Advanced Plus Security SpiderWeb's PC Security Config

[SpiderWeb]

 

[MuzzMelbourne]

Very nice...

 

[SpiderWeb]

I think I settled for a 3rd party AV for now. Kaspersky Plus

Tried:

• K7 Ultimate - Nothing wrong with it. Extremely light. Fast scans. No web protection. Just wanted to try something with more features on macOS
• Malwarebytes Premium - Simple and fastest scans of them all. Slows down browsing, apps and file access when real-time protection is on.
• Norton 360 - Great detection. Slows down apps and browsing, does not protect you during startup. Some features not working. Absolutely love LifeLock.
• Bitdefender - Actually my favorite. Lightest on macOS. But does not offer scheduled scans (????) and does not protect network drives unless you manually scan.
• Eset Premium - Best feature set, but all locked behind Premium price tag. Way too expensive in comparison to:
• Kaspersky Plus - Settled for this because it protects network drives with scheduled scan, scans network devices. Light. No firewall unfortunately.

All of these are severely reduced down versions of what you get on Windows. They are so limited, I think even the free Windows versions have more features sadly which honestly explains why nobody on macOS can be bothered paying for an AV. I cannot justify the price tag on any of them for the feature set. But, Kaspersky Plus is free for the rest of the year and they detected Pegasus so I will have it on my system until it gets nerfed by the US government.

 

[simmerskool]

I think I settled for a 3rd party AV for now. Kaspersky Plus

Tried:

• K7 Ultimate - Nothing wrong with it. Extremely light. Fast scans. No web protection. Just wanted to try something with more features on macOS
• Malwarebytes Premium - Simple and fastest scans of them all. Slows down browsing, apps and file access when real-time protection is on.
• Norton 360 - Great detection. Slows down apps and browsing, does not protect you during startup. Some features not working. Absolutely love LifeLock.
• Bitdefender - Actually my favorite. Lightest on macOS. But does not offer scheduled scans (????) and does not protect network drives unless you manually scan.
• Eset Premium - Best feature set, but all locked behind Premium price tag. Way too expensive in comparison to:
• Kaspersky Plus - Settled for this because it protects network drives with scheduled scan, scans network devices. Light. No firewall unfortunately.

All of these are severely reduced down versions of what you get on Windows. They are so limited, I think even the free Windows versions have more features sadly which honestly explains why nobody on macOS can be bothered paying for an AV. I cannot justify the price tag on any of them for the feature set. But, Kaspersky Plus is free for the rest of the year and they detected Pegasus so I will have it on my system until it gets nerfed by the US government.

fwiw I've been running mbam on my mac_mini (& wife's iMac). once upon a time, many years ago, I tried various 3d-party av on my macbookpro and one was problematic and the other borked the mbp. Relatively high level Apple support tech more recently told me that mbam is best for macOS as it does not interfere with how Apple protects macOS. Slowdown, if any, on my mini is not noticeable to me. I'm curious to try Norton or ZA anti-ransomware @Trident mentioned, but then my curiosity fades... but still undecided... I'd like to see an Apple online av scanner for a safe occasional scan.

 

[SpiderWeb]

fwiw I've been running mbam on my mac_mini (& wife's iMac). once upon a time, many years ago, I tried various 3d-party av on my macbookpro and one was problematic and the other borked the mbp. Relatively high level Apple support tech more recently told me that mbam is best for macOS as it does not interfere with how Apple protects macOS. Slowdown, if any, on my mini is not noticeable to me. I'm curious to try Norton or ZA anti-ransomware @Trident mentioned, but then my curiosity fades... but still undecided... I'd like to see an Apple online av scanner for a safe occasional scan.

Yes I think it depends on the software on your device. They are all fast, even Norton 360. I should have phrased it differently. I suspect some AVs have more conflicts with all the other programs on my computer than others. But, I believe Bitdefender, Kaspersky and Eset did better for real time protection while MBAM did much much better for on-demand scanning, at least on macOS. Ultimately I could have gone with anyone of them and be happy, but Kaspersky Plus had the most of the feature set I wanted.

 

[SpiderWeb]

I had to roll back to Bitdefender unfortunately. I came home to a message that macOS had a kernel panic. Kaspersky is not compatible with my setup and causes random RAM leaks for now but that's ok.

 

[simmerskool]

I had to roll back to Bitdefender unfortunately. I came home to a message that macOS had a kernel panic. Kaspersky is not compatible with my setup and causes random RAM leaks for now but that's ok.

wow but not surprised based on personal mac experience(s). That's why I'm using Malwarebytes, some (extra) protection is better than a bad apple

 

[SpiderWeb]

Very happy with Bitdefender. It is actually working, tested generic drive-by downloads and archived files and it cleans all of them even if they haven't completed download yet. I added Little Snitch Mini as a firewall and it's already worth every penny. The ability to add blocklists cuts so much work out for people who are looking for a general ruleset. I added HaGeZi Threat and Fabezi Malicious Blocklist to really solely focus on removing threat vectors that apps tend to connect to without causing the apps themselves to break. It shows you every domain or IP a program is connected to and provides it on a world map. None of my connections are going anywhere near Russia or China so that is a relief. The most active connections are the browsers, cloud stoage providers (iCloud, Proton Drive, etc), and macOS which seems to constantly check where all my other Apple devices are to stay in sync.

Fun detail: The two connections that point into the Atlantic Ocean are Tailscale VPN and my Local Network. Both use reserved private IP ranges that don't map to anywhere in the world. The other one pointing into the Pacific Ocean is actually legit, it's Hawaii. I guess it was a wise decision to pick a place in the middle of an ocean to avoid overlap.

 

[Trident]

I had to roll back to Bitdefender unfortunately. I came home to a message that macOS had a kernel panic. Kaspersky is not compatible with my setup and causes random RAM leaks for now but that's ok.

Are you using a version that still allows kext? Because with a user mode extension it is nearly impossible to get kernel panic.

 

[SpiderWeb]

SpiderWeb's Macbook Air 27 · Setup v3
Updated Oct 1, 2026

What changed

• Real-time protection: Bitdefender
  Micro Snitch → Nick
  Micro Snitch
• Periodic malware scanners: Bitdefender → Nick
• Browsers and extensions: Tor Browser
  -DuckDuckGo
  -NoScript
  -uBlock Origin
  
  Safari
  -DuckDuckGo
  -Bitdefender Traffic Light
  -uBlacklist
  -SponsorBlock
  -Wipr
  -uBlock Origin Lite → Tor Browser
  -DuckDuckGo
  -NoScript
  -uBlock Origin
  -Osprey Browser Protection
  
  Safari
  -DuckDuckGo
  -Wipr 2
  -SponsorBlock
  - Ad Sensei (AI only)
  -uBlock Origin Lite (Optimal Mode)
  -3P Matrix Lite
• Secure DNS: NextDNS
  ControlD Uncensored → ControlD
• System recovery: Synology Snapshots → Mac Snapshots
  Synology Snapshots
• Router and network details: Verizon CR200A Gateway → T-Mobile 5G Gateway
• Operating system: macOS 15 Sequoia → macOS 27 Golden Gate
• Notable changes: Upgraded to macOS Sequoia → Not specified
• Computer specs: M1 Macbook Air 256GB → M3 Macbook Air 512GB
• OS version and support details: Not specified → 27.0.1
• Device sign-in security: Older selection — review required → Hardware security key, Windows Hello PIN or biometric sign-in (face / fingerprint / Touch ID), Account password
• User Account Control (UAC): Older selection — review required → Not applicable - not running Windows
• Smart App Control: Older selection — review required → Not applicable / not available on this device
• Two-factor authentication: Not specified → Bitwarden Premium
• Usage and exposure: Older selection — review required → Visiting familiar websites, Browsing the dark web, Making audio/video calls, Opening email attachments, Online shopping and card payments, Logging into my bank account, Downloading software and files from reputable sites, Streaming audio/video content from trusted sites or paid subscriptions, Streaming from untrusted sites, Coding and development
• Feedback preference: Older selection — review required → Showcase only - no advice requested
• Setup name: SpiderWeb's Macbook Air '24 → SpiderWeb's Macbook Air 27

Spoiler: Full setup snapshot

My current setup

• Operating system: macOS 27 Golden Gate
• Real-time protection: Nick
  Micro Snitch
• File and photo backups: iCloud+
  Synology Drive
• Device firewall: Other - Internet Security (3rd-party)
• Browsers and extensions: Tor Browser
  -DuckDuckGo
  -NoScript
  -uBlock Origin
  -Osprey Browser Protection
  
  Safari
  -DuckDuckGo
  -Wipr 2
  -SponsorBlock
  - Ad Sensei (AI only)
  -uBlock Origin Lite (Optimal Mode)
  -3P Matrix Lite
• Main use of this computer: For home and private use
• OS version and support details: 27.0.1
• On-device encryption: macOS FileVault
• Device sign-in security: Hardware security key, Windows Hello PIN or biometric sign-in (face / fingerprint / Touch ID), Account password
• Security updates: Allow security updates and latest features
• Update channels: Allow stable updates only
• User Account Control (UAC): Not applicable - not running Windows
• Smart App Control: Not applicable / not available on this device
• Network firewall: Enabled
• Router and network details: T-Mobile 5G Gateway
• Custom security settings: Little Snitch Mini
  Privileges
• Periodic malware scanners: Nick
• Malware sample testing: I do not participate in malware testing
• Environment for malware testing: None
• Secure DNS: ControlD
• Desktop VPN: Tailscale
  Apple Private Relay
• Password and passkey manager: Bitwarden Premium
• Two-factor authentication: Bitwarden Premium
• Maintenance tools: AppCleaner
  Latest
• Subscriptions: Apple iCloud+ 50GB
• System recovery: Mac Snapshots
  Synology Snapshots
• Usage and exposure: Visiting familiar websites, Browsing the dark web, Making audio/video calls, Opening email attachments, Online shopping and card payments, Logging into my bank account, Downloading software and files from reputable sites, Streaming audio/video content from trusted sites or paid subscriptions, Streaming from untrusted sites, Coding and development
• Computer specs: M3 Macbook Air 512GB
• Feedback preference: Showcase only - no advice requested

Shared as my personal configuration.

 

[SpiderWeb]

Thank you to the admin's for updating the macOS section to include the latest version. I have since upgraded to a new M3 MacBook Air. The setup had stayed the same until macOS 27 made a lot of things incompatible so I decided to comb through the system and find new apps and extensions. Viaduct enables me to convert any Chrome extension into Safari but obviously not everything works but the ones I have work without issue.

 

[LinuxFan58]

@SpiderWeb

I see you are running 3P-Matrix-lite on Safari. I did not know it was possible to convert Chrome extensions with Viaduct

Does Mac still has a build-in security that only Apple approved executables can run? And on top you have bitdefender! Tough guy to beat

 

[SpiderWeb]

@SpiderWeb

I see you are running 3P-Matrix-lite on Safari. I did not know it was possible to convert Chrome extensions with Viaduct

Does Mac still has a build-in security that only Apple approved executables can run? And on top you have bitdefender! Tough guy to beat

Yeah it works! Viaduct basically allows you to click install in the Chrome Web Store, then auto-converts to Safari APIs and uses a self signed on-device certificate so Safari and Mac treat it like any other safe extension.

But, it really speaks to your careful and well thought out design and programming philosophy to commitment to Manifest V3 that UI and rules work flawlessly in Safari 27! I was amazed.