What a Free Mac Security Scan Actually Finds

A free Mac security scan is not a full virus hunt. It checks what your Mac is doing right now — the processes running, the permissions apps hold, and what is open to your network — and shows you the parts macOS keeps out of sight. The result is usually surprising, because most of us have never actually looked.

Here is what a free Mac security scan checks, and the kinds of things it commonly finds on an everyday Mac.

What CoreLock's scan actually checks

CoreLock is not an antivirus. Most of its scan checks your Mac's current state rather than hunting for viruses. Its one file check compares files in your Downloads folder against a built-in list of known-malware SHA-256 hashes and CoreLock's malware-signature (YARA) rules.

The scan runs six checks: running apps, network, app permissions, login and background items, AI agents, and your Downloads folder. It runs every 15 minutes by default, and any time you click Scan Now. Here is what the main checks look at:

Running apps. CoreLock looks at the 100 busiest processes. It flags known-bad tools, such as crypto miners, and risky command lines, such as reverse shells, download-and-run commands and encoded commands.

Permissions. With Full Disk Access, CoreLock reads your Mac's privacy permissions: camera, microphone, contacts, photos, files and folders, Screen Recording, Accessibility, Full Disk Access, Input Monitoring and more. It flags sensitive permissions left behind by apps you removed.

Network. CoreLock lists services on your Mac that are listening for connections from other devices. Listening doesn't prove anyone can reach them. The Network screen separately lists your apps' open connections by IP address and port.

Login items, AI agents and Downloads. CoreLock reviews the LaunchAgents and LaunchDaemons folders and flags unsigned or unusual items. It checks for supported AI agents that are running. And it checks your Downloads folder against its list of known-malware hashes and its malware signatures. A signature match is a reason to look at the file, not proof it's harmful.

You can learn more about each capability on the features page.

What the scan commonly surfaces

The specifics vary from Mac to Mac, but the same categories of finding show up again and again. Here is what to expect.

Camera and microphone access: more apps than you'd guess

If you have not audited it, the number of apps that can reach your camera and microphone is almost always higher than you expect. Every video-conferencing tool, every browser, every screen recorder, and plenty of apps you have forgotten about accumulate this access over time — and macOS never prompts you to review it.

Once you look, it is common to find a dozen or more apps with camera access, and often more with microphone access, since audio-only tools add to the count. If you want to understand why this matters and what to do about it, I wrote a detailed breakdown in Apps on Your Mac That Probably Have Camera Access Right Now.

Full disk access: the permission people forget about

Full disk access is one of the most powerful permissions on macOS. An app with it can read every file on your machine — documents, photos, messages, browser history, everything.

It is common to find this permission still granted to apps that no longer need it: backup utilities that have been replaced, old antivirus tools that were uninstalled but whose permissions lingered, or developer tools used once for a project and never again. Because the permission is so powerful, it deserves careful attention. CoreLock's Privacy screen lists which apps hold Full Disk Access, and its scan flags grants left behind by apps you removed. You turn access off in System Settings. See our full disk access guide for how to audit yours.

Running processes: far more than you think

A typical Mac runs several hundred processes at any given moment — macOS itself accounts for well over a hundred just to keep the system running. Most people assume it is a few dozen. It is not.

Almost all of those processes are legitimate. But buried in that list there are usually a handful worth a second look: processes with missing or invalid code signatures, helper processes running from unexpected file paths, or processes using network bandwidth with no obvious reason. CoreLock's scan flags known-bad tools and risky command lines among the 100 busiest processes. It doesn't check every process's signature, so a manual look still helps. I covered this in depth in The Hidden Processes Running on Your Mac.

Outbound network connections: who is your Mac talking to?

At any moment your Mac is maintaining a number of active outbound connections. Most go to expected servers — Apple, Google, Microsoft, Cloudflare, CDN providers. But it is common to find a few connections to destinations you cannot immediately identify or explain.

Often these turn out to be analytics services baked into apps, telemetry from developer tools, or cloud-sync features you forgot you enabled. Occasionally one is worth investigating further. The point is not that every unknown connection is malicious — it is that you had no visibility into any of them until you looked.

Stale permissions: the ghost of apps past

This is the finding people tend to find most interesting. macOS does not automatically revoke permissions when you uninstall an app. If you dragged an app to the Trash six months ago, its camera access, microphone access, and accessibility permissions might still be sitting there, active and waiting. If you ever reinstall that app — or if anything takes over that app's bundle identifier — it inherits all those old permissions instantly.

It is common to accumulate several of these stale permissions over a couple of years of installing and removing software, and they are among the easiest things to clean up once you can see them.

The findings that catch people off guard

Beyond the categories above, a few things consistently surprise people once a scan surfaces them.

Accessibility permissions that make no sense

The accessibility permission is enormously powerful. It lets an app control your Mac, simulate keyboard input, read the contents of any window, and monitor your actions. It is essential for screen readers and certain productivity tools, but it is common to find it granted to apps — note-taking tools, weather apps, file managers — that have no legitimate need for it.

These apps request accessibility access during installation, and users click Allow because they do not understand what the permission does. Then the permission sits there forever. CoreLock's Privacy screen lists which apps hold Accessibility access. To turn one off, go to System Settings, then Privacy and Security, then Accessibility.

Launch agents from years ago

A scan often turns up launch agents and daemons — background items that start automatically when you log in or boot — from software installed years ago and no longer used. An app you installed once, used twice, and forgot about can keep launching silently every day, running in the background, using resources, and maintaining an outbound connection to its developer's servers.

Background processes that phone home

Many Macs have processes that periodically send data to remote servers with no user-visible activity. Usually these are not malware — they are legitimate apps with built-in analytics, crash reporting, and update checking. But most people have no idea it is happening, and given the choice, many would prefer it were not.

The issue is not that these apps are doing something evil. The issue is that you have no visibility into what is happening on your own machine unless you actively go looking for it.

What the scan does not find

I want to be clear about the boundaries. CoreLock's scan is a security audit, not antivirus software. Here is what it does not do:

It does not look inside Mac app bundles or scan your whole disk. The scan checks your Downloads folder against a built-in list of known-malware hashes and 19 malware-signature (YARA) rules, so it only catches files that match them. Nothing is quarantined automatically. Files › Quick scan covers Downloads, Desktop and LaunchAgents. The Pro Full scan adds Documents, the launch folders and /Applications, but skips inside .app bundles. Neither covers external drives.

It does not check for phishing or social engineering. CoreLock analyzes your Mac's security posture, not your email inbox or browser history.

It does not monitor in real time. Each scan is a point-in-time snapshot. Background scans run every 15 minutes by default, on Free and Pro.

What the scan does is give you a clear view of your Mac's current state: busy processes, granted permissions, listening services, login items, AI agents and Downloads. It is a layer of visibility that macOS does not give you natively.

How to act on your results

After you run the scan, you will get a report organized by severity. Here is how I recommend working through it.

Start with the red flags. Anything CoreLock marks as high severity deserves immediate attention. These are things like known-bad tools, risky command lines, or unsigned login items.

Clean up stale permissions. This is the easiest win. Go through any permissions flagged as stale and revoke them. There is zero downside to removing a permission for an app you no longer use.

Review accessibility and full disk access. These are the two most powerful permissions on macOS. If an app has either of these and you are not sure why, revoke the access. If the app truly needs it, it will ask again.

Check your login items. Remove anything you do not recognize or no longer use. Your Mac will boot faster and run cleaner.

Investigate flagged processes. For any process CoreLock flags, take a moment to understand what it is. If something looks wrong, research it further.

Run the scan yourself

Every Mac has its own story. Maybe you are unusually careful about permissions and your results will be clean. Maybe you have been using the same Mac for five years without ever auditing your security settings and the results will be a wake-up call.

Either way, the scan is free and does not require any configuration. Download CoreLock, click scan, and see what is actually happening on your Mac.

Download CoreLock free and run your first scan. The results might surprise you.