Built-in macOS Security Tools

This report provides a technical overview of macOS’s built-in security stack—TCC, File Quarantine, Gatekeeper, XProtect, Malware Removal Tool, and XProtect Remediator—explaining how they interoperate in a check–block–remediate model, from quarantine metadata and Gatekeeper’s signature/notarization and allow/block lists to XProtect’s YARA-based detections and remediation workflows, with emphasis on the platform’s evolution from MRT to XProtect Remediator’s scheduled scans and practical considerations like Gatekeeper overrides and when additional security tooling may be warranted.