Sophos should be avoided, as it could actually increase your Mac's vulnerability?

Hi Nick,

There are two reasons we have processes that must run as root:

1) on-access scanning;

2) full system scanning in the background.

For the first item, best protection requires intercepting malicious software as soon as possible. It makes no sense to scan for malicious software after its already been installed; its better and safer to catch it just after its downloaded or copied to disk. Doing this requires elevated privilges.

For the second item, scanning every file and folder on your disk requires elevated privilges (we call it a "full system scan"). It makes no sense to scan only where a regular user can go, as malicious software could hide in all sorts of interesting places normally not reachable. And we want to do this in the background, without requiring a user to authorize that scanning operation every time.

For that reason, our product will always have some portions that run as root. We won't compromise our strategies for best protection just because someone thinks running as root is theoretically less secure than running as an unprivileged user. But we are always looking to improve the security of our software and running some subsystems with lower privilges is certainly one strategy to achieve this. So yes, don't be shocked when you see, over time, some of our software running as a non-root user.

Hope that helps!

Hi Nick,

There are two reasons we have processes that must run as root:

1) on-access scanning;

2) full system scanning in the background.

For the first item, best protection requires intercepting malicious software as soon as possible. It makes no sense to scan for malicious software after its already been installed; its better and safer to catch it just after its downloaded or copied to disk. Doing this requires elevated privilges.

For the second item, scanning every file and folder on your disk requires elevated privilges (we call it a "full system scan"). It makes no sense to scan only where a regular user can go, as malicious software could hide in all sorts of interesting places normally not reachable. And we want to do this in the background, without requiring a user to authorize that scanning operation every time.

For that reason, our product will always have some portions that run as root. We won't compromise our strategies for best protection just because someone thinks running as root is theoretically less secure than running as an unprivileged user. But we are always looking to improve the security of our software and running some subsystems with lower privilges is certainly one strategy to achieve this. So yes, don't be shocked when you see, over time, some of our software running as a non-root user.

Hope that helps!