# Antivirus or behaviour watching? What a scan for known files misses, and what a small Mac team needs. > What a scan for known files misses, what a tool that watches behaviour adds, and what a small team on Macs needs. Apple's protections included. Page: https://cybee.ai/blog/antivirus-vs-edr/ (Antivirus vs EDR for a small Mac team, explained) - [Blog](https://cybee.ai/blog/) - Antivirus or behaviour watching mac security Your Mac already scans for known bad software, and you can pay for more. This guide sets out what a scan can and cannot see, what a tool that watches behaviour adds, and what a team of five or ten on Macs has to decide. By [Cybee](https://cybee.ai/about/#founders) Published 28.10.2026 8 minute read In one minute - A scan for known files compares what it finds with a list of software someone has already studied. A new program, or an attack that uses no file, gives it nothing to match. - A tool that watches behaviour looks at what programs do: starting themselves at every login, reading stored passwords, switching protections off. - Apple’s own protections are real and on by default. Keep macOS up to date and they keep working. - No tool on a Mac sees a sign in made with a stolen password to a cloud service. That needs checks of its own. - For a client or an insurer, what you can show afterwards matters as much as what a tool caught. ## Is a virus scan enough for a small team on Macs? A scan is a sound start, and on a Mac you already have one. It is not the whole answer. A scan matches files against a list of known bad software. A program written last week is on no list, and some attacks leave no file to match. A tool that watches behaviour covers that gap by looking at what programs do once they run. For a team of five or ten on Macs, the practical plan is to keep Apple’s protections switched on, add something that watches behaviour, and keep a dated record you can show when a client asks. **Q:** What is a signature? ### What a signature is. A signature is the fingerprint of a piece of software that someone has already studied: a short pattern that identifies it. A scan compares your files with a long list of these patterns. A match means a known threat. No match means only that the scan has no pattern for that file. That is different from saying the file is safe. **Q:** What is EDR? ### What EDR means. EDR stands for endpoint detection and response. An endpoint is any computer your team works on. EDR is the name of a product category: software that records what programs do on each computer, spots patterns that look like an attack and responds to them. Cybee does the behaviour part on Macs. It holds no EDR certification, and nobody at Cybee reads your alerts for you. [How Cybee protects a Mac](https://cybee.ai/docs/protection/) ## What does Apple already protect? More than most people assume. Before a program from outside the App Store opens, macOS checks the developer’s signature and, by default, expects Apple to have scanned the program for known malware first, a step called notarization. That scan is a check made at one moment, and Apple can revoke a program it later finds to be malicious. XProtect, Apple’s own set of known malware patterns, checks apps when they first open, when they change and whenever Apple updates the patterns, which it does separately from macOS updates. It removes what it recognises, and because its patterns are broader than exact file fingerprints it can catch variants Apple has not seen. Apple’s guide also mentions a behaviour engine inside XProtect without describing how it works. Apple describes these layers as the first line of defence, aimed at stopping malware from starting. Limiting the damage of something that has already started is a separate layer in the same guide. And none of it is designed to tell you which of your Macs had these protections on last month. ## What does a scan for known files miss? Say a five person agency. A designer opens a file from a message that looks like a client’s. It starts a short script, and the script uses only tools every Mac already has, Terminal among them. It sets itself to start again at every login, then goes looking for saved passwords. Nothing in it is on a list of known bad software, because every piece is ordinary. The US cybersecurity agency CISA published joint guidance on this in February 2024. It covers attackers who work with legitimate tools already on a system, and it says defenders find it hard to tell that activity from normal use. A stolen password is a different case. The attacker signs in to your email or file sharing from somewhere else. Nothing runs on your Mac, so neither a scan nor a behaviour watcher on the Mac can see it. That is a job for the account itself: a second code at sign in, and the service’s own sign in log. > A scan can only match what someone has already described. ## What does watching behaviour add? It asks a different question. Not “what is this file?” but “what is this program doing?”. A program that rewrites hundreds of documents within a minute looks unlike a person saving work, whatever the program is called. The same goes for a program that switches off a protection or starts hunting for passwords. The price is judgement. A watcher can flag something harmless, so somebody has to decide what an alert means. The table puts the two approaches next to what Cybee does on a Mac. Figure: The first two columns describe the approach in general, not one product. The third states what Cybee does. ## What does it cost in money and effort? Tools that watch behaviour were first built for companies with a security team: someone reads the alerts, tunes the rules and decides what to do. In a team of eight, nobody has that job. So the question that matters is less the price than who reads the alert on a Friday evening. Prices differ by package and by quote, so this guide names none. Cybee does not read the alert for you. Protection is free on every Mac, and when something looks wrong, the alert reaches you where you already are: in the chat with your AI assistant, as a macOS notification, in Slack, or on a phone by WhatsApp or SMS. Cybee subscription The sealed Trust Passport and security training are part of the Cybee subscription: CHF 9 per Mac per month, or 90 a year, excluding tax, with a 14 day trial. Protection and the 118 checks stay free on every Mac. [Cybee and CrowdStrike](https://cybee.ai/compare/crowdstrike/)[Cybee and Microsoft Defender](https://cybee.ai/compare/microsoft-defender/) ## How should a small team choose? Skip the label on the box. Antivirus, EDR and “next generation” describe the marketing more than the product. Ask five plain questions of any tool, Cybee included. Figure: Nobody ticks these. Read them against the product page before you pay. When does a plain scan do? A freelancer with one Mac, no client data and automatic macOS updates may be well served by what Apple ships. That changes the day a client sends a questionnaire or an insurer asks what runs on each laptop. From then on the answer has to be something you can show, not something you believe. ## What to remember. - Apple’s protections are real. Keep them on and keep macOS up to date. - A scan matches the known. Behaviour watching looks at what programs do. A stolen password used in a cloud account is neither one’s job. - Choose by what a tool watches, who reads its alert and what you can show. ## Sources. Written by Cybee for small teams. The outside pages were read on 28.10.2026. The documentation says what Cybee covers today. - [Apple: protecting against malware in macOS](https://support.apple.com/guide/security/protecting-against-malware-sec469d47bd8/web) - [Apple: safely open apps on your Mac](https://support.apple.com/en-us/102445) - [CISA: identifying and mitigating living off the land techniques](https://www.cisa.gov/resources-tools/resources/identifying-and-mitigating-living-land-techniques) - [Cybee: how protection works](https://cybee.ai/docs/protection/) ## See what one alert looks like. What the program did, which Mac it ran on and the one decision left to you. [Review an alert before you act](https://cybee.ai/use-cases/security-alerts/) On this page - The short answer - What Apple already protects - What a scan misses - What watching behaviour adds - Money and effort - How to choose - What to remember - Sources Cybee Watches what programs do on your Macs and tells you in the chat. Protection is free on every Mac. [See how it works](https://cybee.ai/docs/protection/) ## The next question someone asks. Three more guides. [Mac security Are Macs secure enough for a small business? What your Mac already protects, what your business still needs to check and how to keep a useful record. Read the guide](https://cybee.ai/blog/mac-security-small-business/) [Mac security What happens after a security check? The step between finding a weak setting and changing it safely, worked through on one screen lock. Read the guide](https://cybee.ai/blog/checking-and-hardening/) [client requests What evidence should you prepare for cyber insurance? What an insurer asks about your Macs, and what to have ready before the renewal. Read the guide](https://cybee.ai/blog/cyber-insurance-evidence/) ## Your next client will ask. Be ready. `curl -sSf https://get.cybee.dev | sh` Run it in Terminal, a chat, your IDE or a CLI. Keep working where you started. What the command does - Installs a notarized agent on this Mac. - Creates no account. The install is identified by a token. - Starts protecting the device at once. - Changes no setting until you confirm it in your AI assistant. - Asks for this Mac’s administrator password once, and for no email address. Free for every Mac with an Apple chip · Asks before it changes your Mac [What it installs](https://cybee.ai/docs/install/#see) [Read the install script](https://get.cybee.dev)