Free Mac security tools, and what each one actually does
Their names do not tell you what they do, and they overlap less than people assume.
There is a small, unusually good ecosystem of free Mac security tools. The problem is that their names do not tell you what they do, and they overlap less than people assume. Here is what each one actually covers, and where the gaps between them are.
The Objective-See suite
Patrick Wardle's tools are free, open source, and narrowly scoped on purpose. You are meant to run several.
| Tool | What it actually does |
|---|---|
| LuLu | An outbound firewall. When a program tries to make a network connection, LuLu asks you whether to allow it. This is the only free tool on this list that blocks anything. |
| BlockBlock | Watches the places macOS runs things from automatically, and alerts when something new installs itself there. Persistence is the step almost all malware has to take. |
| KnockKnock | The same idea, but as a one-off scan rather than a monitor. It enumerates twenty-odd categories of persistence: launch agents, kernel extensions, browser extensions, QuickLook plugins, login hooks and more. |
| OverSight | Tells you when your microphone or camera turns on, and which app did it. |
| Netiquette | A network monitor. Lists every socket and connection your Mac currently has open. |
Pareto Security
Free for personal use, open source. A menu bar app that audits your settings rather than your traffic: is FileVault on, is the firewall up, is screen lock immediate, is sharing off, are updates current. Thirty-odd checks with one-click fixes for many of them. It answers "is my Mac configured sensibly", which is a genuinely different question from "is anything attacking me".
Little Snitch
Paid, closed source. The long-standing commercial outbound firewall. More capable than LuLu, with a network monitor, rule profiles per location, and much better traffic visualisation. If you want a firewall and are willing to pay, most people end up here.
What macOS already does
Worth knowing before installing anything, because it is more than people expect. Gatekeeper checks apps against Apple's notarization service. XProtect is a built-in malware scanner Apple updates silently. FileVault encrypts the disk. SIP protects system files even from root. TCC gates camera, microphone, screen recording and disk access behind per-app permission.
An up-to-date Mac with FileVault on, the firewall on, and Gatekeeper untouched is already in decent shape. Most of the tools above are about visibility, not additional walls.
The gap none of them fill
Every tool above answers a question about your machine. None of them says much about the network you just walked into, which for a laptop changes several times a day.
Nothing in this list tells you that the café Wi-Fi you just joined is unencrypted, that your VPN silently dropped ten minutes ago, that the router's hardware identity changed while you sat still, that this network configured a proxy for you, or that the dev server you started this morning is now reachable by everyone in the room.
That is the gap Argus was built for. It is free and open source, it reads your Mac's own state and the shape of the network using public macOS tools, and it makes no network connections at all. It deliberately does not block traffic, because blocking requires an Apple entitlement that needs a paid developer account.
A sensible free stack
- LuLu for outbound blocking.
- BlockBlock for persistence, monitored continuously.
- Pareto Security or Argus for settings hygiene.
- Argus for network changes and exposure while you move between networks.
- OverSight if you care about camera and microphone use, though Argus now covers the on/off signal too.
They are all lightweight and they do not conflict, because only one of them is in the traffic path.
Argus watches this for you
A free, open-source Mac app that tells you in plain English when your network or your Mac's exposure changes. It lives in the notch, makes no network connections, and weighs 655 KB.
Download for Mac