SE Labs says Macs need third-party protection against targeted attacks

SE Labs found that four Mac security products stopped all 11 targeted attacks in its latest test, while macOS built-in defenses and ClamXAV were compromised in every scenario. The results raise fresh questions about how well Apple’s native protections hold up against modern macOS threats.

Why it matters: - SE Labs’ latest macOS test suggests built-in Apple protections may not be enough against targeted attacks. - The results matter for consumers and enterprises that assume Macs are safer by default than other endpoints. - The findings also point to a growing need for real-time anti-malware protection on macOS.

What happened: - SE Labs released its latest macOS Anti-Malware Evaluation Test on Sept. 22, 2026. - Bitdefender, ESET, Norton 360 and TotalAV Premium stopped all 11 targeted attacks in the test. - macOS with built-in security enabled and Canimaan Software ClamXAV were compromised in every scenario. - The test used spear-phishing emails as the initial attack path.

The details: - SE Labs’ testers used a “Test Like Hackers” approach after gaining initial control. - The simulated attacker actions included gathering system information, stealing files, spying on the network and encrypting data like a ransomware attacker. - Testers also attempted to hide their tracks. - Some tasks required privilege escalation. - Testers were able to achieve privilege escalation when no third-party real-time protection was installed. - In SE Labs’ analysis, Bitdefender Antivirus for Mac, ESET Home Security Essential, Gen Digital Norton 360 and TotalAV Premium each reached 100% Protection Accuracy. - Canimaan Software ClamXAV and macOS both scored -125%, reflecting penalties for each failed attack. - SE Labs said the report is available as a free download on its website.

Between the lines: - SE Labs is pushing back on a long-running assumption that Macs are inherently secure. - That message lands as targeted attacks and attacker tools for macOS continue to increase. - The company also highlighted a gap between product marketing and real-world protection. - Apple’s messaging emphasizes that security is “built right in,” while ClamXAV says it will “Protect your Mac without slowing it down.” - The broader threat picture includes infostealers such as Atomic macOS Stealer, Poseidon and Banshee. - SE Labs also pointed to threat actors, including North Korea-linked Sapphire Sleet, using fake software and update lures.

What’s next: - Mac users and IT teams are likely to face more pressure to add third-party protection rather than rely on native defenses alone. - SE Labs’ report is likely to fuel more scrutiny of macOS security claims and product claims from antivirus vendors. - As enterprise Mac adoption grows, targeted attacks against macOS may keep expanding as an attacker priority.

The bottom line: - SE Labs’ test says four third-party products blocked every targeted attack, while macOS built-in defenses and ClamXAV did not.