RansomWhere? review
A free, open-source macOS utility for detecting and blocking ransomware-like behavior.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
RansomWhere? is a free, open-source macOS utility from Objective-See Foundation that focuses on ransomware detection rather than broad antivirus coverage. It is intended for Mac users who want a specialized defense against processes that rapidly create encrypted files. The utility continuously analyzes file entropy, identifies suspicious or untrusted processes, and can suspend a process when ransomware-like activity is detected. It supports macOS 10.15 or later and requires elevated privileges plus Full Disk Access.
Its standout feature is the behavior-based focus on encryption activity. When a process is flagged, RansomWhere? provides an alert with process and encrypted-file details, then lets the user allow or block that process. Rules can remember those decisions, reducing repeated prompts for known activity. Notarization mode provides another configuration option for trusting notarized applications, while configurable preferences and automatic-update checks give users control over how the utility operates.
The product's narrow scope is both its main strength and its clearest boundary. It provides real-time ransomware protection for macOS, but it is not positioned as complete antivirus coverage across other threat types or platforms. Users who specifically want free, open-source ransomware monitoring on a Mac should find its focused feature set relevant. Users seeking broader antivirus protection, multi-platform coverage, or a wider security suite should choose an alternative designed for those needs.
RansomWhere? pros and cons
- Where it wins
- Continuous real-time file-entropy analysis
- Suspends suspicious processes and shows encrypted-file details
- Open-source, free, and supports remembered allow/block rules
- Where it doesn't
- Focused on ransomware rather than complete antivirus coverage
- Requires macOS 10.15 or later
- Requires elevated privileges and Full Disk Access
RansomWhere? fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update