You’re at a coffee shop, you step away for two minutes, and your MacBook is sitting there, unlocked, logged in, broadcasting your full name to every device on the network. It’s an uncomfortable thought. And the threat isn’t just physical anymore.
Public Wi-Fi is still a hunting ground. CVE-2026-28865, patched in macOS Sequoia 15.7.5, let an attacker in a privileged network position (like someone controlling the Wi-Fi access point or router you’re connected to) intercept 802.1X-authenticated traffic. That’s not theoretical. That’s a real vulnerability that existed on unpatched Macs this year.
The good news: macOS in 2026 has serious built-in defenses. FileVault, the Secure Enclave, Gatekeeper, XProtect, sandboxing, and TCC permissions are all there. But none of it matters if you haven’t turned it on.
These steps won’t stop a nation-state. But they will stop the opportunist at the airport, the script kiddie on the coffee shop Wi-Fi, and the thief who grabs your bag and hopes you didn’t bother with encryption. Let’s make your Mac a much harder target.
1. Set a Strong Login Password and Lock Your Screen Immediately
If your Mac has no login password, everything else in this article is irrelevant. Anyone who sits down can walk straight in.
Go to System Settings > Lock Screen. Set Require password after screen saver begins or display is turned off to Immediately. No grace period. No “after 5 minutes.” Immediately.
While you’re there, enable Show message when locked. You can put a contact email in case your Mac gets lost, which costs you nothing and might actually get it returned.
To set or change your login password, go to System Settings > Users & Groups, select your account, and click Change Password. Make it long. A passphrase like coffee-airport-tuesday-lamp is far stronger than P@ssw0rd1 and easier to remember.
2. Turn On FileVault
This is the single most important thing you can do. If your Mac is stolen and FileVault is off, the thief can pull the drive, mount it on another machine, and read every file on it. With FileVault on, the drive is encrypted and useless without your password.
Go to System Settings > Privacy & Security > FileVault and click Turn On.
You’ll be given a recovery key. Store it somewhere that isn’t your Mac: a password manager, a printed copy in a safe, or iCloud Keychain. If you forget your login password and lose the recovery key, your data is gone. That’s the trade-off, and it’s worth it.
On Apple Silicon Macs (M1 and later), FileVault is backed by the Secure Enclave, which makes brute-force attacks against it essentially impossible with current hardware. On older Intel Macs, it’s still strong, so just make sure your password isn’t weak.
Initial encryption takes a few hours. Leave it plugged in and let it run.
3. Enable Find My and Activation Lock
Find My does two things: it lets you locate a stolen Mac on a map, and more importantly, it enables Activation Lock, which ties the device to your Apple ID. Even if someone wipes the drive, they can’t set it up without your credentials. That makes your Mac worthless to resell, which is a meaningful deterrent.
Go to System Settings > [Your Name] > iCloud > Find My Mac and toggle it on. Enable Find My network too. This lets the Mac broadcast its location even when offline, using nearby Apple devices as relays.
On Apple Silicon Macs (M1 and later), Activation Lock isn’t just a software flag Apple checks after the fact – it’s enforced by the boot firmware itself. The Mac’s Low-Level Bootloader won’t start macOS at all without a valid, cryptographically signed LocalPolicy tied to the Secure Enclave. If that policy is missing or invalid, the Mac drops into recoveryOS and has to check in with Apple’s activation servers before it’ll boot anything. That’s a meaningfully different, harder-to-defeat guarantee than the “find my device” software on an Intel Mac or most Windows laptops, where a determined thief can sometimes wipe and reinstall around the lock.
4. Lock Down Your System Settings
macOS has a padlock mechanism that prevents unauthorized changes to sensitive settings. In older versions this was a literal padlock icon in System Preferences. In System Settings on macOS Ventura and later, individual panes require authentication before changes can be made, but it’s worth knowing how this works.
If someone sits down at your unlocked Mac, they can’t change your security settings without your administrator password, as long as your screen is locked (see step 1). This is why the lock screen matters so much. It’s the gate everything else depends on.
5. Stop Using Your Mac as an Administrator
Most people set up their Mac, create one account, and use it for everything. That account is almost certainly an administrator account. The problem: if malware runs under an admin account, it has significantly more access to do damage.
The fix is to create a separate Standard account for everyday use, and only use your admin account when macOS explicitly asks for it.
Go to System Settings > Users & Groups, click the + button to add a new user, and set the account type to Standard.
Log out of your admin account and use the Standard account day-to-day. When you need to install software or change a system setting, macOS will prompt for your admin credentials. You enter them, the action completes, and you’re back to limited privileges. It’s a small friction that pays off significantly if something malicious tries to run.
6. Disable the Guest User Account
macOS includes a Guest User option that lets someone log in without a password. The intent is benign, letting a friend borrow your Mac without accessing your files. The reality is more complicated.
Guest users can access all your installed apps, and on a Unix system like macOS, the shared /tmp directory is world-writable by design, so it’s a spot where scripts can drop files. Unless you have a specific reason to keep Guest enabled, turn it off.
Go to System Settings > Users & Groups and toggle off Guest User.
7. Turn On Automatic Updates, and Actually Let Them Install
The CVEs mentioned earlier, the 802.1X interception bug and the kernel network flaw (CVE-2026-20671), were all patched by Apple. The only Macs that stayed vulnerable were the ones that didn’t install the update.
Go to System Settings > General > Software Update and enable Automatic Updates. Click the info icon next to it and make sure all the sub-options are checked: downloading updates, installing macOS updates, installing app updates from the App Store, and installing security responses and system files.
The “security responses and system files” option is worth calling out specifically. Apple can push Rapid Security Responses — small, targeted patches that install much faster than a full macOS update and often without a restart, though some may still prompt you to restart. These are your fastest protection against actively exploited vulnerabilities. Keep that toggle on.
8. Turn On the Firewall
macOS’s built-in firewall blocks unsolicited incoming connections. It’s not the complex, rule-heavy firewall you might associate with Windows. It’s a one-click toggle that does most of the work automatically.
Go to System Settings > Network > Firewall and turn it on.
You don’t need to configure anything in Firewall Options for a standard setup. The defaults are sensible. If you want to go further, enable Stealth Mode. It stops your Mac from responding to network probes, making it invisible to port scanners. Find it under Firewall Options at the bottom of the Firewall pane.
9. Tighten Up Wi-Fi Security
Public Wi-Fi is where passive attacks happen. Even with the firewall on, a network sniffer on the same hotspot can potentially intercept unencrypted traffic. Here’s how to reduce that exposure.
Use a VPN on public networks. Mullvad and ProtonVPN are both solid options that don’t log your traffic. This is the most effective single step for public Wi-Fi security. WireGuard-based VPNs are fast enough that you’ll barely notice it’s running.
Enable MAC address randomization. Go to System Settings > Network > Wi-Fi, click Details next to your current network, and check Limit IP address tracking. For public networks, also look for the Private Wi-Fi Address option. This rotates your MAC address so networks can’t track you across sessions.
Disable auto-join on public networks. In the same Details panel, uncheck Auto-join for any public hotspot you’ve connected to. You don’t want your Mac silently connecting to a spoofed “Starbucks WiFi” network without your knowledge.
10. Review App Permissions in Privacy & Security
macOS’s TCC (Transparency, Consent, and Control) system requires apps to ask before accessing your camera, microphone, location, contacts, files, and more. But permissions you granted years ago may no longer be appropriate, especially for apps you rarely use.
Go to System Settings > Privacy & Security and work through the categories: Camera, Microphone, Location Services, Files and Folders, Full Disk Access. Revoke access for anything that doesn’t have a clear reason to need it.
Full Disk Access in particular is worth scrutinizing. Any app with Full Disk Access can read essentially everything on your Mac. If something in that list surprises you, remove it.
11. Anonymize Your Mac’s Network Name
When your Mac connects to a network, it broadcasts a name. If that name is “Sarah’s MacBook Pro,” you’ve just told everyone on the network exactly what device you’re using and who owns it. Not a catastrophic vulnerability, but unnecessary information to hand out.
Go to System Settings > General > Sharing. At the top, you’ll see your computer’s name. Click Edit next to it and change it to something generic, such as a random word, a fake model number, or anything that doesn’t identify you or the device type.
Keep Use dynamic global hostname unchecked.
12. Turn Off Sharing Services You Don’t Need
While you’re in System Settings > General > Sharing, scroll through the list of sharing services. Screen Sharing, File Sharing, Remote Login, Remote Management. If you’re not actively using them, turn them off. Each one is a potential entry point.
Content Caching is generally fine to leave on. It speeds up downloads for other Apple devices on your network and doesn’t expose your files. Everything else should be off unless you have a specific reason for it.
Bonus: Use the Passwords App for Your Credentials
macOS Sequoia introduced a standalone Passwords app, a proper credential manager built into the OS with iCloud sync, passkey support, and Wi-Fi password sharing. If you’re still using the same password across multiple sites, or storing passwords in a Notes document, fix that now.
Open the Passwords app (it’s in your Applications folder) and let it flag any weak, reused, or compromised passwords. Passkeys replace passwords with Touch ID or Face ID authentication, are supported for a growing number of sites, and are meaningfully more secure than even strong passwords.
If you need more than what the built-in app offers, 1Password is the best third-party option for most people.
What These Steps Actually Protect Against
To be clear about what you’re getting here: these are defenses against opportunistic attacks. The person who finds your unlocked laptop, the script running on a compromised public hotspot, the thief who grabs your bag and tries to resell the hardware.
A determined, well-resourced attacker with physical access and time is a different problem. These steps will slow them down, not stop them. But that’s not who’s sitting at the next table at the airport.
Enable FileVault, set automatic updates, turn on the firewall, and use a VPN on public Wi-Fi. Do those four things and you’re already ahead of the vast majority of Mac users. The rest is just making the gap even wider.