A notarized app is software that has been checked by Apple before release and issued a certificate indicating it was scanned for malware. The certificate is used by macOS to verify the app has passed a screening step, which strengthens user trust and reduces the risk of distributing obviously malicious software.
What notarization means for macOS software
Notarization is Apple’s pre-release screening step for macOS software. It does not make an app trustworthy by itself, but it signals that Apple checked the app for known malware before it was distributed. For users and admins, the practical value is a higher-confidence gate before launch and installation.
In practice, notarization sits between software signing and runtime execution policy. A notarized app can still contain bugs, unwanted behaviour, or insecure design, but the certificate gives macOS a verifiable signal that the package passed Apple’s automated review process. That makes it a distribution trust control, not a full application security guarantee.
Why notarized apps matter
The main benefit is reducing the chance that obviously malicious software reaches a Mac user through normal download and install flows. Because the certificate is checked by macOS, notarization helps the platform distinguish software that has at least passed Apple’s screening from software that has not. This is especially important when users install apps outside a managed app store path.
Notarization also supports a broader trust decision for software distribution. It can help IT teams and users reject unsigned or unreviewed packages earlier, but it should be treated as one control layer among many. A notarized app may still be unsafe if it is poorly designed, overly privileged, or later tampered with after notarization.
What notarization does not prove
Notarization is often misunderstood as an endorsement of quality, privacy, or business legitimacy. It is none of those things. Apple’s scan is aimed at obvious malware indicators and packaging integrity signals, not at evaluating whether the app is necessary, well-coded, or safe for a particular environment.
It also does not remove the need to verify the developer, distribution channel, and downstream permissions the app requests. A notarized app can still request sensitive access, contact external services, or introduce operational risk if it is installed broadly without review. The certificate reduces one class of risk, but it does not replace normal software vetting.
How notarization fits into software trust decisions
For organisations, notarization is best treated as a screening signal inside a wider software trust workflow. It is useful when deciding whether a Mac application should be allowed to run, but it should be paired with source verification, package inspection, and endpoint policy controls. Apple’s own documentation and security guidance remain the authoritative source for how notarization is enforced.
Because notarization is tied to platform trust, it also belongs in a supply-chain mindset. A package can be notarized and still be unacceptable if it comes from an untrusted source, has changed after screening, or is deployed into a sensitive environment without review. That is why notarization should complement, not replace, software integrity checks and endpoint security controls such as SLSA for build provenance, CIS Benchmarks for host hardening, and NIST Cybersecurity Framework 2.0 for broader governance.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8, NIST CSF 2.0, SLSA and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-10 — Malware Defenses | Notarization is a malware-screening trust signal for software distribution. |
| Recommendation — Validate downloaded macOS apps with malware defenses before allowing execution. | ||
| NIST CSF 2.0 | PR.DS-08 — Integrity Verification | Notarization supports verifying software integrity before use. |
| Recommendation — Require integrity checks for macOS software before installation and runtime. | ||
| SLSA | Supply-chain Levels for Software Artifacts | Notarization fits software provenance and artifact-trust decisions. |
| Recommendation — Track build provenance and trust signals before approving software release. | ||
| NIST SP 800-53 Rev 5 | SI-3 — Malicious Code Protection | Notarization is a pre-execution malware screening signal aligned to code protection. |
| SA-12 — Supply Chain Protection | Notarized apps still depend on trustworthy acquisition and distribution paths. | |
| Recommendation — Scan software for malicious code before deployment and execution. Assure software provenance and acquisition trust across the delivery chain. | ||
Practitioner Guidance
Why practitioners should care: Notarization is a useful trust filter, but it is only one control in the software acceptance chain. Treat it as evidence that an app cleared Apple’s screening step, not as proof that the app is fit for unrestricted use.
Common misunderstanding: Teams sometimes assume notarized means safe by default. In reality, the control reduces obvious malware distribution risk, while security review still needs to cover source trust, change control, user permissions, and whether the app’s behaviour is acceptable in context.
Practitioner takeaway: Use notarization as a gate for execution trust, then layer it with your standard software approval, integrity, and endpoint policy checks before allowing wide deployment.
Related resources from NHI Mgmt Group
- Why can a single SaaS app create such a large blast radius?
- What is the difference between a service account and an OAuth-connected app?
- What is the difference between a disabled app and a deleted app in Microsoft 365?
- What is the difference between app visibility and identity visibility in SaaS security?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 31, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org