have been analyzed and blacklisted. I launch each URL in all four browsers and note the reaction. If any one of the browsers can’t load the URL, I discard it. I also check to be sure that each URL really does fit the definition of phishing, meaning it imitates a secure site and attempts to steal login credentials.
While phishing itself is completely browser-independent, protection against phishing may not be. With Webroot, I tested the Windows and macOS editions simultaneously and found that they aligned perfectly, detecting all the same frauds and missing the same few. The Mac edition’s 93% score is a significant drop from the 100% it scored when last tested, though. Along with G Data, Webroot is right in the middle, with as many competitors scoring higher as lower. At the top, Avast and Trend Micro hold perfect 100% scores, while Bitdefender’s 99% puts it in second place.
Do bear in mind, though, that this protection against phishing frauds currently only works in Chrome. If you’re a loyal Apple aficionado, wedded to Safari on your Mac, you won’t get the same protection.
Webroot’s Web Threat Shield extension also checks the links in your search results, marking safe links with a green checkmark icon and dangerous ones with a red exclamation icon. Point to the icon with the mouse for a pop-up that explains the link’s status and, for dangerous links, its category. With Norton’s similar feature, clicking the pop-up explanation gets you a full page of analysis reporting exactly what problems triggered the warning.
There seems to be a trend toward simplicity in some Mac antivirus utilities. Sophos Home Premium for Mac, for example, is so simple it doesn’t even have the standard macOS main menu. Webroot is also on the simple side, but it does throw in some advanced utilities. Experts will appreciate them; ordinary users can ignore them.
Clicking Utilities in the main window reveals two buttons, System Analyzer and Optimize Now. Clicking System Analyzer tells Webroot to make a quick scan of your Mac’s status. On my test Mac, it reported a low amount of available RAM, a high number of processes hogging RAM, and thousands of open files. The fact that I don’t use Time Machine to back up my test system also caught flak from Webroot. It assigned the Mac an overall score of 76 points out of a possible 100.
What to do about those problems? I clicked the adjacent System Optimizer tab and found several choices. Clicking Optimize Now promised to get rid of useless files and browsing traces that reveal your surfing activity. It took about three minutes and reported that it recovered nearly 9GB of disk space.
Back in Advanced Settings, I noticed a page for Secure Erase. By default, Webroot’s secure deletion feature overwrites file data three times before deletion, thereby foiling most attempts at forensic recovery. Raising the slider from Medium to High causes it to perform seven overwrites, which should make even hardware-based forensic recovery impossible. You access the feature itself by clicking Delete Files Securely on the System Optimizer tab.
The final optimization choice involves verifying the status of your Mac’s main hard drive. It finished a scan quickly, reporting “Unresolved issues exist,” but didn’t provide any advice for resolution.
Also on the Utilities page, the System Control list displays all processes that are currently active in your Mac’s memory. As in the Windows product, it shows a status of Allow, Monitor, or Block for each process. You can kill a process by changing its status to Block, though you shouldn’t do so without good reason. Monitor status means that the verdict is still out on whether the process is safe or malicious. Webroot journals all activity by the process and rolls back everything it did if the cloud-based analysis system comes back with a thumbs-down verdict. Testing on Windows, I found that in most cases blocking a monitored program and then running a scan correctly caused Webroot to undo all changes that program made. However, a few pernicious ransomware samples managed to outfox Webroot’s journal-and-rollback system.
Finally, items on the Reports page are handy if you run into trouble. You can save a scan log to share with Webroot tech support here. There’s also an option to submit suspect files directly to Webroot’s research team.
A full antivirus scan with Webroot AntiVirus for Mac finishes in minutes, much more quickly than the nominally quick scans of most of its competitors. It schedules this speedy scan to run daily, and if it detects any malware, it scans again and again until the system comes up clean. Unfortunately, Webroot doesn’t appear in the current reports from the testing labs we follow. Its phishing protection score is down from previous perfection, as is its detection of Windows malware. In addition, it no longer offers the ability to remotely monitor and configure all your Webroot installations.
Webroot isn’t the only speedy product. Bitdefender Antivirus for Mac and Norton 360 Deluxe for Mac both finished a quick scan in just a minute or two, and Norton’s full scan ran in less than seven minutes. Norton took a perfect score in one lab test, and Bitdefender earned two perfect scores. These two remain our Editors’ Choice products for macOS antivirus.
When the IBM PC was new, I served as the president of the San Francisco PC User Group for three years. That’s how I met PCMag’s editorial team, who brought me on board in 1986. In the years since that fateful meeting, I’ve become PCMag’s expert on security, privacy, and identity protection, putting antivirus tools, security suites, and all kinds of security software through their paces.
Before my current security gig, I supplied PCMag readers with tips and solutions on using popular applications, operating systems, and programming languages in my “User to User” and “Ask Neil” columns, which began in 1990 and ran for almost 20 years. Along the way I …
PCMag is obsessed with culture and tech, offering smart, spirited coverage of the products and innovations that shape our connected lives and the digital trends that keep us talking.

source