Several of those who have already updated to macOS Tahoe 26.2 have remarked how much larger their download was than the 3.78 GB expected for Apple silicon Macs, with some reporting over 10 GB. Here I ponder how that could happen.

How is macOS now updated?

My understanding of the broad processes involved in current macOS updates is that the total downloaded for Macs of the same architecture starting from the same version should be identical.

Major components required for each update include:

• contents of the System volume that have changed from the starting version for that update;
• standard cryptexes containing Safari and its supporting components, and dyld caches. The latter differ between Intel Macs, which only receive Intel versions, and Apple silicon Macs, which receive Intel versions to support Rosetta 2 as well as their own Arm versions. Those probably account for much of the difference in size between Intel and Apple silicon updates. Note that Apple silicon Macs may also require updates to cryptexes used in AI, but those are most likely obtained outside the macOS update;
• architecture-specific firmware;
• new Recovery system;
• the ‘update brain’ to run the update, including creation of the new SSV with its hash tree.

Those contrast with what’s required for a full installer upgrade (or reinstall), which consists of a single Universal app containing the whole contents of the SSV, cryptexes and firmware for both architectures, Recovery and the update brain.

Following decompression of the download, changed components are installed in the System volume, a snapshot made of that, and its hash tree is constructed. Updated cryptexes replace those from the previous version, the new Recovery system and firmware updates are installed.

For all Macs of both architectures being updated from the previous public release of macOS, creation of the new SSV should be identical, as their old SSVs are all signed with the same signature, as their contents are identical.

Combo updates

In any update, changed contents of the System volume depend greatly on the starting version of macOS installed. Updating from a previous beta can require different files to be replaced, compared with those from the last public release. In some cases, Apple may be able to provide a single updater that will convert both a Release Candidate and the last public release into the new version.

If that’s not feasible, Macs that are updating from a beta, or a public release before the last, will require what we used to call a Combo update, consisting of all changed contents since the last major version, in this case 26.0. Combo updates are inevitably significantly larger than single-step Delta updates from the last public release, but should remain smaller than a full installer.

Recent upgrades between major versions of macOS, such as 15.6 to 26.0, have tried to avoid full installers where possible, by adopting what’s effectively a Combo-style update, but slightly larger as a Combo+.

Thus, updates to 26.2 most probably consist of:

• a Delta update from the last public release, 26.1, which might also be suitable for some beta releases;
• a Combo update from 26.0, 26.0.1 or some beta releases.
• a Combo+ update or full installer from earlier major versions of macOS.

As later minor versions are released, the size of the Combo update rises, as it’s required to incorporate more changes than for previous updates.

What would be surprising would be for two Macs of the same architecture updating from the same starting version of macOS to be provided with updates of significantly different size. I look forward to hearing from you if you consider that happened with the 26.2 update.

No BSI/RSR

What is puzzling about the 26.2 update is that it wasn’t preceded by a Background Security Improvement (BSI) or Rapid Security Response (RSR). Two of the top security vulnerabilities fixed in 26.2 (and in the Safari updates for 15.7.3 and 14.8.3) are both in WebKit, which is supplied in the Safari cryptex. These are for CVEs 2025-43529 and 2025-14174. Both were documented as already being exploited in older versions of macOS, in sophisticated attacks on targeted individuals. Both would appear to have been suitable for distribution prior to 26.2 in updated cryptexes, either by the existing RSR system or its replacement in Tahoe 26.1 of the BSI.

This appears to have been another missed opportunity for an RSR/BSI to have proved its value.

Some who use SilentKnight for the first time discover that their Mac has been running for months with one of its security systems disabled. As macOS doesn’t have a dashboard to warn you of such dangerous settings, you may not notice until it’s too late. This article explains how to check those essential security settings on Macs with T2 or Apple silicon chips, and how to put them right. Intel Macs without T2 chips are different, and are covered in a previous version.

Secure Boot

Running your Mac in Full Security ensures it gets full protection from its Secure Boot technology. In an Apple silicon Mac this prevents it from loading third-party kernel extensions, and requires recent approved versions of macOS. Check this in System Information by selecting the Controller item in its Hardware section, or in SilentKnight.

This is controlled in Startup Security Utility, accessed from Recovery. Note that it only works with the paired Recovery system, the one you normally use; Apple silicon fallback Recovery doesn’t have this ability.

If you need to run kernel extensions or other software that can’t be loaded in Full Security, use Startup Security Utility to set the Mac to Reduced Security, and enable kexts. Avoid doing this if at all possible.

Settings are different for Intel Macs with T2 chips, where there are three levels of boot security, and the most common reason for reduction from Full Security is to enable that Mac to boot from external drives, something that Apple silicon Macs can do in Full Security.

System Integrity Protection (SIP)

Since El Capitan, macOS has protected all its system files, even down to bundled apps, using System Integrity Protection. This should make it impossible for malware or other software to change those protected files. SIP is also required for a wide range of other security protection, and should be fully enabled unless you have a compelling reason for disabling it partially or completely. In Apple silicon Macs, its status is reported in System Information’s Controller item, but Intel Macs instead give it in the Software section. It’s also checked by SilentKnight and Skint.

You can turn SIP off, something very occasionally needed to perform certain essential tasks. Doing so requires you to start up in Recovery mode, enter a command in Terminal there, and restart; Apple silicon Macs also need to have their boot security reduced in Startup Security Utility before SIP can be disabled.

To enable SIP, start up in Recovery mode, open Terminal, and type the following command:
csrutil enable; reboot
Once that’s done your Mac will restart in normal mode, and you should confirm that SIP is reported as enabled.

If you ever do need to disable SIP, do yourself a favour and put a sticky note on your Mac’s display to remind you to turn it back on.

Gatekeeper/XProtect

Gatekeeper runs checks on apps when they’re opened, and those can include scans for known malicious software using XProtect. As part of your Mac’s frontline protection against malware, you should leave those enabled unless there’s a compelling reason to temporarily disable them. However, I don’t know of anywhere in the macOS GUI that informs you whether these checks are being performed, although they are reported by SilentKnight and Skint.

If it has been disabled, you may be able to enable it using the command
spctl --enable
but chances are that you will instead need to invoke
sudo spctl --global-enable
requiring you to authenticate using your admin password. Be careful with those commands: the hyphens before enable and global-enable aren’t long dashes, but two separate hyphens.

Signed System Volume (SSV)

When you install Big Sur or later, the vast majority of its system files are saved in its System volume. For your Mac to boot from this, it has to be turned into a snapshot, sealed using a tree of cryptographic hashes, and the master seal ‘signed’ by a hash, which is compared against that set by Apple. This signed system volume is extremely secure and thoroughly reliable. On Intel Macs, this is only reported in Disk Utility, but Apple silicon Macs list it in System Information as well. It’s also reported by SilentKnight and Skint.

The SSV should always be enabled. If it isn’t, you’ll need to re-install macOS.

FileVault

Intel Macs with T2 chips and Apple silicon Macs encrypt the whole of the Data volume on their internal SSD. By default, that uses an internally-generated key that’s used automatically when any user logs in. Although it provides good security in most situations, you’re far better off enabling FileVault, as that protects the encryption key with your password as well. This imposes no overhead on accessing encrypted data, and provides valuable protection for your data at no cost.

Check whether FileVault is enabled in Privacy & Security settings, where you can enable it if it’s not already turned on. SilentKnight checks it as well.

macOS and firmware

To ensure your Mac and its apps are best protected from malware, keep its firmware and macOS up to date. As those are updated together, Macs with T2 or Apple silicon chips that are running the most recent release of their major version of macOS will also be running the current firmware, which no longer needs to be checked separately. Check the version of macOS in the About This Mac command at the top of the Apple menu.

Apple lists current supported versions of macOS on its Security Releases page. Those, and versions of security data software, are also listed and detailed here on this page.

If your Mac is running an older release of macOS and its firmware, update them together using Software Update in General settings.

XProtect Remediator scans

This anti-malware scanner performs automatic background scans to detect and remove a wide range of malicious software. It’s normally scheduled to run at least once a day, when your Mac is awake but not busy, and supplied with mains power. You’re wise to check that its scans are being run correctly, and will probably want to know if it has detected and remediated any malware. SilentKnight and Skint run a quick check of its activity over the previous 36 hours, and XProCheck provides detailed reporting and analysis.

Over the last year or so, XProtect Remediator has been using a timer during its scans, and automatically cancelling them if a scan takes longer than allowed. On many Macs, most scans are terminated early, and that results in warnings from SilentKnight and Skint. If you’re concerned, check the reports in XProCheck, where you’ll see that plugin was cancelled with a status_code of 30, as is typical with the timer.

Check:

• the Mac boots in Full Security, if possible,
• SIP is enabled,
• Gatekeeper/XProtect is enabled,
• it has booted from an SSV,
• FileVault is enabled,
• it’s up to date with macOS,
• XProtect Remediator scans are taking place daily.

SilentKnight does all of those and more.